feature request: audit log only if disruptive

[liudongmiao]

coreruleset v3 introduces Paranoia Level, assign score for rule, and evaluate in separate rule.

In some cases, the request is not disruptive, however it's logged in audit log. We'd like to log disruptive request only in product environment.

And, in DetectionOnly mode, the request is not disruptive at all, however, it should be logged too.

(Currently, we modify the source code, use severity level to check for log.)

[liudongmiao]

ctl:auditengine should solve this issue: #2606 However, it's rule based.

[martinhsv]

"In some cases .. "

Please provide at least one specific example where the current functionality is not what you would reasonably expect.

[liudongmiao]

@martinhsv As we use score-mode like CRS, when rule match, it doesn't mean disruptive or block.

We'd like to only log for disruptive requests.

SecRule ARGS "@rx ..." "id:1,setvar:evilscore+=2"

SecRule ARGS "@rx ..." "id:2,setvar:evilscore+=2"

TX:evilscore "@ge 8" "id:9,deny"

Then if only id-1 / id-2 matched, if it's not reached id-9 (score evaluation), then matched auditlog is off.
However, if it's reached id-9 (score evaluation), then show all-matched auditlog.

noauditlog for id-1 / id-2 cannot solve this problem, if id-9 is logged, there is no auditlog for id-1/id-2 at all.
auditlog for id-1/id-2 cannot solve this problem, if id-9 is not reached, there is always auditlog for id-1/id-2 if match.

[liudongmiao]

@martinhsv Actually, I have implemented all the feature request by me.
However, I'd like this can be implemented in to official ModSecurity to avoid maintain a forked ModSecurity.

[martinhsv]

Hi @liudongmiao ,

If you want to omit all writing to the audit log if the HTTP response code is 200, you could create a rule that tests RESPONSE_STATUS and include 'ctl:auditEngine=Off' in its actions. (Note that ctl:auditEngine is available in v3/master but not in the tagged version of v3.0.6 from last November.)

[martinhsv]

Hi @liudongmiao ,

Have you tried using that last suggestion? Since that posting, ctl:auditEngine has been available in multiple official releases (since v3.0.7).

[liudongmiao]

@martinhsv Yes, ctl:auditEngine solve my issues.