[mod-security-users] Advice for moving forward with more CRS rules

[Jamie B. <ja...@ib...>]

Hello

I'm hoping for some general advice on next steps for my EL7 / Apache 2.4 / Mod Security 2.9 / OWASP CRS setup please. This is potentially more of a CRS question, so apologies if this is the wrong place to pose the question and I'd appreciate any pointers as to where I could ask this. Server Fault hasn't yielding any response.

I had a requirement to rate limit some URL paths and to (attempt to) block some well known scripting user agents and have successfully achieved both of these things using a custom mod_security rule for the rate limit and the OWASP CRS rules pertaining to scripting user agents.

For the moment, I've disabled pretty much all of the CRS rules except for the scanners. I needed to increase the Paranoia Level (PL) to 2 before those rules I needed were activated.

I'd now like to look at enabling more of the CRS but in a monitored and controlled way, but this now poses a problem. I have a rate limit rule live and working and CRS rules at PL2 just for script scanner detection. I'm not able to put mod_security in detection only mode, because I have live rules working. I can change the blocking actions for the anomaly detection rules to pass and log, but this will deactivate my scanner rules. And I'm stuck with PL2 in order to get the scanner rules I need.

I'm unsure how to proceed in a controlled way to monitor further CRS rules without them actually blocking - and whether or not I'm stuck with PL2 for all other rules because of what I need for the scanners.

Would really appreciate any pointers, this conundrum is driving me mad.

Thanks in advance
Jamie