ModSecurity 2.5 collections

The following collections are available in ModSecurity 2.5:

• ARGS
• ENV
• FILES
• FILES_NAMES
• FILES_SIZES
• FILES_TMPNAMES
• GEO
• IP
• REQUEST_COOKIES
• REQUEST_COOKIES_NAMES
• REQUEST_HEADERS
• REQUEST_HEADERS_NAMES
• RESPONSE_HEADERS
• RESPONSE_HEADERS_NAMES
• SESSION
• TX
• USER

Some collections have fixed fields, such as the GEO collection, which contains fields such as COUNTRY_NAME and CITY. Other collections, such as REQUEST_HEADERS have variable field names - in the case of REQUEST_HEADERS it depends on which headers were sent by the client. It is never an error to specify a field name that doesn't exist or doesn't have a value set - so specifying REQUEST_HEADERS:Rubber-Ducky always works - the value would not be tested against if the client hasn't sent a Rubber-Ducky header.