The ModSecurity Reference Manual should be consulted in any cases where questions arise relating to the syntax of commands.

In terms of rule writing, the main directive to know is SecRule, which is used to create rules and thus does most of the work.

Every rule defined by SecRule conforms to the same format, as below:

SecRule VARIABLES OPERATOR [TRANSFORMATION_FUNCTIONS,ACTIONS]

The rule consists of four parts:

  • VARIABLES: Tells the WAF engine where to look in the transactional data (HTTP request and response data).
  • OPERATOR: Tells the WAF engine how to process the variable data.
  • TRANSFORMATION_FUNCTIONS: Tells the WAF engine how to normalize data before an operator is applied.
  • ACTIONS: Tells the WAF engine what to do if a rule matches.

The four parts are explained in the sections below.

Variables

Variables specify which places to check in a HTTP transaction. Examples include:

  • ARGS – all arguments including the POST payload
  • REQUEST_METHOD – request method used in the transaction
  • REQUEST_HEADERS – can be used as either a collection of all of the request headers or can be used to inspect selected headers
  • The full list of variables is available here: ModSecurity Reference Manual

Operator

The operator specifies a regular expression, pattern, or keyword to be checked in the variable(s). Operators begin with the @ character. The full list of operators is available under the Operators section of Reference Manual on the: ModSecurity Documentation page.

Transformation functions

There are a number of transformation functions that can be performed, for example:

  • Anti-evasion (such as lowercase, normalisePath, removeNulls, replaceComments, compressWhitespace)
  • Decoding (such as base64Decode, hexDecode, jsDecode, urlDecodeUni)
  • Encoding (such as base64Encode, hexEncode)
  • Hashing (such as sha1, md5)

Actions

Actions specify what to do if a rule matches. Actions are defined in seven categories, listed below:

  • Disruptive – used to allow ModSecurity to take an action, for example, allow or block
  • Flow – affect the flow, for example, skip
  • Meta-data – used to provide more information about rules
  • Variable – used to set, change, and remove variables
  • Logging – used to influence the way logging takes place
  • Special – used to provide access to another class of functionality
  • Miscellaneous – contain actions that do not belong in any other groups.

If no actions are provided, default actions apply as per SecDefaultAction (phase:2,log,auditlog,pass). The full list of actions is available in the Actions section of the Reference Manual on the ModSecurity Documentation page

When constructing rules, you can specify at what phase the rule should run. Specifying the correct phase can reduce CPU processing. For more information on phases, refer to the ModSecurity Reference Manual.