How do I install the Web App Logging Mdscrt skill?

Run npx skillmds@latest add undermybelt/web-app-logging-mdscrt in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web App Logging Mdscrt safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web App Logging Mdscrt?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web App Logging Mdscrt free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under Apache-2.

Who published Web App Logging Mdscrt?

undermybelt (@undermybelt) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web App Logging Mdscrt by undermybelt

Name: Web App Logging Mdscrt
Author: undermybelt

Web App Logging Mdscrt

Configure ModSecurity WAF with OWASP Core Rule Set (CRS) for web application logging, tune rules to reduce false positives, analyze audit logs for attack detection, and implement custom SecRules for application-specific threats. The analyst configures SecRuleEngine, SecAuditEngine, and CRS paranoia levels to balance security coverage with operational stability. Activates for requests involving WAF configuration, ModSecurity rule tuning, web application audit logging, or CRS deployment.

undermybelt Updated Sep 17, 2026

File contents

Implementing Web Application Logging with ModSecurity

Overview

ModSecurity is an open-source WAF engine that works with Apache, Nginx, and IIS. The OWASP Core Rule Set (CRS) provides generic attack detection rules covering SQL injection, XSS, RCE, LFI, and other OWASP Top 10 attacks. ModSecurity logs full request/response data in audit logs for forensic analysis and generates alerts that feed into SIEM platforms.

When to Use

When deploying or configuring implementing web application logging with modsecurity capabilities in your environment
When establishing security controls aligned to compliance requirements
When building or improving security architecture for this domain
When conducting security assessments that require this implementation

Prerequisites

Web server (Apache 2.4+ or Nginx) with ModSecurity v3 module
OWASP CRS v4.x installed
Log aggregation infrastructure (ELK, Splunk, or Wazuh)

Steps

Install ModSecurity and configure SecRuleEngine in DetectionOnly mode
Deploy OWASP CRS v4 and set paranoia level (PL1-PL4)
Configure SecAuditEngine for relevant-only logging
Tune false positives with SecRuleRemoveById and rule exclusions
Switch to blocking mode (SecRuleEngine On) after tuning period
Forward audit logs to SIEM for correlation and alerting

Expected Output

ModSecurity: Warning. Pattern match "(?:union\s+select)" [file "/etc/modsecurity/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "45"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [severity "CRITICAL"]

---name: web-app-logging-mdscrtdescription: Configure ModSecurity WAF with OWASP Core Rule Set (CRS) for web application logging, tune rules to reduce false positives, analyze audit logs for attack detection, and implement custom SecRules for application-specific threats. The analyst configures SecRuleEngine, SecAuditEngine, and CRS paranoia levels to balance security coverage with operational stability. Activates for requests involving WAF configuration, ModSecurity rule tuning, web application audit logging, or CRS deployment.license: Apache-2.0---# Implementing Web Application Logging with ModSecurity## OverviewModSecurity is an open-source WAF engine that works with Apache, Nginx, and IIS. The OWASPCore Rule Set (CRS) provides generic attack detection rules covering SQL injection, XSS,RCE, LFI, and other OWASP Top 10 attacks. ModSecurity logs full request/response data inaudit logs for forensic analysis and generates alerts that feed into SIEM platforms.## When to Use- When deploying or configuring implementing web application logging with modsecurity capabilities in your environment- When establishing security controls aligned to compliance requirements- When building or improving security architecture for this domain- When conducting security assessments that require this implementation## Prerequisites- Web server (Apache 2.4+ or Nginx) with ModSecurity v3 module- OWASP CRS v4.x installed- Log aggregation infrastructure (ELK, Splunk, or Wazuh)## Steps1. Install ModSecurity and configure SecRuleEngine in DetectionOnly mode2. Deploy OWASP CRS v4 and set paranoia level (PL1-PL4)3. Configure SecAuditEngine for relevant-only logging4. Tune false positives with SecRuleRemoveById and rule exclusions5. Switch to blocking mode (SecRuleEngine On) after tuning period6. Forward audit logs to SIEM for correlation and alerting## Expected Output```ModSecurity: Warning. Pattern match "(?:union\s+select)" [file "/etc/modsecurity/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "45"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [severity "CRITICAL"]```

Frequently asked questions