izenn

        # Retrieve the IP address
        SecAction id:'2000000',phase:1,nolog,pass,initcol:IP=%{REMOTE_ADDR}

         # Enforce an existing IP address block
        SecRule IP:bf_block "@eq 1" \
                "id:'2000001',phase:1,deny,\
                msg:'IP address blocked because of suspected brute-force attack'"

        # Retrieve the username
        SecRule REQUEST_HEADERS:Authorization "Basic (.*)" "chain,capture,phase:1,pass,id:'2000002'"