Re: Audit data messages

Hey Mattia,

That information is controlled by the rule via the "logdata" action.

Ahoj,

Christian

On Tue, Aug 27, 2019 at 10:58:02AM +0200, mattia conversano wrote:
> Hi Guys,
> 
> I'm interested in how messages are formatted in audit data (json or native)
> logs.
> my question is:
> When some rule detects some threat, does it always insert in
> *[data "text of the threat"]* ?
> 
> For example when i try to do a sql injection, the malicius string in
> inserted in something like this:
> [data \"Matched Data: s&1c found within ARGS:username: [email protected]' and
> 1=1 -- \"]
> 
> Thanks in advance,
> Mattia


> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/



_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/