gistfile1.txt

modsecurity on;
modsecurity_rules '
    SecDefaultAction "phase:2,deny,auditlog,status:403"
    SecRuleEngine On
    SecDebugLog /tmp/modsec_debug.log
    SecDebugLogLevel 9
    SecAuditLog /tmp/modsec_audit.log
    SecAuditLogRelevantStatus "403"
    SecAuditLogParts ABCFHKZ
    SecAuditEngine RelevantOnly
    SecAuditLogType Serial
    SecResponseBodyAccess On
    SecRule RESPONSE_BODY "@contains nginx" "id:1,phase:4,deny"
  ';