Skip to content
This repository was archived by the owner on May 14, 2020. It is now read-only.

Commit 5354faa

Browse files
annawinklerannawinkler
committed
Add PL1 tag.
1 parent eb77b37 commit 5354faa

19 files changed

+162
-0
lines changed

‎rules/REQUEST-910-IP-REPUTATION.conf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ SecRule TX:DO_REPUT_BLOCK "@eq 1" \
3838
tag:'language-multi',\
3939
tag:'platform-multi',\
4040
tag:'attack-reputation-ip',\
41+
tag:'paranoia-level/1',\
4142
tag:'IP_REPUTATION/MALICIOUS_CLIENT',\
4243
severity:'CRITICAL',\
4344
chain,\
@@ -66,6 +67,7 @@ SecRule TX:HIGH_RISK_COUNTRY_CODES "!@rx ^$" \
6667
tag:'language-multi',\
6768
tag:'platform-multi',\
6869
tag:'attack-reputation-ip',\
70+
tag:'paranoia-level/1',\
6971
severity:'CRITICAL',\
7072
chain"
7173
SecRule TX:REAL_IP "@geoLookup" \
@@ -96,6 +98,7 @@ SecRule TX:HIGH_RISK_COUNTRY_CODES "!@rx ^$" \
9698
# tag:'language-multi',\
9799
# tag:'platform-multi',\
98100
# tag:'attack-reputation-ip',\
101+
# tag:'paranoia-level/1',\
99102
# severity:'CRITICAL',\
100103
# setvar:'tx.anomaly_score_pl1=+%{tx.critical_anomaly_score}',\
101104
# setvar:'ip.reput_block_flag=1',\
@@ -117,6 +120,7 @@ SecRule IP:PREVIOUS_RBL_CHECK "@eq 1" \
117120
tag:'language-multi',\
118121
tag:'platform-multi',\
119122
tag:'attack-reputation-ip',\
123+
tag:'paranoia-level/1',\
120124
skipAfter:END-RBL-LOOKUP"
121125

122126
#
@@ -138,6 +142,7 @@ SecRule &TX:block_suspicious_ip "@eq 0" \
138142
pass,\
139143
t:none,\
140144
nolog,\
145+
tag:'paranoia-level/1',\
141146
chain,\
142147
skipAfter:END-RBL-CHECK"
143148
SecRule &TX:block_harvester_ip "@eq 0" \
@@ -157,6 +162,7 @@ SecRule TX:REAL_IP "@rbl dnsbl.httpbl.org" \
157162
tag:'language-multi',\
158163
tag:'platform-multi',\
159164
tag:'attack-reputation-ip',\
165+
tag:'paranoia-level/1',\
160166
setvar:'tx.httpbl_msg=%{tx.0}',\
161167
chain"
162168
SecRule TX:httpbl_msg "@rx RBL lookup of .*?.dnsbl.httpbl.org succeeded at TX:checkip. (.*?): .*" \
@@ -175,6 +181,7 @@ SecRule TX:block_search_ip "@eq 1" \
175181
tag:'language-multi',\
176182
tag:'platform-multi',\
177183
tag:'attack-reputation-ip',\
184+
tag:'paranoia-level/1',\
178185
severity:'CRITICAL',\
179186
chain,\
180187
skipAfter:END-RBL-CHECK"
@@ -196,6 +203,7 @@ SecRule TX:block_spammer_ip "@eq 1" \
196203
tag:'language-multi',\
197204
tag:'platform-multi',\
198205
tag:'attack-reputation-ip',\
206+
tag:'paranoia-level/1',\
199207
severity:'CRITICAL',\
200208
chain,\
201209
skipAfter:END-RBL-CHECK"
@@ -217,6 +225,7 @@ SecRule TX:block_suspicious_ip "@eq 1" \
217225
tag:'language-multi',\
218226
tag:'platform-multi',\
219227
tag:'attack-reputation-ip',\
228+
tag:'paranoia-level/1',\
220229
severity:'CRITICAL',\
221230
chain,\
222231
skipAfter:END-RBL-CHECK"
@@ -238,6 +247,7 @@ SecRule TX:block_harvester_ip "@eq 1" \
238247
tag:'language-multi',\
239248
tag:'platform-multi',\
240249
tag:'attack-reputation-ip',\
250+
tag:'paranoia-level/1',\
241251
severity:'CRITICAL',\
242252
chain,\
243253
skipAfter:END-RBL-CHECK"
@@ -259,6 +269,7 @@ SecAction \
259269
tag:'language-multi',\
260270
tag:'platform-multi',\
261271
tag:'attack-reputation-ip',\
272+
tag:'paranoia-level/1',\
262273
setvar:'ip.previous_rbl_check=1',\
263274
expirevar:'ip.previous_rbl_check=86400'"
264275

