Re: [mod-security-users] Some filter questions

[Ivan R. <iv...@we...>]

BassPlayer wrote:
> I would like to filter these user agents
> 
>         User Agents:
>                 [360] Mozilla/4.75 [en] (X11, U; Nessus)
>                 [2] Nessus
> 
> From reading the manual I'm not sure what locations are equivilent to the
> User-Agent: entry in the log.
> 
> From this entry in the manual
> 
> HTTP_header – search request header "header" (HEADER_header also works as
> of 1.9)
> 
> I would guess it would be something like
> 
> SecFilterSelective HEADER_User-Agent Nessus

  Yup, that should do it.

-- 
Ivan Ristic, Technical Director
Thinking Stone, http://www.thinkingstone.com
ModSecurity: Open source Web Application Firewall