Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using ModSecurity 2.7.1 on IIS 7.5 / Windows 2008 R2. I've reference my base set up conf file in my Web.Staging.config of a site like so:

<ModSecurity enabled="true" configFile="*******\ModSecurity.conf" xdt:Transform="Insert"/>

How do I include another rule set, e.g. the OWASP rule set?

share|improve this question
Can't you just add new rules to the existing conf file? – Peter Hahndorf Dec 11 '12 at 8:31
Yes I did that as a temporary solution, but the documentation recommends not to do this (in case of future updates), so I wanted to know how to do this the right way. – autonomatt Dec 11 '12 at 13:31
up vote 2 down vote accepted

I've just been playing with Modsecurity 2.7.1 in IIS and i achieved this by using Include "c:/yourpath/modsecurity_crs_10_setup.conf" in your base conf file and also using an Include to pull in the base_rules inside the modsecurity_crs_10_setup.conf file.

Just a warning though, iv'e found the ModSecurity/IIS to be very flaky, especially using the OWASP rule set. It has killed my AppPool a number of times.

Also, I have had the same issue as you where SecRequestBodyAccess prevents ASP.NET from receiving the POST data. I am not using MVC though so i suspect it's not related specifically to MVC.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.