ModSecurity

A ModSecurity log viewer for the audit log

ModSecurity with the OWASP Core Rule Set blocks a great deal, and writes about all of it to an audit log in a format built for machines. This page turns that log into something readable: which requests were blocked, which rule fired, what the anomaly score was, and where the request came from.

The reason to look at this regularly is false positives. The Core Rule Set is deliberately strict, and at the default paranoia level it will block legitimate traffic in most real applications — file uploads, rich text editors, and anything that posts markup or SQL-like strings are the usual casualties. The pattern to look for is the same rule ID firing repeatedly against the same endpoint from many different addresses. That is not an attack, that is your own application being caught.

Whitelist narrowly when you find one: exclude the specific rule for the specific parameter on the specific path, not the whole rule and never the whole category. The page also lists the active rule set so you can confirm what is actually loaded after a change.