I have installed ModSecurity on IIS 10 (development machine) and the requests do get filtered by the owasp rules, accordingly.
But... I want to use the header tagging feature (combined with SecRuleEngine DetectionOnly) so I can defer the action to my ASP.NET application, where I want to combine the ModSecurity results with some custom filtering logic.
Therefore, I have included the modsecurity_crs_49_header_tagging.conf optional rule in my modsecurity_iis.conf file. But as soon as the module gets loaded, the following error is logged:
Unknown command in config: RequestHeader
The header tagging conf file contains these rules:
RequestHeader append X-WAF-Events "%{matched_rule-1}e" env=matched_rule-1
RequestHeader append X-WAF-Events "%{matched_rule-2}e" env=matched_rule-2
RequestHeader append X-WAF-Events "%{matched_rule-3}e" env=matched_rule-3
RequestHeader append X-WAF-Events "%{matched_rule-4}e" env=matched_rule-4
RequestHeader append X-WAF-Events "%{matched_rule-5}e" env=matched_rule-5
RequestHeader append X-WAF-Events "%{matched_rule-6}e" env=matched_rule-6
RequestHeader append X-WAF-Events "%{matched_rule-7}e" env=matched_rule-7
RequestHeader append X-WAF-Events "%{matched_rule-8}e" env=matched_rule-8
RequestHeader append X-WAF-Events "%{matched_rule-9}e" env=matched_rule-9
RequestHeader append X-WAF-Events "%{matched_rule-10}e" env=matched_rule-10
RequestHeader append X-WAF-Events "%{matched_rule-11}e" env=matched_rule-11
RequestHeader append X-WAF-Events "%{matched_rule-12}e" env=matched_rule-12
RequestHeader append X-WAF-Events "%{matched_rule-13}e" env=matched_rule-13
RequestHeader append X-WAF-Events "%{matched_rule-14}e" env=matched_rule-14
RequestHeader append X-WAF-Events "%{matched_rule-15}e" env=matched_rule-15
RequestHeader append X-WAF-Events "%{matched_rule-16}e" env=matched_rule-16
RequestHeader append X-WAF-Events "%{matched_rule-17}e" env=matched_rule-17
RequestHeader append X-WAF-Events "%{matched_rule-18}e" env=matched_rule-18
RequestHeader append X-WAF-Events "%{matched_rule-19}e" env=matched_rule-19
RequestHeader append X-WAF-Events "%{matched_rule-20}e" env=matched_rule-20
RequestHeader set X-WAF-Score "Total=%{anomaly_score}e; sqli=%{sql_injection_score}e; xss=%{xss_score}e" env=anomaly_score
... which basically instruct the module to append some headers with the events and score.
I haven't managed to find any instruction on how this RequestHeader should be somehow installed/registered on IIS.
This thread shows a solution for Linux Apache, but I couldn't find something similar for IIS.
Any help would be greatly appreciated!
Mihai C.