Very new to mod_sec
I want to block a UA string and I noticed there are a few types:
SecRule HTTP_User-Agent
SecRule REQUEST_HEADERS:User-Agent
What is the real difference between them?
My block:
SecRule REQUEST_HEADERS:User-Agent "perl" "phase:2,pass,msg:'Perl based user agent identified'"
Do I need to set a SecDefaultAction phase:2,deny,status:403,log,auditlog before that? Then any SecRule below that follows that action right?