[Owasp-modsecurity-core-rule-set] Anomaly Scoring logging

Avi Rosenblatt avi at greensmoke.net
Wed Nov 14 14:41:58 UTC 2012

I have configured the CRS to use anomaly scoring and raised the inbound score level in order to reduce false positives. I'm currently running our server in detectiononly mode and I'm getting error log and audit log messages for any rule match regardless of score. Is there a way to only log messages when a threshold has been reached. Thanx in advance for the help.


More information about the Owasp-modsecurity-core-rule-set mailing list