Apache ModSecurity configuration

This section describes how to send logs from Apache ModSecurity.

ModSecurity can generate the following logs:

Apache error log summarizes the possible attacks detected.
Apache custom log is an Apache proprietary log to record the ModSecurity logs, using the header %{mod_security-message}i, if the request contains a mod_security-relevant environment variable.
Serial log type is a unique ModSecurity log where the generated alerts are registered in detail.
Concurrent log type is a ModSecurity-specific log that generates an unique file for each alert. It offers a better performance than the serial log.

The /etc/rsyslog.d/45-modsecurity.conf configuration file for rsyslog shown below is used in this procedure.

$template modsecurity,"<%PRI%>%timegenerated% %HOSTNAME% %syslogtag% %msg%"
# File access
$InputFileName /var/log/apache2/modsec_audit.log
$InputFileTag web.apache.mod-security.pro.myapp.www1:
$InputFileStateFile stat-file1-ModSecurityAudit
$InputFileSeverity info
$InputFileFacility local7
$InputFilePollInterval 1
$InputFilePersistStateInterval 1
$InputRunFileMonitor
if $syslogtag contains 'web.apache.mod-security' and $syslogfacility-text == 'local7' then @@LOGTRUST-RELAY:PORT;modsecurity :syslogtag, contains, "web.apache.mod-security"~

To send logs from Apache ModSecurity Communications Broker using syslog:

Replace LOGTRUST-RELAY:PORT with the server and the port of your Trellix Comm Broker Sender.