Hi Ryan,
yes, in section H I've:

WebApp-Info: "MYSITE.COM" "-" "-"


On Fri, Dec 18, 2009 at 8:44 PM, Ryan Barnett <Ryan.Barnett@breach.com> wrote:

Have you confirmed in the actual raw event file the the webappid data is present in section H?

Ryan C. Barnett
Director of Application Security Research
Breach Security, Inc.

From: Nicola Bianchi
To: Mod Security
Sent: Fri Dec 18 10:01:54 2009
Subject: [mod-security-users] ModSecurity Console & Group by Application
Hi guys,
we have a problem sorting the alerts on the console by application.

Following the instructions in the user manual and in the new book of Ivan we have done this:

    SecWebAppId MYAPP.COM

On the console when we group by application we only see APP:none.
Any idea?