Re: Audit data messages

Thank you so much,
Mattia

Il giorno mar 27 ago 2019 alle ore 11:45 Christian Folini <
[email protected]> ha scritto:

> Hey Mattia,
>
> That information is controlled by the rule via the "logdata" action.
>
> Ahoj,
>
> Christian
>
> On Tue, Aug 27, 2019 at 10:58:02AM +0200, mattia conversano wrote:
> > Hi Guys,
> >
> > I'm interested in how messages are formatted in audit data (json or
> native)
> > logs.
> > my question is:
> > When some rule detects some threat, does it always insert in
> > *[data "text of the threat"]* ?
> >
> > For example when i try to do a sql injection, the malicius string in
> > inserted in something like this:
> > [data \"Matched Data: s&1c found within ARGS:username: [email protected]' and
> > 1=1 -- \"]
> >
> > Thanks in advance,
> > Mattia
>
>
> > _______________________________________________
> > mod-security-users mailing list
> > [email protected]
> > https://lists.sourceforge.net/lists/listinfo/mod-security-users
> > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> > http://www.modsecurity.org/projects/commercial/rules/
> > http://www.modsecurity.org/projects/commercial/support/
>
>
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/