|
From: Christian F. <chr...@ne...> - 2026-10-22 12:29:52
|
Hi Brent, That's not possible out of the box. What you can either do is to move the rules you are interested into PL1 via a script. Ervin has published a couple of tools to edit the rule set via a script. Or you enable PL2 and disable all non-RCE PL2 rules via SecRuleRemoveById. You can determine the list of the rule ids via said tools by Ervin or you grep your way to a useful result. Best, Christian On Thu, Oct 22, 2026 at 01:55:58PM +0200, Brent Clark wrote: > Good day Guys > > We want to retain PL1 as our overall paranoia level and avoid enabling > unrelated PL2 rules. > > Is it at all possible run / include rule (i.e id:932239) from > owasp-modsecurity-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf > > Hope to include the id 932239 in crs-setup.conf, > > I'd appreciate any advice or examples from anyone who has implemented > something similar. > > Thanks in advance for your help. > > Regards > Brent > > > > _______________________________________________ > mod-security-users mailing list > mod...@li... > https://lists.sourceforge.net/lists/listinfo/mod-security-users > Commercial ModSecurity Rules and Support from Trustwave's SpiderLabs: > http://www.modsecurity.org/projects/commercial/rules/ > http://www.modsecurity.org/projects/commercial/support/ |
