implementing-web-application-logging-with-modsecurity
Helps your agent configure and tune the ModSecurity WAF to log activities and detect web threats.
What it does
This feature helps set up a security system called ModSecurity to log activities on web applications. It acts like an internet traffic cop, noting who tries to access what and if there's any suspicious activity.
When to use it
- ✓When installing a new security system for your website.
- ✓When you need to investigate attack attempts on your website.
- ✓To fine-tune security rules and avoid unnecessary blocks.
Example of what to ask your AI
“Set up ModSecurity to log SQL Injection attack attempts on my website.”
Want more? Open the sections below.
How to use
The easiest way: copy the message below and paste it into Claude, ChatGPT, Cursor or any AI. It reads the skill and follows the instructions.
Skill link
Ready-to-paste message
How it works
ModSecurity monitors the requests coming to your website. It uses a set of rules (OWASP CRS) to identify malicious activities and logs these attempts in log files for later analysis.
Installation
Easiest way: copy the skill link and paste it into Claude, ChatGPT or Cursor asking it to follow the instructions.
In the terminal (Claude Code, Codex, Cursor), in your project folder:
npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill implementing-web-application-logging-with-modsecurityOr download just the file:
curl -L https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/main/skills/implementing-web-application-logging-with-modsecurity/SKILL.md -o SKILL.mdTechnical content (original SKILL.md)
Original text by the author, straight from GitHub.
Implementing Web Application Logging with ModSecurity
Overview
ModSecurity is an open-source WAF engine that works with Apache, Nginx, and IIS. The OWASP Core Rule Set (CRS) provides generic attack detection rules covering SQL injection, XSS, RCE, LFI, and other OWASP Top 10 attacks. ModSecurity logs full request/response data in audit logs for forensic analysis and generates alerts that feed into SIEM platforms.
When to Use
- When deploying or configuring implementing web application logging with modsecurity capabilities in your environment
- When establishing security controls aligned to compliance requirements
- When building or improving security architecture for this domain
- When conducting security assessments that require this implementation
Prerequisites
- Web server (Apache 2.4+ or Nginx) with ModSecurity v3 module
- OWASP CRS v4.x installed
- Log aggregation infrastructure (ELK, Splunk, or Wazuh)
Steps
- Install ModSecurity and configure SecRuleEngine in DetectionOnly mode
- Deploy OWASP CRS v4 and set paranoia level (PL1-PL4)
- Configure SecAuditEngine for relevant-only logging
- Tune false positives with SecRuleRemoveById and rule exclusions
- Switch to blocking mode (SecRuleEngine On) after tuning period
- Forward audit logs to SIEM for correlation and alerting
Expected Output
ModSecurity: Warning. Pattern match "(?:union\s+select)" [file "/etc/modsecurity/crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "45"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [severity "CRITICAL"]
FAQ
What is ModSecurity?
ModSecurity is a program that acts as a Web Application Firewall (WAF), protecting your website from common attacks.
What is OWASP CRS?
OWASP CRS is a set of pre-defined security rules that ModSecurity uses to detect and block threats like SQL injection and XSS.
What are 'false positives'?
False positives occur when the security system blocks a legitimate action, thinking it's an attack. Adjusting the rules helps prevent this.
Details
Original description by the author
Configure ModSecurity WAF with the OWASP Core Rule Set (CRS) for web application audit logging, tuning SecRuleEngine, SecAuditEngine, and CRS paranoia levels to reduce false positives, and writing custom SecRules for application-specific threats. Use when deploying or tuning a ModSecurity WAF, analyzing audit logs for attack detection, or reducing CRS false positives.
Popularity
- GitHub stars
- 35k
- Ranking position
- #5976
- License
- Apache-2.0
- Updated
- 8/31/2026
Comments
- …
More skills from this repository
abusing-dpapi-for-credential-access
Gives your AI agent ready-made instructions for a specific task, so it does it better and faster.
mukul975/Anthropic-Cybersecurity-Skills
abusing-shadow-credentials-for-privesc
Teaches your AI agent to write clear, well-structured text.
mukul975/Anthropic-Cybersecurity-Skills
achieving-cmmc-level-2-compliance
Helps your agent prepare an environment for CMMC Level 2 compliance. It implements security requirements and manages necessary documentation.
mukul975/Anthropic-Cybersecurity-Skills
acquiring-disk-image-with-dd-and-dcfldd
Helps your agent create exact copies of hard drives. This is useful for ensuring no information is lost or altered during investigations.
mukul975/Anthropic-Cybersecurity-Skills
Similar skills
dashboard-builder
Helps your agent create useful monitoring dashboards. It turns data into charts that answer important system questions.
affaan-m/ECC
dev-team
Simulates a collaborative development team where different roles respond to a problem together. It's useful for getting multiple perspectives without manually switching agents.
affaan-m/ECC
ecc-council
Has your agent convene a four-voice council for difficult decisions. It's useful when there are multiple good options and debate is needed before choosing.
affaan-m/ECC