owasp-modsecurity / owasp-modsecurity/ModSecurity
Nginx libmodsecurity v3.0 JSON Log format don't show alert action description
@victorhora is already working on this.
Since Mar 30, 2019.
- Dominant language
- C++
- Stars
- 9.8k
- Forks
- 1.8k
- Avg merge
- 2h 46m
- Merged PRs (30d)
- 1
Description
I want to set up and use json logformat. See the modsecurity.conf settings below.
SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogFormat JSON
SecAuditLogType Concurrent
SecAuditLogStorageDir /var/log/modsec
However, the log file does not display an Alert Action Description such as "Message: Access denied with code 403 (phase 2)." And Action Log trailer actions such as "Intercepted (phase 2)" are not displayed.
My company uses the Alert Action and Log Trailer Action in SIEM to determine whether the transaction is an alert or block.
The Alert Action Description is always displayed on Native Log format
when i set json log format in modsecurity 3.x , i hope that alert action can also be displayed.
Is there no way?
Logs and dumps
Output of:
- DebugLogs (level 9)
Not relevant - AuditLogs
{"transaction":{"client_ip":"127.0.0.1","time_stamp":"Tue Mar 26 14:43:03 2019","server_id":"70cb38a1c36b322ec111f48cc15c3f8c9215ae58","client_port":55630,"host_ip":"127.0.0.1","host_port":80,"unique_id":"155357898313.262841","request":{"method":"GET","http_version":1.1,"uri":"/foo?testparam=thisisatestofmodsecurity","headers":{"User-Agent":"curl/7.29.0","Host":"localhost","Accept":"/"}},"response":{"http_code":403,"headers":{"Server":"nginx/1.14.2","Date":"Tue, 26 Mar 2019 05:43:03 GMT","Content-Length":"169","Content-Type":"text/html","Connection":"keep-alive"}},"producer":{"modsecurity":"ModSecurity v3.0.3 (Linux)","connector":"ModSecurity-nginx v1.0.0","secrules_engine":"Enabled","components":["OWASP_CRS/3.1.0""]},"messages":[{"message":"BSW Method is not allowed by policy","details":{"match":"Matched "OperatorUnconditionalMatch' with parameter' against variableREQUEST_METHOD' (Value:GET' )","reference":"v0,3","ruleId":"7000",
"file":"/etc/nginx/modsec/crs-3.1.0/rules/REQUEST-911-METHOD-ENFORCEMENT.conf","lineNumber":"49","data":"GET","severity":"2","ver":"OWASP_CRS/3.1.0","rev":"","tags":["application-multi","language-multi","platform-multi","attack-generic","OWASP_CRS/POLICY/METHOD_NOT_ALLOWED","WASCTC/WASC-15","OWASP_TOP_10/A6","OWASP_AppSensor/RE1","PCI/12.1"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Score: 5)","details":{"match":"Matched "OperatorGe' with parameter5' against variableTX:ANOMALY_SCORE' (Value:5' )","reference":"","ruleId":"949110","file":"/etc/nginx/modsec/crs-3.1.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"80","data":"","severity":"2","ver":"","rev":"","tags":["application-multi","language-multi","platform-multi","attack-generic"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): BSW Method is not allowed by policy; individual paranoia level scores: 5, 0, 0, 0","details":{"match":"Matched "OperatorGe' with parameter5' against variableTX:INBOUND_ANOMALY_SCORE' (Value:5' )","reference":"","ruleId":"980130","file":"/etc/nginx/modsec/crs-3.1.0/rules/RESPONSE-980-CORRELATION.conf","lineNumber":"76","data":"","severity":"0","ver":"","rev":"","tags":["event-correlation"],"maturity":"0","accuracy":"0"}}]}} - Error logs
Not relevant - If there is a crash, the core dump file.
Not relevant
Server (please complete the following information):
- ModSecurity version (and connector):
ModSecurity v3.0.3 with nginx-connector v1.0.0 - WebServer: [e.g. nginx-1.14.2]
- OS
centos 7.x
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.