Block IP if triggered a critical modsecurity rule repeatedly

[ibrahimhajjaj]

Hello World,

I want to automate IP blocking if certain IP keep trigger CRITICAL modsecurity rule!

e.g: IP 1.1.1.1 have triggered more than 10 critical rule in a day = action: IP block





Best Regards

 

[cPanelLauren]

You would need to edit the rule or add a new one, the documentation here may be helpful: ModSecurity Tools | cPanel & WHM Documentation as well as modsecurity's own documentation here Making Rules — OWASP CRS Documentation 3.0.0-rc1 documentation

 

[PlotHost]

You can consider this option in csf

# [*]Enable failure detection of repeated Apache mod_security rule triggers