ModSecurity Handbook: Getting Started - Bad Request

AuditConsole
Using ModSecurity entirely from the command line is possible but not much fun. The
configuration part is not a problem, but reviewing logs is difficult without higher-level tools.
Your best choice for a log centralization and GUI tool is AuditConsole, which is built by Christian
Bockermann and hosted on jwall.org [http://www.jwall.org].
AuditConsole is free and provides the following features:
• Event centralization from multiple remote ModSecurity installations
• Event storage and retrieval
• Support for multiple user accounts and support for different views
• Event tagging
• Event rules, which are executed in the console
Summary
This chapter was your ModSecurity orientation. I introduced ModSecurity at a high level,
discussed what it is and what it isn’t, and what it can do and what it cannot. I also gave you a
taste of what ModSecurity is like and described common usage scenarios, as well as covered
some of the interesting parts of its operation.
The foundation you now have should be enough to help you set off on a journey of ModSecurity
exploration. The next chapter discusses installation.
AuditConsole 21