SecLang YAML Structure

- metadata: SecRuleMetadata
  conditions: []Condition
  actions: SecRuleActions
  chainedRule: bool
  secMarker: string

metadata:
  id: 942100
  phase: "2"
  message: "SQL Injection Attack Detected"
  severity: CRITICAL
  tags:
    - attack-sqli
    - OWASP_CRS
    - paranoia-level/2

conditions:
- variables:
  - name: REQUEST_URI
  - name: ARGS_GET
    collection: id           # optional member of collection
  operator:
    name: rx
    value: (?:union|select|--)
    negate: false

conditions:
- collections:
  - name: TX
    arguments:
    - DETECTION_PARANOIA_LEVEL
  operator:
    name: lt
    value: "1"

conditions:
- always-match: true

disruptive:
  disruptiveActionType: deny | block | allow | pass | drop | redirect
  status: "403"                    # for deny/block
  redirectUrl: "https://..."

flow:
- flowActionType: skip
  value: "950000"           # skip next N rules
- flowActionType: skipAfter
  value: END-REQUEST-920    # skip to marker

nonDisruptive:
- nonDisruptiveActionType: setvar
  value: TX.inbound_anomaly_score_pl1=+5
- nonDisruptiveActionType: msg
  value: "Attack detected on %{REQUEST_URI}"
- nonDisruptiveActionType: logdata
  value: "%{MATCHED_VAR}"
- nonDisruptiveActionType: ctl
  value: ruleRemoveById=942100
- nonDisruptiveActionType: nolog

- metadata: { id: 942100, ... }
  conditions: [ condition A ]
  actions:
    disruptive: { disruptiveActionType: pass }
  chainedRule: true
- metadata: { ... same id ... }
  conditions: [ condition B ]
  actions:
    disruptive: { disruptiveActionType: block }

- secMarker: END-REQUEST-920-PROTOCOL-ENFORCEMENT
  metadata:
    id: 0
    phase: "1"
  conditions:
  - always-match: true
  actions:
    nonDisruptive:
    - nonDisruptiveActionType: nolog