How do I install the Implementing Web Application Logging With Modsecurity skill?

Run npx skillmds@latest add gabrielmoreira/implementing-web-application-logging-with-modsecurity in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Which AI agents work with Implementing Web Application Logging With Modsecurity?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Who published Implementing Web Application Logging With Modsecurity?

gabrielmoreira (@gabrielmoreira) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Implementing Web Application Logging With Modsecurity by gabrielmoreira

Name: Implementing Web Application Logging With Modsecurity
Rating: 4.2 (5 reviews)
Author: gabrielmoreira

Implementing Web Application Logging With Modsecurity

Configure ModSecurity WAF with the OWASP Core Rule Set (CRS) for web application audit logging, tuning SecRuleEngine, SecAuditEngine, and CRS paranoia levels to reduce false positives, and writing custom SecRules for application-specific threats. Use when deploying or tuning a ModSecurity WAF, analyzing audit logs for attack detection, or reducing CRS false positives.

gabrielmoreira Updated Sep 9, 2026 17 repo stars

File contents

Implementing Web Application Logging with ModSecurity

Overview

ModSecurity is an open-source WAF engine that works with Apache, Nginx, and IIS. The OWASP Core Rule Set (CRS) provides generic attack detection rules covering SQL injection, XSS, RCE, LFI, and other OWASP Top 10 attacks. ModSecurity logs full request/response data in audit logs for forensic analysis and generates alerts that feed into SIEM platforms.

When to Use

When deploying or configuring implementing web application logging with modsecurity capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Web server (Apache 2.4+ or Nginx) with ModSecurity v3 module
OWASP CRS v4.x installed
Log aggregation infrastructure (ELK, Splunk, or Wazuh)

Steps

Install ModSecurity and configure SecRuleEngine in DetectionOnly mode
Deploy OWASP CRS v4 and set paranoia level (PL1-PL4)
Configure SecAuditEngine for relevant-only logging
Tune false positives with SecRuleRemoveById and rule exclusions
Switch to blocking mode (SecRuleEngine On) after tuning period
Forward audit logs to SIEM for correlation and alerting

Expected Output

ModSecurity: Warning. Pattern match "(?:union\s+select)" [file "/etc/modsecurity/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "45"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [severity "CRITICAL"]

---name: implementing-web-application-logging-with-modsecuritydescription: Configure ModSecurity WAF with the OWASP Core Rule Set (CRS) for web application audit logging, tuning SecRuleEngine, SecAuditEngine, and CRS paranoia levels to reduce false positives, and writing custom SecRules for application-specific threats. Use when deploying or tuning a ModSecurity WAF, analyzing audit logs for attack detection, or reducing CRS false positives.license: Apache-2.0---# Implementing Web Application Logging with ModSecurity ## Overview ModSecurity is an open-source WAF engine that works with Apache, Nginx, and IIS. The OWASP Core Rule Set (CRS) provides generic attack detection rules covering SQL injection, XSS, RCE, LFI, and other OWASP Top 10 attacks. ModSecurity logs full request/response data in audit logs for forensic analysis and generates alerts that feed into SIEM platforms. ## When to Use - When deploying or configuring implementing web application logging with modsecurity capabilities in your environment - When establishing security controls aligned to compliance requirements - When building or improving security architecture for this domain - When conducting security assessments that require this implementation ## Prerequisites - Web server (Apache 2.4+ or Nginx) with ModSecurity v3 module - OWASP CRS v4.x installed - Log aggregation infrastructure (ELK, Splunk, or Wazuh) ## Steps 1. Install ModSecurity and configure SecRuleEngine in DetectionOnly mode 2. Deploy OWASP CRS v4 and set paranoia level (PL1-PL4) 3. Configure SecAuditEngine for relevant-only logging 4. Tune false positives with SecRuleRemoveById and rule exclusions 5. Switch to blocking mode (SecRuleEngine On) after tuning period 6. Forward audit logs to SIEM for correlation and alerting ## Expected Output ``` ModSecurity: Warning. Pattern match "(?:union\s+select)" [file "/etc/modsecurity/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "45"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [severity "CRITICAL"] ```

Frequently asked questions