mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-03 09:20:18 +03:00
Mahipal
2fb6a9faff
Each rewritten description now states both what the skill does (concrete capability, named tools/artifacts) and an explicit when-to-use trigger, improving agent discovery/activation. Grounded in each skill's own body; changes confined to the `description` field only (bodies and all other frontmatter untouched). Produced by a gated audit->rewrite->recheck loop (548 -> 0 flagged) with a sampled anti-invention check (0 ungrounded). Schema: 817/817 pass. Framework-ID gate: 0 defects.
77 lines
2.4 KiB
Markdown
77 lines
2.4 KiB
Markdown
---
|
|
name: implementing-web-application-logging-with-modsecurity
|
|
description: Configure ModSecurity WAF with the OWASP Core Rule Set (CRS) for web
|
|
application audit logging, tuning SecRuleEngine, SecAuditEngine, and CRS paranoia
|
|
levels to reduce false positives, and writing custom SecRules for application-specific
|
|
threats. Use when deploying or tuning a ModSecurity WAF, analyzing audit logs for
|
|
attack detection, or reducing CRS false positives.
|
|
domain: cybersecurity
|
|
subdomain: web-application-security
|
|
tags:
|
|
- modsecurity
|
|
- waf
|
|
- crs
|
|
- owasp
|
|
- web-security
|
|
- audit-logging
|
|
- rule-tuning
|
|
version: '1.0'
|
|
author: mahipal
|
|
license: Apache-2.0
|
|
nist_ai_rmf:
|
|
- MEASURE-2.7
|
|
- MAP-5.1
|
|
- MANAGE-2.4
|
|
atlas_techniques:
|
|
- AML.T0070
|
|
- AML.T0066
|
|
- AML.T0082
|
|
nist_csf:
|
|
- PR.PS-01
|
|
- ID.RA-01
|
|
- PR.DS-10
|
|
- DE.CM-01
|
|
mitre_attack:
|
|
- T1190
|
|
- T1059.007
|
|
- T1505.003
|
|
- T1083
|
|
---
|
|
# Implementing Web Application Logging with ModSecurity
|
|
|
|
## Overview
|
|
|
|
ModSecurity is an open-source WAF engine that works with Apache, Nginx, and IIS. The OWASP
|
|
Core Rule Set (CRS) provides generic attack detection rules covering SQL injection, XSS,
|
|
RCE, LFI, and other OWASP Top 10 attacks. ModSecurity logs full request/response data in
|
|
audit logs for forensic analysis and generates alerts that feed into SIEM platforms.
|
|
|
|
|
|
## When to Use
|
|
|
|
- When deploying or configuring implementing web application logging with modsecurity capabilities in your environment
|
|
- When establishing security controls aligned to compliance requirements
|
|
- When building or improving security architecture for this domain
|
|
- When conducting security assessments that require this implementation
|
|
|
|
## Prerequisites
|
|
|
|
- Web server (Apache 2.4+ or Nginx) with ModSecurity v3 module
|
|
- OWASP CRS v4.x installed
|
|
- Log aggregation infrastructure (ELK, Splunk, or Wazuh)
|
|
|
|
## Steps
|
|
|
|
1. Install ModSecurity and configure SecRuleEngine in DetectionOnly mode
|
|
2. Deploy OWASP CRS v4 and set paranoia level (PL1-PL4)
|
|
3. Configure SecAuditEngine for relevant-only logging
|
|
4. Tune false positives with SecRuleRemoveById and rule exclusions
|
|
5. Switch to blocking mode (SecRuleEngine On) after tuning period
|
|
6. Forward audit logs to SIEM for correlation and alerting
|
|
|
|
## Expected Output
|
|
|
|
```
|
|
ModSecurity: Warning. Pattern match "(?:union\s+select)" [file "/etc/modsecurity/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "45"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [severity "CRITICAL"]
|
|
```
|