All rules require IDs and it’s easiest to add the ID as part of the preceding rule in the chain. Most of the time, when writing an inspectFile rule, you will need to make it chained.

Write a script which does the inspectFile and outputs the values expected.

The steps for using Write a rule using inspectFile

Additional SpiderLabs (OpenLiteSpeed) Requirements.

Using enable-owasp-modsecurity-crs: 'true' we enable the use of the rules. The directory /etc/nginx/owasp-modsecurity-crs contains the OWASP ModSecurity Core Rule Set repository. The CRS aims to protect web applications from a wide range of attacks, including the OWASP Top Ten, with a minimum of false alerts. The OWASP ModSecurity Core Rule Set (CRS) is a set of generic attack detection rules for use with ModSecurity or compatible web application firewalls.

The default Serial value in SecAuditLogType can impact performance.

Due to the value of the setting SecAuditLogType=Concurrent the ModSecurity log is stored in multiple files inside the directory /var/log/audit. Note: the default configuration use detection only, because that minimizes the chances of post-installation disruption.

To enable the ModSecurity feature we need to specify enable-modsecurity: 'true' in the configuration configmap. Using a volume we can replace this file with the desired configuration. This is the only file located in this directory and contains the default recommended configuration. The default ModSecurity configuration file is located in /etc/nginx/modsecurity/nf. The ModSecurity-nginx connector is the connection point between NGINX and libmodsecurity (ModSecurity v3). It has a robust event-based programming language which provides protection from a range of attacks against web applications and allows for HTTP traffic monitoring, logging and real-time analysis. ModSecurity is an open source, cross platform web application firewall (WAF) engine for Apache, IIS and Nginx that is developed by Trustwave's SpiderLabs. Custom DH parameters for perfect forward secrecy.

NGINX Configuration NGINX Configuration.

Modsecurity owasp vs comodo