mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
66 lines
2.1 KiB
Markdown
66 lines
2.1 KiB
Markdown
# ModSecurity WAF Logging — API Reference
|
|
|
|
## Key ModSecurity Directives
|
|
|
|
| Directive | Description |
|
|
|-----------|-------------|
|
|
| `SecRuleEngine On/Off/DetectionOnly` | Enable/disable rule engine |
|
|
| `SecAuditEngine On/Off/RelevantOnly` | Configure audit logging scope |
|
|
| `SecAuditLog /path/to/modsec_audit.log` | Audit log file path |
|
|
| `SecAuditLogParts ABCDEFHZ` | Audit log sections to include |
|
|
| `SecRequestBodyAccess On` | Inspect request bodies |
|
|
| `SecResponseBodyAccess On` | Inspect response bodies |
|
|
| `SecRuleRemoveById <id>` | Disable specific rule by ID |
|
|
| `SecRuleUpdateTargetById <id> "!ARGS:param"` | Exclude parameter from rule |
|
|
|
|
## Audit Log Sections
|
|
|
|
| Section | Contents |
|
|
|---------|----------|
|
|
| A | Audit log header (timestamp, transaction ID) |
|
|
| B | Request headers |
|
|
| C | Request body |
|
|
| E | Response body |
|
|
| F | Response headers |
|
|
| H | Audit log trailer (rule matches, scores) |
|
|
| Z | End of entry marker |
|
|
|
|
## OWASP CRS Rule ID Ranges
|
|
|
|
| Range | Category |
|
|
|-------|----------|
|
|
| 911xxx | Method Enforcement |
|
|
| 920xxx | Protocol Enforcement |
|
|
| 930xxx | Local File Inclusion |
|
|
| 932xxx | Remote Code Execution |
|
|
| 941xxx | Cross-Site Scripting (XSS) |
|
|
| 942xxx | SQL Injection |
|
|
| 944xxx | Java/Spring Attack |
|
|
| 949xxx | Inbound Anomaly Score Blocking |
|
|
|
|
## CRS Paranoia Levels
|
|
|
|
| Level | Description |
|
|
|-------|-------------|
|
|
| PL1 | Default — low false positives, covers common attacks |
|
|
| PL2 | Moderate — adds more patterns, some tuning needed |
|
|
| PL3 | High — aggressive detection, significant tuning needed |
|
|
| PL4 | Extreme — maximum coverage, heavy tuning required |
|
|
|
|
## Configuration Example
|
|
|
|
```apache
|
|
SecRuleEngine DetectionOnly
|
|
SecAuditEngine RelevantOnly
|
|
SecAuditLogRelevantStatus "^(?:5|4(?!04))"
|
|
SecAuditLogParts ABCDEFHZ
|
|
SecAuditLogType Serial
|
|
SecAuditLog /var/log/modsec_audit.log
|
|
```
|
|
|
|
## External References
|
|
|
|
- [ModSecurity v3 Reference Manual](https://github.com/owasp-modsecurity/ModSecurity/wiki/Reference-Manual-(v3.x))
|
|
- [OWASP CRS Documentation](https://coreruleset.org/docs/)
|
|
- [CRS Tuning Guide](https://coreruleset.org/docs/concepts/false_positives_tuning/)
|