nginx generation improved

waf_patterns/nginx/correlation.conf

@@ -1,28 +1,19 @@
 # Nginx WAF rules for CORRELATION
-location / {
-    set $attack_detected 0;
+# Automatically generated from OWASP rules.
+# Include this file in your server or location block.
 
-    if ($request_uri ~* "@ge 5") {
-        set $attack_detected 1;
-    }
-
-    if ($request_uri ~* "@ge %{tx.inbound_anomaly_score_threshold}") {
-        set $attack_detected 1;
-    }
-
-    if ($request_uri ~* "@eq 0") {
-        set $attack_detected 1;
-    }
-
-    if ($request_uri ~* "@gt 0") {
-        set $attack_detected 1;
-    }
-
-    if ($request_uri ~* "@ge %{tx.outbound_anomaly_score_threshold}") {
-        set $attack_detected 1;
-    }
-
-    if ($attack_detected = 1) {
-        return 403;
-    }
+map $request_uri $waf_block_correlation {
+    default 0;
+    "~*@ge %{tx.outbound_anomaly_score_threshold}" 1;
+    "~*@ge %{tx.inbound_anomaly_score_threshold}" 1;
+    "~*@ge 5" 1;
+    "~*@gt 0" 1;
+    "~*@eq 0" 1;
 }
+
+if ($waf_block_correlation) {
+    return 403;
+    # Log the blocked request (optional)
+    # access_log /var/log/nginx/waf_blocked.log;
+}
+