NK lets customers build their own ModSecurity rule_sets. See WAF overview; this article covers custom-rule details.
3 scopes
- global — node-wide (default NK built-in CRS)
- system — admin-created, optionally bound by any user's site
- user — created by regular user, applies only to their own sites
Key fields
- paranoia_level 1-4 (stricter = more false positives)
- anomaly_threshold_inbound (default 5) / outbound (default 4)
- allowed_methods space-separated / allowed_content_types
- early_blocking 1 = block immediately / 0 = end-of-phase scoring
- keyword_rules JSON array [{keyword, is_regex}]
- custom_rules raw SecRule text (advanced)
Reload required
After changes, call modsec-rule/reload to load new rules into the WAF engine. Otherwise it's only in DB while runtime still runs old.