<p>I created the following <code>configMap </code>for my NGINX ingress controller:</p>
<pre><code>apiVersion: v1
data:
  allow-snippet-annotations: &quot;true&quot;
  enable-modsecurity: &quot;true&quot;
  enable-owasp-modsecurity-crs: &quot;true&quot;
  modsecurity-snippet: |-
    SecRuleEngine On
    SecRequestBodyAccess On
    SecAuditLog /dev/stdout
    SecAuditLogFormat JSON
    SecAuditEngine RelevantOnly
    SecRule REQUEST_URI|ARGS|QUERY_STRING &quot;@contains attack&quot; &quot;id:100001,phase:1,t:lowercase,deny,status:403,msg:'Attack Detected'&quot;
kind: ConfigMap
metadata:
  annotations:
    meta.helm.sh/release-name: nginx-ingress
    meta.helm.sh/release-namespace: ingress-basic
  creationTimestamp: &quot;2023-01-20T11:31:53Z&quot;
  labels:
    app.kubernetes.io/component: controller
    app.kubernetes.io/instance: nginx-ingress
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: ingress-nginx
    app.kubernetes.io/part-of: ingress-nginx
    app.kubernetes.io/version: 1.5.1
    helm.sh/chart: ingress-nginx-4.4.2
  name: nginx-ingress-ingress-nginx-controller
  namespace: ingress-basic
  resourceVersion: &quot;200257665&quot;
  uid: e6ab9121-9a73-47e3-83ec-6c1fa19072ee
</code></pre>
<p>I would expect that following SecRule</p>
<pre><code>SecRule REQUEST_URI|ARGS|QUERY_STRING &quot;@contains attack&quot; &quot;id:100001,phase:1,t:lowercase,deny,status:403,msg:'Attack Detected'&quot;
</code></pre>
<p>would block any request containing the word <code>attack </code>in the URI or in the querystring, for example in:</p>
<p><a href="https://secrule.sample.com/api?task=attack" rel="nofollow noreferrer">https://secrule.sample.com/api?task=attack</a></p>
<p>But it doesn't. There is clearly something missing in the definition of the configMap of my NGINX ingress controller, but I don't understand what. Any clue? Thanks!</p>
<p>I'd like to use ModSecurity with an NGINX Ingress Controller to block incoming calls that contain a given word in the querystring.</p>

Paolo Salvatori
<p>I solved the issue by escaping quotes and double quotes of the SecRule in the configmap as follows:</p>
<pre><code>SecRule REQUEST_URI|ARGS|QUERY_STRING \&quot;@contains attack\&quot; \&quot;id:100001,phase:1,t:lowercase,deny,status:403,msg:\'Attack Detected\'\&quot;
</code></pre>
