From 134466293d9b1b0422a60be53d4792562bca1187 Mon Sep 17 00:00:00 2001
From: Debian <linux@myhorse.netcell-it.de>
Date: Wed, 3 Jun 2026 13:45:04 +0200
Subject: [PATCH] =?UTF-8?q?fix(waf):=20Setup-Regeln=20(900xxx=E2=80=93909x?=
 =?UTF-8?q?xx)=20nicht=20als=20Alerts=20speichern=20=E2=80=94=20v1.2.83?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CRS 900xxx/901xxx (init, body inspection, paranoia setup) feuern auf
JEDEM Request — keine Security-Events. Filter: nur rule_id >= 910000
wird als Alert in DB geschrieben. Buffer 512 → 2048.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 VERSION                   |  2 +-
 cmd/edgeguard-waf/main.go |  2 +-
 internal/waf/spoe.go      | 12 +++++++++---
 3 files changed, 11 insertions(+), 5 deletions(-)

diff --git a/VERSION b/VERSION
index aea1186..7000921 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-1.2.82
+1.2.83
diff --git a/cmd/edgeguard-waf/main.go b/cmd/edgeguard-waf/main.go
index f3b291f..d917a86 100644
--- a/cmd/edgeguard-waf/main.go
+++ b/cmd/edgeguard-waf/main.go
@@ -70,7 +70,7 @@ func main() {
 		}
 	}()
 
-	alertWriter := intwaf.NewAlertWriter(pool, 512)
+	alertWriter := intwaf.NewAlertWriter(pool, 2048)
 
 	agent := intwaf.SPOEAgent{
 		Manager:     mgr,
diff --git a/internal/waf/spoe.go b/internal/waf/spoe.go
index 0f696c3..3b7652b 100644
--- a/internal/waf/spoe.go
+++ b/internal/waf/spoe.go
@@ -138,9 +138,15 @@ func (a *SPOEAgent) sendAlert(host, clientIP, method, uri string, mr types.Match
 	if a.AlertWriter == nil {
 		return
 	}
-	// Skip rules with no message — these are CRS skip/control-flow rules
-	// (e.g. 949011..949018, 911011..911018) that match but carry no alert info.
-	if mr.Message() == "" && mr.Rule().ID() > 0 {
+	ruleID := mr.Rule().ID()
+	// Skip CRS setup/initialization rules (900xxx–909xxx) — they fire on
+	// every request as part of CRS init and are not security events.
+	// Real detection rules start at 910xxx (IP reputation) and above.
+	if ruleID > 0 && ruleID < 910000 {
+		return
+	}
+	// Skip control-flow rules with no message (PL-skip markers).
+	if mr.Message() == "" {
 		return
 	}
 	action := "detected"