Re: [Prelude Hybrid IDS] #216: mod_security cleanup, and compatibility with version 2.0
"Prelude Hybrid IDS" <[email protected]> Tue, 12 Aug 2008 14:16:32 -0000
| Newsgroups | gmane.comp.security.ids.prelude.devel |
|---|---|
| Message-ID | <[email protected]> |
#216: mod_security cleanup, and compatibility with version 2.0 -------------------------+-------------------------------------------------- Reporter: gegomez | Owner: Peter Vrabec <[email protected]> Type: defect | Status: assigned Priority: normal | Milestone: Prelude-LML 0.9.13 Component: prelude-lml | Version: 0.9 Severity: normal | Resolution: Keywords: | -------------------------+-------------------------------------------------- Comment(by [email protected]): Replying to [comment:18 yoann]: > > > * What is ModSec Rule ID? > > > > This is the ID of the mod_security rule that generated the log entry. > > Is the RuleID tied to the "msg" part of the log (aka: one ID per msg)? Yes. > I am wondering whether we should use the "msg" part directly within classification.text. > ... > Do you have any opinion on the matter? The msg part can be very long and very specific. For example: "Injection of Undocumented ColdFusion Tags. Matched signature <%{TX.0}>" In error_log %{TX.0} is substituted with data from the session that triggered this alert. I thought that the classification.text should contain the 2 main alerts that modsecurity generates: warning and access denied. Should it be more specific? > How many different msg are there in current ModSecurity rules? # sed -n "s/.*msg:'\([^']*\)'.*/\1/p" /etc/httpd/modsecurity.d/*.conf | sort | uniq | wc -l[[BR]] 64 ...and probably more in the latest version. -- Ticket URL: <https://trac.prelude-ids.org/ticket/216#comment:19> Prelude Hybrid IDS <http://www.prelude-ids.org> The Prelude Hybrid Intrusion Detection System suite _______________________________________________ Prelude-devel site list [email protected] http://lists.prelude-ids.org/mailman/listinfo/prelude-devel