Question predefined set of parameters or your custom ModSecurity directives - mutually exclusive?

[websavers]

Server operating system version

AlmaLinux 9

Plesk version and microupdate number

18.0.77 Update #4

Under Tools & Settings > Web Application Firewall > Settings (tab) there is a "Configuration" section that states:

Configure web application firewall using either a predefined set of parameters or your custom ModSecurity directives.

Then below that you can select one of the predefined set of parameters with options: Fast, Tradeoff, and Thorough. Following that is the "Custom directives" box.

The way the quoted text above is written, it sounds like you *either* select a predefined parameter OR specify custom directives.

My question is: are those two parts (predefined vs. custom) mutually exclusive like the description implies?

If I have custom rules specified, will the selected "predefined set of parameters" no longer apply? Or does it apply the predefined set of parameters, then also the custom directives?

 

[alapshin]

Hello @websavers
The configuration of the Web Application Firewall (ModSecurity) in Plesk allows you to use both predefined sets of parameters and custom directives simultaneously. However custom directives have prioriry over predefined set (Fast, Tradeoff, and Thorough)
For example if you set
"SecRequestBodyAccess Off" in custom directives
and chose Thorough pre-defined set, which will set "SecRequestBodyAccess On" in /etc/apache2/plesk.conf.d/server.conf

the effective value will be SecRequestBodyAccess Off

I am agree that explanation

Configure web application firewall using either a predefined set of parameters or your custom ModSecurity directives.

is confusing, it's actually "preset + custom directives."