fix(waf): Setup-Regeln (900xxx–909xxx) nicht als Alerts speichern — v1.2.83

CRS 900xxx/901xxx (init, body inspection, paranoia setup) feuern auf
JEDEM Request — keine Security-Events. Filter: nur rule_id >= 910000
wird als Alert in DB geschrieben. Buffer 512 → 2048.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

VERSION

@@ -1 +1 @@
-1.2.82
+1.2.83

cmd/edgeguard-waf/main.go

@@ -70,7 +70,7 @@ func main() {
 		}
 	}()
 
-	alertWriter := intwaf.NewAlertWriter(pool, 512)
+	alertWriter := intwaf.NewAlertWriter(pool, 2048)
 
 	agent := intwaf.SPOEAgent{
 		Manager:     mgr,

internal/waf/spoe.go

@@ -138,9 +138,15 @@ func (a *SPOEAgent) sendAlert(host, clientIP, method, uri string, mr types.Match
 	if a.AlertWriter == nil {
 		return
 	}
-	// Skip rules with no message — these are CRS skip/control-flow rules
+	ruleID := mr.Rule().ID()
-	// (e.g. 949011..949018, 911011..911018) that match but carry no alert info.
+	// Skip CRS setup/initialization rules (900xxx–909xxx) — they fire on
-	if mr.Message() == "" && mr.Rule().ID() > 0 {
+	// every request as part of CRS init and are not security events.
+	// Real detection rules start at 910xxx (IP reputation) and above.
+	if ruleID > 0 && ruleID < 910000 {
+		return
+	}
+	// Skip control-flow rules with no message (PL-skip markers).
+	if mr.Message() == "" {
 		return
 	}
 	action := "detected"