1type: trigger
2#debug: true
3name: crowdsecurity/modsecurity
4description: "Web exploitation via modsecurity"
5#modsec for nginx only logs the numerical value of the severity
6filter: evt.Meta.log_type == 'modsecurity' && (evt.Parsed.ruleseverity == 'CRITICAL' || evt.Parsed.ruleseverity == '2')
7blackhole: 2m
8groupby: evt.Meta.source_ip
9labels:
10  remediation: true
11  classification:
12    - attack.T1595
13    - attack.T1190
14  behavior: "http:exploit"
15  label: "Modsecurity Alert"
16  spoofable: 0
17  confidence: 2
18  service: http
19