pinkpixel-dev/implementing-web-application-logging-with-modsecurity
SKILLS/implementing-web-application-logging-with-modsecurity/SKILL.md
Configure ModSecurity WAF with OWASP Core Rule Set (CRS) for web application logging, tune rules to reduce false positives, analyze audit logs for attack detection, and implement custom SecRules for application-specific threats. The analyst configures SecRuleEngine, SecAuditEngine, and CRS paranoia levels to balance security coverage with operational stability. Activates for requests involving WAF configuration, ModSecurity rule tuning, web application audit logging, or CRS deployment.
$ install --global
skillsauthnpx skillsauth add pinkpixel-dev/skills-collection-2 implementing-web-application-logging-with-modsecurityInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 15, 2026, 4:47 AM134.4s3 files scanned
SKILL.md
- name:
- implementing-web-application-logging-with-modsecurity
- description:
- >
- domain:
- cybersecurity
- subdomain:
- web-application-security
- tags:
- [modsecurity, waf, crs, owasp, web-security, audit-logging, rule-tuning]
- version:
- 1.0
- author:
- mahipal
- license:
- Apache-2.0
Implementing Web Application Logging with ModSecurity
Overview
ModSecurity is an open-source WAF engine that works with Apache, Nginx, and IIS. The OWASP Core Rule Set (CRS) provides generic attack detection rules covering SQL injection, XSS, RCE, LFI, and other OWASP Top 10 attacks. ModSecurity logs full request/response data in audit logs for forensic analysis and generates alerts that feed into SIEM platforms.
When to Use
- When deploying or configuring implementing web application logging with modsecurity capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Web server (Apache 2.4+ or Nginx) with ModSecurity v3 module
- OWASP CRS v4.x installed
- Log aggregation infrastructure (ELK, Splunk, or Wazuh)
Steps
- Install ModSecurity and configure SecRuleEngine in DetectionOnly mode
- Deploy OWASP CRS v4 and set paranoia level (PL1-PL4)
- Configure SecAuditEngine for relevant-only logging
- Tune false positives with SecRuleRemoveById and rule exclusions
- Switch to blocking mode (SecRuleEngine On) after tuning period
- Forward audit logs to SIEM for correlation and alerting
Expected Output
ModSecurity: Warning. Pattern match "(?:union\s+select)" [file "/etc/modsecurity/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "45"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [severity "CRITICAL"]
Related Skills
pinkpixel-dev/performing-cryptographic-audit-of-application
development
VerifiedTrustedCommunity
A cryptographic audit systematically reviews an application's use of cryptographic primitives, protocols, and key management to identify vulnerabilities such as weak algorithms, insecure modes, hardco
1SKILL.mdUpdated Jul 15, 2026
pinkpixel-dev/performing-credential-access-with-lazagne
tools
VerifiedTrustedCommunity
Extract stored credentials from compromised endpoints using the LaZagne post-exploitation tool to recover passwords from browsers, databases, system vaults, and applications during authorized red team operations.
1SKILL.mdUpdated Jul 15, 2026
pinkpixel-dev/performing-content-security-policy-bypass
testing
VerifiedTrustedCommunity
Analyze and bypass Content Security Policy implementations to achieve cross-site scripting by exploiting misconfigurations, JSONP endpoints, unsafe directives, and policy injection techniques.
1SKILL.mdUpdated Jul 15, 2026
pinkpixel-dev/performing-container-security-scanning-with-trivy
testing
VerifiedTrustedCommunity
Scan container images, filesystems, and Kubernetes manifests for vulnerabilities, misconfigurations, exposed secrets, and license compliance issues using Aqua Security Trivy with SBOM generation and CI/CD integration.
1SKILL.mdUpdated Jul 15, 2026