owasp-modsecurity / owasp-modsecurity/ModSecurity

Nginx libmodsecurity v3.0 JSON Log format don't show alert action description

Open
#2,054 0 comments 0 reactions 1 assignee View on GitHub

@victorhora is already working on this.

Since Mar 30, 2019.

3.x enhancement
Dominant language
C++
Stars
9.8k
Forks
1.8k
Avg merge
2h 46m
Merged PRs (30d)
1

Description

I want to set up and use json logformat. See the modsecurity.conf settings below.

SecAuditEngine RelevantOnly
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
SecAuditLogParts ABIJDEFHZ
SecAuditLogFormat JSON
SecAuditLogType Concurrent
SecAuditLogStorageDir /var/log/modsec

However, the log file does not display an Alert Action Description such as "Message: Access denied with code 403 (phase 2)." And Action Log trailer actions such as "Intercepted (phase 2)" are not displayed.
My company uses the Alert Action and Log Trailer Action in SIEM to determine whether the transaction is an alert or block.
The Alert Action Description is always displayed on Native Log format
when i set json log format in modsecurity 3.x , i hope that alert action can also be displayed.
Is there no way?

Logs and dumps

Output of:

  1. DebugLogs (level 9)
    Not relevant
  2. AuditLogs
    {"transaction":{"client_ip":"127.0.0.1","time_stamp":"Tue Mar 26 14:43:03 2019","server_id":"70cb38a1c36b322ec111f48cc15c3f8c9215ae58","client_port":55630,"host_ip":"127.0.0.1","host_port":80,"unique_id":"155357898313.262841","request":{"method":"GET","http_version":1.1,"uri":"/foo?testparam=thisisatestofmodsecurity","headers":{"User-Agent":"curl/7.29.0","Host":"localhost","Accept":"/"}},"response":{"http_code":403,"headers":{"Server":"nginx/1.14.2","Date":"Tue, 26 Mar 2019 05:43:03 GMT","Content-Length":"169","Content-Type":"text/html","Connection":"keep-alive"}},"producer":{"modsecurity":"ModSecurity v3.0.3 (Linux)","connector":"ModSecurity-nginx v1.0.0","secrules_engine":"Enabled","components":["OWASP_CRS/3.1.0""]},"messages":[{"message":"BSW Method is not allowed by policy","details":{"match":"Matched "Operator UnconditionalMatch' with parameter ' against variable REQUEST_METHOD' (Value: GET' )","reference":"v0,3","ruleId":"7000",
    "file":"/etc/nginx/modsec/crs-3.1.0/rules/REQUEST-911-METHOD-ENFORCEMENT.conf","lineNumber":"49","data":"GET","severity":"2","ver":"OWASP_CRS/3.1.0","rev":"","tags":["application-multi","language-multi","platform-multi","attack-generic","OWASP_CRS/POLICY/METHOD_NOT_ALLOWED","WASCTC/WASC-15","OWASP_TOP_10/A6","OWASP_AppSensor/RE1","PCI/12.1"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Score: 5)","details":{"match":"Matched "Operator Ge' with parameter 5' against variable TX:ANOMALY_SCORE' (Value: 5' )","reference":"","ruleId":"949110","file":"/etc/nginx/modsec/crs-3.1.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"80","data":"","severity":"2","ver":"","rev":"","tags":["application-multi","language-multi","platform-multi","attack-generic"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Inbound Score: 5 - SQLI=0,XSS=0,RFI=0,LFI=0,RCE=0,PHPI=0,HTTP=0,SESS=0): BSW Method is not allowed by policy; individual paranoia level scores: 5, 0, 0, 0","details":{"match":"Matched "Operator Ge' with parameter 5' against variable TX:INBOUND_ANOMALY_SCORE' (Value: 5' )","reference":"","ruleId":"980130","file":"/etc/nginx/modsec/crs-3.1.0/rules/RESPONSE-980-CORRELATION.conf","lineNumber":"76","data":"","severity":"0","ver":"","rev":"","tags":["event-correlation"],"maturity":"0","accuracy":"0"}}]}}
  3. Error logs
    Not relevant
  4. If there is a crash, the core dump file.
    Not relevant

Server (please complete the following information):

  • ModSecurity version (and connector):
    ModSecurity v3.0.3 with nginx-connector v1.0.0
  • WebServer: [e.g. nginx-1.14.2]
  • OS
    centos 7.x

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.