Can Christian Folini's analysis use cases be covered?

[bittner]

@dune73 Following up with our discussion at the end of this evening's ModSecurity CRS Bern Meetup.

Could you come up with a list or description of your primary use cases that you use concatenations of shell commands and/or custom scripts for, and maybe even link them to the related tutorial chapter of your course website?

This way we might be able to identify which parts of our code could be abstracted in a way that someone could write an adapter to allow other data sources, namely reading from log files, for example. Having a single tool that can match your workflow expectations sounds like a thrilling idea to me!

[dune73]

This is relatively hard. They are all over the tutorials.

The one that make very heavy use of piped commands are:

• Tutorial 5: https://www.netnea.com/cms/apache-tutorial-5_extending-access-log/
• Tutorial 8: https://www.netnea.com/cms/apache-tutorial-8_handling-false-positives-modsecurity-core-rule-set/

Aliases / scripts typically used are:

• sucs
• sucspercent
• al-prefix + access log field (extract field, combine with sucs)
• mel-prefix + ModSec error log field (extract field, combine with sucs)
• basicstats.awk

The scripts / alias are linked at: https://www.netnea.com/cms/apache-tutorials/