‎rules/REQUEST-911-METHOD-ENFORCEMENT.conf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ SecRule REQUEST_METHOD "!@within %{tx.allowed_methods}" \
3434
tag:'language-multi',\
3535
tag:'platform-multi',\
3636
tag:'attack-generic',\
37+
tag:'paranoia-level/1',\
3738
tag:'OWASP_CRS',\
3839
tag:'OWASP_CRS/POLICY/METHOD_NOT_ALLOWED',\
3940
tag:'WASCTC/WASC-15',\

‎rules/REQUEST-912-DOS-PROTECTION.conf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,6 +109,7 @@ SecRule IP:DOS_BLOCK "@eq 1" \
109109
tag:'application-multi',\
110110
tag:'language-multi',\
111111
tag:'platform-multi',\
112+
tag:'paranoia-level/1',\
112113
tag:'attack-dos',\
113114
chain"
114115
SecRule &IP:DOS_BLOCK_FLAG "@eq 0" \
@@ -131,6 +132,7 @@ SecRule IP:DOS_BLOCK "@eq 1" \
131132
tag:'application-multi',\
132133
tag:'language-multi',\
133134
tag:'platform-multi',\
135+
tag:'paranoia-level/1',\
134136
tag:'attack-dos',\
135137
setvar:'ip.dos_block_counter=+1'"
136138

@@ -151,6 +153,7 @@ SecRule IP:DOS_BLOCK "@eq 1" \
151153
tag:'application-multi',\
152154
tag:'language-multi',\
153155
tag:'platform-multi',\
156+
tag:'paranoia-level/1',\
154157
tag:'attack-dos',\
155158
skipAfter:END-DOS-PROTECTION-CHECKS"
156159

@@ -168,6 +171,7 @@ SecRule REQUEST_BASENAME "@rx .*?(\.[a-z0-9]{1,10})?$" \
168171
tag:'application-multi',\
169172
tag:'language-multi',\
170173
tag:'platform-multi',\
174+
tag:'paranoia-level/1',\
171175
tag:'attack-dos',\
172176
setvar:'tx.extension=/%{TX.1}/',\
173177
chain"
@@ -196,6 +200,7 @@ SecRule IP:DOS_COUNTER "@ge %{tx.dos_counter_threshold}" \
196200
tag:'application-multi',\
197201
tag:'language-multi',\
198202
tag:'platform-multi',\
203+
tag:'paranoia-level/1',\
199204
tag:'attack-dos',\
200205
chain"
201206
SecRule &IP:DOS_BURST_COUNTER "@eq 0" \
@@ -213,6 +218,7 @@ SecRule IP:DOS_COUNTER "@ge %{tx.dos_counter_threshold}" \
213218
tag:'application-multi',\
214219
tag:'language-multi',\
215220
tag:'platform-multi',\
221+
tag:'paranoia-level/1',\
216222
tag:'attack-dos',\
217223
chain"
218224
SecRule &IP:DOS_BURST_COUNTER "@ge 1" \
@@ -236,6 +242,7 @@ SecRule IP:DOS_BURST_COUNTER "@ge 2" \
236242
tag:'application-multi',\
237243
tag:'language-multi',\
238244
tag:'platform-multi',\
245+
tag:'paranoia-level/1',\
239246
tag:'attack-dos',\
240247
setvar:'ip.dos_block=1',\
241248
expirevar:'ip.dos_block=%{tx.dos_block_timeout}'"

‎rules/REQUEST-913-SCANNER-DETECTION.conf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ SecRule REQUEST_HEADERS:User-Agent "@pmFromFile scanners-user-agents.data" \
4242
tag:'language-multi',\
4343
tag:'platform-multi',\
4444
tag:'attack-reputation-scanner',\
45+
tag:'paranoia-level/1',\
4546
tag:'OWASP_CRS',\
4647
tag:'OWASP_CRS/AUTOMATION/SECURITY_SCANNER',\
4748
tag:'WASCTC/WASC-21',\
@@ -66,6 +67,7 @@ SecRule REQUEST_HEADERS_NAMES|REQUEST_HEADERS "@pmFromFile scanners-headers.data
6667
tag:'language-multi',\
6768
tag:'platform-multi',\
6869
tag:'attack-reputation-scanner',\
70+
tag:'paranoia-level/1',\
6971
tag:'OWASP_CRS',\
7072
tag:'OWASP_CRS/AUTOMATION/SECURITY_SCANNER',\
7173
tag:'WASCTC/WASC-21',\
@@ -92,6 +94,7 @@ SecRule REQUEST_FILENAME|ARGS "@pmFromFile scanners-urls.data" \
9294
tag:'language-multi',\
9395
tag:'platform-multi',\
9496
tag:'attack-reputation-scanner',\
97+
tag:'paranoia-level/1',\
9598
tag:'OWASP_CRS',\
9699
tag:'OWASP_CRS/AUTOMATION/SECURITY_SCANNER',\
97100
tag:'WASCTC/WASC-21',\

0 commit comments

Comments
 (0)