Summary
False positives found and cleared without leaving the thread.
The drill-down is the design: it starts from the rules that fired on successful responses — the false-positive shape — and ends with the exclusion actually written, so tuning is not a loop of greps and config edits.
What it is
An MCP server for an OWASP ModSecurity CRS instance running in Docker. It runs a drill-down — overview, then events filtered by IP or rule, then one event in full with headers, request body and every rule match — and it can change engine mode, paranoia level, rule exclusions and the IP whitelist.
What you get
- An overview of total events, unique IPs and rules, and events in the last hour
- Top IPs by event count with geo enrichment, and the most-triggered rules with severity and description
- Rules that fired on HTTP 2xx responses, surfaced as false-positive candidates
- Events filtered by source IP or by rule ID, and a single event in full
- Container health, engine mode, rules loaded and paranoia level
- Engine mode switched between On, Off and DetectionOnly, paranoia set 1 to 4, rules disabled or re-enabled, IPs whitelisted or removed
- A test run against the WAF covering scanner detection, SQLi, XSS and path traversal
Requirements
A ModSecurity CRS container the server can reach through Docker. Analysis tools take a since window written in Docker duration syntax — minutes, hours or days — and fall back to a default window when you do not give one.