Libmodsecurity with the 4 paranoia levels

[chakir123123]

Hi,
I want to test modsecurity in the four paranoia levels so I uncommented following rule in crs-setup.conf and I changed paranoia level to 3 but when I tested I found in the modsec_audit.log tag paranoia level:2 and not 3.
I have installed modsecurity v3 with CRS v3.3.0

[martinhsv]

Hello @chakir123123 ,

In your paste of content from the modsec_audit.log, you have highlighted ' [tag "paranoia-level/2"] '.

The string output here is not the paranoia level that you have set in your SecAction directive. Rather, it is the paranoia level of the rule. If you have opted for a paranoia level of 3, you can see audit log output pertaining to rules from any of paranoia level 1, 2, or 3.

[chakir123123]

Hello @martinhsv , thank you very much for your quick reply.
Sorry, but I don't understand what I have to do to test modsecurity with the different levels?
I want to run a lot of attacks with the burp suite to see how modsecurity will react in the 4 levels.

[martinhsv]

You can test ModSecurity with the CRS rules by doing what you have done. In your SecAction with id:900000, you can vary the paranoia level that you wish to set.

Just be aware that when you set a paranoia level, all of the rules at that level AND LOWER will be in effect.

If what you really want to do is, for example, have only the paranoia-level 3 rules active (and none of level 1,2, or 4 rules): I am not aware of any simple way to do that with CRS settings, as I don't believe that is an expected use case.

(You can of course, manually disable the ones you don't want included. You could probably also do something with SecRuleUpdateTargetByTag directives for each of the paranoia levels that you wish to ignore.)

If you have further questions, you may want to ask the group that maintains CRS ( https://github.com/coreruleset/coreruleset ), since your inquiry is more focussed on CRS's implementation rather than the ModSecurity engine itself.