I posted the orignal question. But, let me add some clarification.
Almost all of the stock CRS rules will block in anomaly scoring mode as-is.
But, there are couple in the SQLi rules (I think) that might not (don't
have those handy).
The other words, if you doing nothing but straight CRS with no local or third
party rules, no problems.
The issue is that local (or possibly non-CRS third party) rules you've added
(on top of CRS) with scoring will need more than just the score now. You must
also have a "setvar:tx.%{rule.id}-SOMETHING" (the need for a dash is what
effectively got changed).
-RP
_______________________________________________
Owasp-modsecurity-core-rule-set mailing list
Owasp-modsecurity-core-rule-set@lists.owasp.org
https://lists.owasp.org/mailman/listinfo/owasp-modsecurity-core-rule-set
