Журналирование событий фильтра безопасности#

filters:
  filter_mds:
    custom_rules:
      - owasp-crs/crs-setup.conf
      - owasp-crs/rules/*.conf

filters:
  filter_mds:
    config:
      SecAuditLogType: Syslog|Concurrent|Serial

if ($programname startswith "sowa-modsecurity") then {
    action(type="omfile" file="/sowalogs/sowa-mds.log" flushOnTXEnd="on")
    stop
}

localhost:8091 x.x.x.x - [24/Dec/2019:14:47:22 +0300] "GET /payments/v4/banking/products/p2bpayments/mobile-main/main?connectdselectfrom HTTP/1.1" 500 298 - "curl/7.29.0" 157718804246.059708 - /sowalogs/uko_web/services/service_main_proxy/1_mds/20191224/20191224-1447/20191224-144722-157718804246.059708 0 2564.000000 md5:998bf6e95ee710bf07a7243b992c480a

{"transaction":{"client_ip":"x.x.x.x","time_stamp":"Tue Dec 24 14:47:22 2019","server_id":"4dd156df48891b6fb2981a221801cdec879fb08c","client_port":0,"host_ip":"x.x.x.x","host_port":12147,"unique_id":"157718804246.059708","request":{"method":"GET","http_version":1.1,"uri":"/payments/v4/banking/products/p2bpayments/mobile-main/main?connectdselectfrom","headers":{"Host":"localhost:8091","X-Real-IP":"x.x.x.x","Connection":"close","Content-Length":"5","User-Agent":"curl/7.29.0","Accept":"*/*","Content-Type":"application/json","Origin":"front.ift-node2.testonline.mycompany.ru","X-Forwarded-For":"127.0.0.1"}},"response":{"body":"{\n\t\"status\": {\n\t\t\"code\": 3,\n\t\t\"errors\": [\n\t\t\t{\n\t\t\t\t\"id\": \"EFSGW-100\",\n\t\t\t\t\"element\": \"\",\n\t\t\t\t\"title\": \"datapower\",\n\t\t\t\t\"description\": \"Неизвестная run-time ошибка\"\n\t\t\t}\n\t\t],\n\t\t\"warnings\": [\n\t\t\t{\n\t\t\t\t\"id\": \"\",\n\t\t\t\t\"element\": \"\",\n\t\t\t\t\"title\": \"\",\n\t\t\t\t\"description\": \"\"\n\t\t\t}\n\t\t]\n\t}\n}\n","http_code":500,"headers":{"Access-Control-Allow-Methods":"","Date":"Tue, 24 Dec 2019 11:47:21 GMT","Access-Control-Allow-Headers":"","Access-Control-Allow-Credentials":"true","Server":"SOWA","Server":"SOWA","Connection":"close","Access-Control-Allow-Origin":"front.ift-node2.testonline.mycompany.ru","Content-Type":"application/json;charset=UTF-8","Content-Length":"298","Access-Control-Max-Age":""}},"producer":{"modsecurity":"ModSecurity v3.0.3 (Linux)","connector":"ModSecurity-nginx v1.0.0","secrules_engine":"Enabled","components":[]},"messages":[{"message":"GET or HEAD Request with Body Content.","details":{"match":"Matched \"Operator `Rx' with parameter `^0?$' against variable `REQUEST_HEADERS:Content-Length' (Value: `5' )","reference":"o0,3v0,3v167,1","ruleId":"7036","file":"/sowa/profile_storage/custom/uko_web/ufs_rules/REQ.conf","lineNumber":"84","data":"GET","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"1","tags":[],"maturity":"9","accuracy":"9"}},{"message":"GET or HEAD Request with Body Content.","details":{"match":"Matched \"Operator `Rx' with parameter `^0?$' against variable `REQUEST_HEADERS:Content-Length' (Value: `5' )","reference":"o0,3v0,3v167,1","ruleId":"7036","file":"/sowa/profile_storage/custom/uko_web/ufs_rules/REQ.conf","lineNumber":"84","data":"GET","severity":"2","ver":"OWASP_CRS/3.0.0","rev":"1","tags":["application-multi","language-multi","platform-multi","attack-protocol","OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ","CAPEC-272"],"maturity":"9","accuracy":"9"}}]}}