Creating custom rules

Discussion

If you need to create your own custom rules, do not change the asl*conf files. These files will be overwritten by updates.

The use of "asl" in the filename is also reserved. Do not name custom files with "asl" in the filename, for example, 99_asl_custom.conf. This file may be overwritten or deleted by the rule management system. Do not create custom rules with "asl" in the filename.

Rule Ids for custom rules

For custom rules, you must create your own rule ids which must be unique. The id: fields contain the rule ids. For custom rules you should use the local (internal) use range (see below for the reserved id ranges). Do not use assigned ranges.

These are the reserved ranges:

   *     1-99,999; reserved for local (internal) use. Use as you see fit but do not use this range for rules that are distributed to others.
   *     100,000-199,999; reserved for internal use of the engine, to assign to rules that do not have explicit IDs.  (deprecated, all rules require assigned ids in 2.7.x and up)
   *     200,000-299,999; reserved for rules published at modsecurity.org.
   *     300,000-399,999; reserved for rules published by atomicorp.com
   *     400,000-419,999; unused (available for reservation).
   *     420,000-429,999; reserved for ScallyWhack.
   *     430,000-699,999; unused (available for reservation).
   *     700,000-799,999; reserved for Ivan Ristic.
   *     900,000-999,999; reserved for the Core Rules project.
   *     1,000,000 and above; unused (available for reservation).