Detect user agent and execute action

Hello!

I would like to know what would be the best way I can do something similar to this (taken from ChatGPT). I would need to detect when there are many WP Rocket requests (User Agent -> “WP Rocket/Preload”) and if it exceeds more than X requests, execute a request to an external server to have it monitored Would it be possible?

So far what I have, which does not work, is:

SecAction "id:400020,phase:1,nolog,pass,t:none,setvar:tx.wp_rocket_counter=0"

SecRule REQUEST_HEADERS:User-Agent "@contains ?iRocket/Preload"
"id:400021,phase:1,nolog,pass,setvar:tx.wp_rocket_counter=+1"

SecRule TX:wp_rocket_counter "@gt 10"
"id:400022,phase:2,log,deny,status:403,msg:'Too many Rocket/Preload requests detected',
exec:'/usr/bin/curl --user-agent "phmodsec" -X POST https://api.domain.com/alert.php -d "alert=Too many Rocket/Preload requests detected"'"

Hopefully someone can lend a hand!

The issue contains only inline SecAction and SecRule snippets and names no repository files or tests. Start by reviewing the rule-processing and execution behavior relevant to these directives, then reproduce the request-counting scenario; done means the intended threshold and external notification behavior are clearly defined and verified.