Re: Variable name for "data"

Hi Homesh,

probably tx.0 but try looking at the rule ID 11, on logdata action.

azurit





Citát homesh joshi <[email protected]>:

> Dear Franziska,
>
> Thanks for the reply.
> I shared partial Json as I wanted to showcase the important part.
> My requirement is simple. I wanted to know the variable name that holds the
> [data \"or 2=2\"] like rule.msg variable holds the [msg \"SQL Injection\"]
>
> Thanks,
> Homesh
>
>
> On Wed, Jun 1, 2022 at 7:44 PM Franziska Buehler <
> [email protected]> wrote:
>
>> Hi Homesh,
>>
>> That doesn't appear to be valid JSON. Can you please describe what you
>> want to do exactly and how you tried to achieve this??
>>
>> Best,
>> Franziska
>>
>>
>>
>> homesh joshi <[email protected]> schrieb am Di., 31. Mai 2022, 14:08:
>>
>>> Hi All,
>>>
>>> Please refer to the following from modsec logs in json format.
>>>
>>> [file \"/usr/share/modsec/rules/10_gen_rules.conf\"] [line \"283\"] [id
>>> \"11\"] [rev \"43\"] [msg \"SQL Injection\"] [data \"or 2=2\"] [severity
>>> \"CRITICAL\"]
>>>
>>> I am able to get the values of msg, id &  severity variables(using
>>> rule.msg,rule.id,rule.severity) but I can't find the variable name for
>>> data ([data \"or 2=2\"])
>>>
>>> I have searched on google as well as on modsec handbook pdf but can't
>>> find the name.
>>>
>>> Can someone share some info on this please.
>>>
>>> Thanks,
>>> Homesh
>>>
>>>
>>> _______________________________________________
>>> mod-security-users mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>>> http://www.modsecurity.org/projects/commercial/rules/
>>> http://www.modsecurity.org/projects/commercial/support/
>>>
>> _______________________________________________
>> mod-security-users mailing list
>> [email protected]
>> https://lists.sourceforge.net/lists/listinfo/mod-security-users
>> Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
>> http://www.modsecurity.org/projects/commercial/rules/
>> http://www.modsecurity.org/projects/commercial/support/
>>





_______________________________________________
mod-security-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/mod-security-users
Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs:
http://www.modsecurity.org/projects/commercial/rules/
http://www.modsecurity.org/projects/commercial/support/