Good day Guys I'm in bit of a pickle, in that, I've received a request that no modsecurity logs may contains passwords or attempted passwords etc in the log.
This is for if we get audited. I can set: |SecDefaultAction "phase:1,deny,nolog,auditlog" SecDefaultAction "phase:2,deny,nolog,auditlog" But then I would loose visibility of other issues. This is mostly for the SQLi rules that I am trying to tackle. Does anyone know of a way of disabling logging, without having to search and replace the rules provided by Owasp. If anyone can assist, it would be greatly appreciated. Regards Brent Clark |
_______________________________________________ Owasp-modsecurity-core-rule-set mailing list Owasp-modsecurity-core-rule-set@lists.owasp.org https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
