<p>I enabled modsecurity: "true" and enable-owasp-modsecurity-crs: "true" via the configmap of the nginx ingresss controller according to <a href="https://kubernetes.github.io/ingress-nginx/user-guide/third-party-addons/modsecurity/" rel="nofollow noreferrer">this link</a> . In the annotation of the ingress I set SecRuleEngine On.
When I use <a href="https://github.com/sullo/nikto" rel="nofollow noreferrer">nikto</a> to do some scans and try to trigger the owasp rules I only see 400 responses in the ingress logging. I would expect 403 responses. Anyone any idea on what I am doing wrong or what to check?</p>

<p>Followed the instructions on:
<a href="https://karlstoney.com/2018/02/23/nginx-ingress-modsecurity-and-secchatops/" rel="nofollow noreferrer">https://karlstoney.com/2018/02/23/nginx-ingress-modsecurity-and-secchatops/</a></p>

<p>The only thing I had to change was "SecAuditLog /var/log/modsec/audit.log". Changed it to SecAuditLog /var/log/modsec_audit.log</p>
