app:web modsecurity_audit
ModSecurity audit log (WAF on the host)
Per-transaction audit record with request headers, body, response headers and matched rules (parts ABCFHZ by default).
- Log source
- Web server logs (Apache httpd, nginx, Tomcat, Traefik)
- Host type
- Other / unclassified
- How to enable
- SecAuditEngine RelevantOnly; SecAuditLogRelevantStatus '^(?:5|4(?!04))'; SecAuditLog /var/log/modsec_audit.log.
- Tier, host type
- Listed
- Techniques
- 0
- Rules depending on it
- none
Why this tier
By role
| Role | Tier | Basis |
|---|---|---|
| Windows web server (IIS), internet-facing | Listed | |
| Linux web server, internet-facing | Listed |
Techniques it helps detect
No ATT&CK analytic names this event. Its standing comes from the standards and rules below.
Rules that depend on it
No vendor rule names this event or source directly.