anchor.diff:    t:none, \
     initcol:global=global, \
     initcol:ip=%{remote_addr}_%{tx.ua_hash}, \
  -  nolog, \
  -  pass"
  +  setvar:tx.real_ip=%{remote_addr}, \
  +  nolog, \
  +  pass"
  +
  
positive.code: # Uncomment this SecAction line if you want use CSP enforcement.
  # You need to set the appropriate directives and settings for your site/domain and
  # and activate the CSP file in the experimental_rules directory.
  #
  # Ref: http://blog.spiderlabs.com/2011/04/modsecurity-advanced-topic-of-the-week-integrating-content-security-policy-csp.html
  #
  #SecAction \
  
negative.code: # - To log *only* to the Apache error_log file use: "log,noauditlog"
  #
  # Ref: http://blog.spiderlabs.com/2010/11/advanced-topic-of-the-week-traditional-vs-anomaly-scoring-detection-modes.html
  # Ref: https://github.com/SpiderLabs/ModSecurity/wiki/Reference-Manual#wiki-SecDefaultAction 
  #
  SecDefaultAction "phase:1,<%= @_secdefaultaction -%>"
  SecDefaultAction "phase:2,<%= @_secdefaultaction -%>"
  