Overhauling the CRS Tags

Mon, 08 Jun 2020 21:13:59 +0200

Tagging rules is a great feature of ModSecurity since it allows you to add information to your ModSec alert messages. In my tutorial on Embedding ModSec over at netnea.com, I use the tag feature in the default action to add a tag to every alert message from a given service. I do this as follows:

SecDefaultAction "phase:2,pass,log,tag:'Local Lab Service'"

One of my customers uses a shortcut URI as the tag. So when an alert pops up, the SoC person can click on the tag, the URI is being expanded (redirection service) and she ends up on a wiki page giving her all the infos about a given service with purpose, architecture, host IDs, security classification and contact information.

CAPEC on CRS Project

Overhauling the CRS Tags