Implementing Web Application Logging with ModSecurity

Overview

ModSecurity is an open-source WAF engine that works with Apache, Nginx, and IIS. The OWASP Core Rule Set (CRS) provides generic attack detection rules covering SQL injection, XSS, RCE, LFI, and other OWASP Top 10 attacks. ModSecurity logs full request/response data in audit logs for forensic analysis and generates alerts that feed into SIEM platforms.

Prerequisites

• Web server (Apache 2.4+ or Nginx) with ModSecurity v3 module
• OWASP CRS v4.x installed
• Log aggregation infrastructure (ELK, Splunk, or Wazuh)

Steps