Good tuning removes one incorrect match while preserving protection everywhere else. Start from the audit event: rule ID, matched variable, request route, application behavior, phase, and actual disruptive action.
Prefer the narrowest correction
From narrowest to broadest:
- Remove one parameter from one rule for one route.
- Remove one parameter from one rule globally.
- Disable one rule for one route.
- Disable one rule globally.
- Disable a tag or rule family only when its protection is truly out of scope.
Avoid turning off ModSecurity, disabling request-body access, or removing broad rule ranges to solve a single false positive.
Configuration-time target exclusion
SecRuleUpdateTargetById 340162 "!ARGS:known_safe_parameter"
This keeps the rule active but removes one target. Confirm the exact target name from the audit event.
Runtime exclusion for one route
SecRule REQUEST_URI "@beginsWith /trusted-workflow/" \
"id:100050,phase:1,pass,nolog,ctl:ruleRemoveTargetById=340162;ARGS:known_safe_parameter"
Runtime exclusions must execute before the excluded rule. Phase and file include order therefore matter.
Removing a rule
SecRuleRemoveById 340162
This is broad: the rule no longer runs in that configuration context. Use it only when the entire rule is inappropriate and document why, who approved it, and when it should be reviewed.
Keep changes upgrade-safe
- Put local rules and exclusions in separate files.
- Load early runtime exclusions before the vendor rules they affect.
- Load configuration-time updates after the referenced rules exist.
- Assign unique local IDs outside vendor ranges.
- Record the application, route, parameter, rule ID, and business justification.
- Retest exclusions after application and rule updates.
Atomic false-positive support
Before adding a permanent exclusion to a supported Atomic rule, report the false positive. A fix in the maintained feed protects every customer from the same operational problem and avoids a growing local exception set. Qualifying commercial-rule reports for public applications are covered by the Zero False Positive Guarantee.