WAF Custom Signatures¶

Overview¶

StarkOne ships additional ModSecurity rules beyond the OWASP CRS. These rules are stored in /etc/modsecurity/starkone-rules.conf and updated automatically with each panel release.

Rule Structure¶

SecRule VARIABLE "@operator value" \
    "id:XXXXXX,\
    phase:N,\
    action,\
    status:403,\
    log,\
    msg:'StarkOne WAF: Description',\
    tag:'starkone-waf',\
    tag:'category'"

Field	Description
`VARIABLE`	What to inspect: `REQUEST_URI`, `REQUEST_HEADERS`, `ARGS`, `FILES`, etc.
`@operator`	Operator: `@contains`, `@rx` (regex), `@beginsWith`, `@endsWith`, etc.
`phase`	Processing phase (1=request headers, 2=request body, 3=response headers, 4=response body)
`action`	`deny` to block, `pass` to log only
`id`	Unique rule ID (must be in a StarkOne range - see below)

Rule ID Ranges¶

Range	Purpose
`100001`-`100099`	WordPress protection
`100100`-`100199`	File upload protection
`100200`-`100299`	Scanner / bot detection
`100300`-`100399`	Generic attack patterns

Installed Location¶

On each server, the signatures live at /etc/modsecurity/starkone-rules.conf and are loaded automatically by ModSecurity.

Update Cadence¶

Servers check for new signature versions every 6 hours and apply them automatically when found. To force an immediate refresh:

systemctl restart starkone

Example Signature¶

The ruleset follows standard ModSecurity syntax. Example - block requests for exposed .git directories:

SecRule REQUEST_URI "@rx /\.git/" \
    "id:100201,\
    phase:1,\
    deny,\
    status:403,\
    log,\
    msg:'StarkOne WAF: Git repository access attempt',\
    tag:'starkone-waf',\
    tag:'scanner-detection'"

Testing Rules¶

Test in detection mode first (rules log but don't block):

POST /api/waf/sites/:id/mode
{ "mode": "detection" }

Then watch events:

GET /api/waf/sites/:id/events

Switch to prevention mode when confident:

POST /api/waf/sites/:id/mode
{ "mode": "prevention" }

Whitelisting False Positives¶

POST /api/waf/sites/:id/whitelist
{
  "rule_id": "100201",
  "uri": "/admin/git-info",
  "comment": "Internal git status page"
}