How to send an email attack is detected by ModSec.

[MyAlien]

Hello,
I am a beginner on ModSec.
How to send an email as soon as an attack is detected by ModSec.

For all ModSec rules.

I tried to add exec: /local/script.sh
Then restart Nginx but error every time.

Thank you .

[zimmerle]

Hi @MyAlien,

I would suggest you create a separated script, to go over the logs and alert you whenever convenient.

Putting the exec inside ModSecurity to send an email could lead to a performance issue.

Apart from that, what is the error message that you are getting? What is your ModSecurity version?

[MyAlien]

ModSecurity version v3 .

Do you have a solution to be notified by email with the details of the attack?

Thank you .

[MyAlien]

OWASP ModSecurity CRS v3.2.0

[zimmerle]

Right, that is not your ModSecurity version, but the ruleset that you have loaded.

What is your webserver?

[MyAlien]

Server Web NGINX v1.15.8

[MyAlien]

The server hosts websites also databases.

[zimmerle]

Can you send me the error message that you are facing?

[MyAlien]

When I add at the end of an rules exec:/loc/script-email.sh, I restart nginx and it causes an error.

[zimmerle]

Right, but can you send me this error message?

[MyAlien]

-- L'unité (unit) nginx.service a commencé à démarrer.
sept. 18 14:02:41 www nginx[16067]: nginx: [emerg] "modsecurity_rules_file" directive Rules error. File: /etc/nginx/modsec/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf. Line: 35. Column: 85. Expecting an action, got:
sept. 18 14:02:41 www nginx[16067]: nginx: configuration file /etc/nginx/nginx.conf test failed
sept. 18 14:02:41 www systemd[1]: nginx.service: Control process exited, code=exited status=1
sept. 18 14:02:41 www systemd[1]: Failed to start A high performance web server and a reverse proxy server.
-- Subject: L'unité (unit) nginx.service a échoué
-- Defined-By: systemd

[MyAlien]

Is it correct?

SecRule &TX:'/WEB_ATTACK/' "@ge 1" "t:none,\exec:/opt/send-email-modsecurity.sh"

[zimmerle]

you may want to remove the escape character in front of the exec action. It will be:

SecRule &TX:'/WEB_ATTACK/' "@ge 1" "t:none,exec:/opt/send-email-modsecurity.sh"

You may want to double-check if in the context of the rules it is really doing what you meant it to do.