Fastcomet confirmed that they needed to disable modsec 'rule': '77140883' based on the following:
INFO [2024-05-24 00:49:29,031] r.defence360agent.internals.the_sink: SensorIncident({'method': 'INCIDENT', 'plugin_id': 'modsec', 'attackers_ip': '84.22.18.72', 'transaction_id': 'pT7rYW3oSxF3YZYT5P6yc4Pj', 'rule': '77140883', 'message': 'IM360 WAF: RBL block known shells||
INFO [2024-05-24 00:49:29,031] r.defence360agent.internals.the_sink: SensorIncident({'method': 'INCIDENT', 'plugin_id': 'modsec', 'attackers_ip': '84.22.18.72', 'transaction_id': 'pT7rYW3oSxF3YZYT5P6yc4Pj', 'rule': '77140883', 'message': 'IM360 WAF: RBL block known shells||
Statistics: Posted by modernmagic — Mon May 27, 2024 7:49 pm