Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit cf4d2f1

Browse files
fzipifzipi
authored
Add logdata to some rules (#980)
* Add logdata the rules proposed.
1 parent 4207ae0 commit cf4d2f1

File tree

2 files changed

+17
-1
lines changed

2 files changed

+17
-1
lines changed

‎rules/REQUEST-910-IP-REPUTATION.conf

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,7 @@ SecRule TX:HIGH_RISK_COUNTRY_CODES "!@rx ^$" \
6363
block,\
6464
t:none,\
6565
msg:'Client IP is from a HIGH Risk Country Location.',\
66+
logdata:'%{MATCHED_VAR}',\
6667
tag:'application-multi',\
6768
tag:'language-multi',\
6869
tag:'platform-multi',\

‎rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -423,6 +423,7 @@ SecRule REQUEST_URI "@rx \%(?:(?!$|\W)|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" \
423423
block,\
424424
t:none,\
425425
msg:'URL Encoding Abuse Attack Attempt',\
426+
logdata:'%{matched_var}',\
426427
tag:'application-multi',\
427428
tag:'language-multi',\
428429
tag:'platform-multi',\
@@ -443,6 +444,7 @@ SecRule REQUEST_HEADERS:Content-Type "@rx ^(?:application\/x-www-form-urlencoded
443444
block,\
444445
t:none,\
445446
msg:'URL Encoding Abuse Attack Attempt',\
447+
logdata:'%{matched_var}',\
446448
tag:'application-multi',\
447449
tag:'language-multi',\
448450
tag:'platform-multi',\
@@ -475,6 +477,7 @@ SecRule TX:CRS_VALIDATE_UTF8_ENCODING "@eq 1" \
475477
block,\
476478
t:none,\
477479
msg:'UTF8 Encoding Abuse Attack Attempt',\
480+
logdata:'%{matched_var}',\
478481
tag:'application-multi',\
479482
tag:'language-multi',\
480483
tag:'platform-multi',\
@@ -513,6 +516,7 @@ SecRule REQUEST_URI|REQUEST_BODY "@rx \%u[fF]{2}[0-9a-fA-F]{2}" \
513516
block,\
514517
t:none,\
515518
msg:'Unicode Full/Half Width Abuse Attack Attempt',\
519+
logdata:'%{matched_var_name}=%{matched_var}',\
516520
tag:'application-multi',\
517521
tag:'language-multi',\
518522
tag:'platform-iis',\
@@ -567,6 +571,7 @@ SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES "@validateByteRange 1-255" \
567571
block,\
568572
t:none,t:urlDecodeUni,\
569573
msg:'Invalid character in request (null character)',\
574+
logdata:'%{matched_var_name}=%{matched_var}',\
570575
tag:'application-multi',\
571576
tag:'language-multi',\
572577
tag:'platform-multi',\
@@ -821,6 +826,7 @@ SecRule &TX:MAX_NUM_ARGS "@eq 1" \
821826
block,\
822827
t:none,\
823828
msg:'Too many arguments in request',\
829+
logdata:'%{matched_var_name}=%{matched_var}',\
824830
tag:'application-multi',\
825831
tag:'language-multi',\
826832
tag:'platform-multi',\
@@ -846,6 +852,7 @@ SecRule &TX:ARG_NAME_LENGTH "@eq 1" \
846852
block,\
847853
t:none,\
848854
msg:'Argument name too long',\
855+
logdata:'%{matched_var_name}=%{matched_var}',\
849856
tag:'application-multi',\
850857
tag:'language-multi',\
851858
tag:'platform-multi',\
@@ -870,6 +877,7 @@ SecRule &TX:ARG_LENGTH "@eq 1" \
870877
block,\
871878
t:none,\
872879
msg:'Argument value too long',\
880+
logdata:'%{matched_var_name}=%{matched_var}',\
873881
tag:'application-multi',\
874882
tag:'language-multi',\
875883
tag:'platform-multi',\
@@ -894,6 +902,7 @@ SecRule &TX:TOTAL_ARG_LENGTH "@eq 1" \
894902
block,\
895903
t:none,\
896904
msg:'Total arguments size exceeded',\
905+
logdata:'%{matched_var_name}=%{matched_var}',\
897906
tag:'application-multi',\
898907
tag:'language-multi',\
899908
tag:'platform-multi',\
@@ -946,6 +955,7 @@ SecRule &TX:COMBINED_FILE_SIZES "@eq 1" \
946955
block,\
947956
t:none,\
948957
msg:'Total uploaded files size too large',\
958+
logdata:'%{matched_var_name}=%{matched_var}',\
949959
tag:'application-multi',\
950960
tag:'language-multi',\
951961
tag:'platform-multi',\
@@ -1189,6 +1199,7 @@ SecRule ARGS "@rx \%((?!$|\W)|[0-9a-fA-F]{2}|u[0-9a-fA-F]{4})" \
11891199
block,\
11901200
t:none,\
11911201
msg:'Multiple URL Encoding Detected',\
1202+
logdata:'%{matched_var}',\
11921203
tag:'application-multi',\
11931204
tag:'language-multi',\
11941205
tag:'platform-multi',\
@@ -1245,6 +1256,7 @@ SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES "@validateByteRange 9,10,13,
12451256
block,\
12461257
t:none,t:urlDecodeUni,\
12471258
msg:'Invalid character in request (non printable characters)',\
1259+
logdata:'%{matched_var_name}=%{matched_var}',\
12481260
tag:'application-multi',\
12491261
tag:'language-multi',\
12501262
tag:'platform-multi',\
@@ -1330,6 +1342,7 @@ SecRule REQUEST_URI|REQUEST_HEADERS|ARGS|ARGS_NAMES|REQUEST_BODY "@validateByteR
13301342
block,\
13311343
t:none,t:urlDecodeUni,\
13321344
msg:'Invalid character in request (outside of printable chars below ascii 127)',\
1345+
logdata:'%{matched_var_name}=%{matched_var}',\
13331346
tag:'application-multi',\
13341347
tag:'language-multi',\
13351348
tag:'platform-multi',\
@@ -1385,8 +1398,9 @@ SecRule ARGS|ARGS_NAMES|REQUEST_BODY "@validateByteRange 38,44-46,48-58,61,65-90
13851398
"id:920273,\
13861399
phase:2,\
13871400
block,\
1388-
msg:'Invalid character in request (outside of very strict set)',\
13891401
t:none,t:urlDecodeUni,\
1402+
msg:'Invalid character in request (outside of very strict set)',\
1403+
logdata:'%{matched_var_name}=%{matched_var}',\
13901404
tag:'application-multi',\
13911405
tag:'language-multi',\
13921406
tag:'platform-multi',\
@@ -1409,6 +1423,7 @@ SecRule REQUEST_HEADERS|!REQUEST_HEADERS:User-Agent|!REQUEST_HEADERS:Referer|!RE
14091423
block,\
14101424
t:none,t:urlDecodeUni,\
14111425
msg:'Invalid character in request headers (outside of very strict set)',\
1426+
logdata:'%{matched_var_name}=%{matched_var}',\
14121427
tag:'application-multi',\
14131428
tag:'language-multi',\
14141429
tag:'platform-multi',\

0 commit comments

Comments
 (0)