Recipe 5 — Tune the CRS exclusion set without dropping the reference posture

Tool Section Level Time Layer Tags
test/crs-differential, any host with Go CRS medium 15 min crs · differential crs, exclusions, parity

Problem

You want to silence one noisy CRS rule for one target. You want the community baseline intact after the edit. You want a gate that catches drift.

Solution

  1. Read the committed exclusion set. The private ids 990001 to 990004 carry it (990001 = the response-body plumbing; the other three = the removals):
SecRule REQUEST_FILENAME "!@rx ^/$" "id:990002,phase:1,pass,nolog,ctl:ruleRemoveTargetById=941010;REQUEST_FILENAME"
SecRule TX:DETECTION_PARANOIA_LEVEL "@ge 1" "id:990003,phase:1,pass,nolog,ctl:ruleRemoveById=921170"
  1. Run the parity gate. The baseline against the committed set:
go test ./test/crs-differential/ -run TestCorpusParity -count=1
parity 19/19 ran (1 skipped; target >= 90%) — zero unexplained deltas = gate
  1. Probe the gate. Disable one exclusion (comment out id 990002 in test/crs-differential/testdata/seclang/engine.conf) and run the gate again. The gate fails and names the deltas:
--- FAIL: TestCorpusParity/01-clean-post (0.00s)
    runner_test.go:61: parity delta: 941010 demotion evidence: want false, reference true
parity 13/19 ran (1 skipped; target >= 90%) — zero unexplained deltas = gate
  1. Restore the edit. The gate reads green again.

Discussion

The exclusion set lives as SecLang control rules with private ids. The ids sit outside the CRS ranges: CRS parity semantics pin by includes and removes, never by renumbering CRS. The corpus pins the observed rule-id sets per request. The gate fails on any drift the edit introduces. Exclusion 990002 removes rule 941010 from the REQUEST_FILENAME target. Disabling it lets 941010 demote case evidence. The gate names the delta per case.

Tune by ids. Run the gate after every edit. The reference posture = the corpus reading green at the pinned target.

See also

Provenance

Verified against trishula@10df4bee on main, 2026-10-25.

Smoke run, 2026-10-25, on the host clone:

  • Baseline gate: parity 19/19 ran (1 skipped), zero unexplained deltas, ok.
  • Probe with id 990002 disabled: parity 13/19, FAIL, three named 941010 demotion evidence deltas.
  • Restore: parity green again. The tree reads clean after restore.