Export ModSecurity rule error report

This function submits ModSecurity™ rule error reports to a remote receiver. The third party rule vendors use these error reports to identify problems with their rule sets.

Important:

When you disable the Web Server role, the system disables this function.

get/modsec_report_rule

Request

Base URL
https://whm-server.tld:2087/json-api
Auth
HTTP basic

Query parameters

emailstring email required

Example:john.doe@example.com

The contact email address to send with the error report. This allows the rule's vendor to reply to the user directly.

messagestring required

Example:Hi. We're having some trouble with this rule. It seems to be blocking all requests.

A short message that explains the reason for the report.

row_idsinteger required

The MySQL® row IDs from the hits table in the modsec database for the audit log event to report.

Note:

If you specify more than one row ID:

You must comma-separate the rule IDs.
The rule IDs must all correspond to the same ModSecurity rule.

send1 | 0 required

Example:1

Whether the function sends the report to the rule's vendor.

1 — Send the report.
0 — Do not send the report.

typestring required

Example:false positive

The report's type.

Note:

This value does not use a specified format. Treat the value as freeform text.

Response

HTTP Request was successful.

Example response

{
  "data": {
    "report": [
      {
        "email": "john.doe@example.com",
        "hits": [
          {
            "action_desc": "Access denied with code 406 (phase 2).",
            "host": "example.com",
            "http_method": "GET",
            "http_status": 406,
            "http_version": "HTTP/1.1",
            "id": 794828,
            "ip": "10.215.215.236",
            "justification": "Unconditional match in SecAction.",
            "meta_file": "/usr/local/apache/conf/modsec_vendor_configs/MyVendor/one.conf",
            "meta_id": 12345694,
            "meta_line": 1,
            "meta_msg": "Method is not allowed by policy",
            "meta_rev": 1,
            "meta_severity": "CRITICAL",
            "path": "/something",
            "timestamp": "2019-10-13T07:58:04.000Z",
            "timezone": "-300"
          }
        ],
        "message": "Hi. We're having some trouble with this rule. It seems to be blocking all requests.",
        "rule_text": "SecAction \"deny,auditlog,id:'12345694'\"\n",
        "type": "false positive"
      }
    ]
  },
  "metadata": {
    "command": "modsec_report_rule",
    "reason": "OK",
    "result": 1,
    "version": 1
  }
}

Changes

No recorded changes to this operation across all 5 revisions of this API.