From bdc62d3715ed739fba1d174a5287b9ba64eb9730 Mon Sep 17 00:00:00 2001 From: Sebastien Blot Date: Wed, 17 Apr 2024 09:46:43 +0200 Subject: [PATCH] only ignore rules without a message --- pkg/acquisition/modules/appsec/utils.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/acquisition/modules/appsec/utils.go b/pkg/acquisition/modules/appsec/utils.go index 6635ce61a..802515ed1 100644 --- a/pkg/acquisition/modules/appsec/utils.go +++ b/pkg/acquisition/modules/appsec/utils.go @@ -273,7 +273,7 @@ func (r *AppsecRunner) AccumulateTxToEvent(evt *types.Event, req *appsec.ParsedR }) for _, rule := range req.Tx.MatchedRules() { - if rule.Message() == "" || rule.DisruptiveAction() == "pass" || rule.DisruptiveAction() == "allow" { + if rule.Message() == "" { r.logger.Tracef("discarding rule %d (action: %s)", rule.Rule().ID(), rule.DisruptiveAction()) continue }