Re: Modsecurity ClamAV integration Filename and Virus name details

Dear Azur,

Yes I was able to do the testing using your plugin.
I want to report the filename also in the reporting dashboard saying that
filename = xyz.pdf virusname=abc
Now I am able to get the virusname but want to know the filename as well.

Thanks,
Homesh


On Mon, Oct 18, 2021 at 12:06 PM <[email protected]> wrote:

> Hi Homesh,
>
>
> > Thank you very much for the suggestion on antivirus plugin.
> > I tested the antivirus plugin with CRS I have following queries
>
>
> You are welcome! Is plugin working ok for you?
>
>
>
> > Is CRS a prerequisite for this plugin ? as I don't use CRS I want to use
> > this without CRS. I understand this plugin rule uses LUA script.
>
>
> I cannot guarantee it for the future but, currently, it should work
> also without CRS.
>
>
>
> > I was able to see the virus name in the logs, however what is the
> variable
> > name for the filename which was scanned. so I will call that variable
> > inside the TAG or msg
>
>
> Filename if get directly from Modsecurity using FILES_TMPNAMES
> variable but it's only a temporary name of the uploaded file.
>
>
>
> azur
>
>
>
>
> > Thanks,
> > Homesh
> >
> >
> > On Mon, Oct 4, 2021 at 1:40 PM homesh joshi <[email protected]> wrote:
> >
> >> Thanks will test this and update you soon.
> >>
> >> On Mon, 4 Oct, 2021, 1:33 pm , <[email protected]> wrote:
> >>
> >>> Hi,
> >>>
> >>> if you are using CRS, please check this:
> >>> https://github.com/coreruleset/antivirus-plugin
> >>>
> >>> azur
> >>>
> >>>
> >>> Citát homesh joshi <[email protected]>:
> >>>
> >>> > Hi All,
> >>> >
> >>> > Hope you all are well.
> >>> > I have done the Modsecurity and ClamAV integration and am now able to
> >>> block
> >>> > the malicious file upload. I wanted to get the filename and virus
> name
> >>> > details inside modsec audit logs.
> >>> >
> >>> > I am not able to find any documentation on this. Can you please share
> >>> any
> >>> > document or tutorial on this ?
> >>> >
> >>> > Thanks,
> >>> > Homesh
> >>>
> >>>
> >>>
> >>>
> >>>
> >>> _______________________________________________
> >>> mod-security-users mailing list
> >>> [email protected]
> >>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> >>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> >>> http://www.modsecurity.org/projects/commercial/rules/
> >>> http://www.modsecurity.org/projects/commercial/support/
> >>>
> >>
>
>
>
>
>
> _______________________________________________
> mod-security-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/mod-security-users
> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
> http://www.modsecurity.org/projects/commercial/rules/
> http://www.modsecurity.org/projects/commercial/support/
>

_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/