title: mod_security false positives
body: <p>I`m getting lots of false positives [??]after just setting up mod_security.  I'm running it in detection only so no issues yet but these filters will start blocking requests once I need it to go live. </p>
  
  <p>Afraid I don't 100% understand what the significance of these filters are, I get 100s of them on nearly every domain &amp; all the requests look legitimate.</p>
  
  <pre><code>Request Missing a User Agent Header
  Request Missing an Accept Header
  </code></pre>
  
  <p>What is the best thing to do here? Should I disable these filters? Can I set the severity lower so that requests won't be blocked?</p>
  
  <p>Here is a complete entry</p>
  
  <pre><code>[22/Nov/2011:21:32:37 --0500] u6t6IX8AAAEAAHSiwYMAAAAG 72.47.232.216 38543 72.47.232.216 80
  --5fcb9215-B--
  GET /Assets/XHTML/mainMenu.html HTTP/1.0
  Host: www.domain.com
  Content-type: text/html
  Cookie: pdgcomm-babble=413300:451807c5d49b8f61024afdd94e57bdc3; __utma=100306584.1343043347.1321115981.1321478968.1321851203.4; __utmz=100306584.1321115981.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=XXXXXXXX%20clip%20ons
  
  --5fcb9215-F--
  HTTP/1.1 200 OK
  Last-Modified: Wed, 23 Nov 2011 02:01:02 GMT
  ETag: "21e2a7a-816d"
  Accept-Ranges: bytes
  Content-Length: 33133
  Vary: Accept-Encoding
  Connection: close
  Content-Type: text/html
  
  --5fcb9215-H--
  Message: Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/httpd/modsecurity_crs/base_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "47"] [id "960015"] [rev "2.2.1"] [msg "Request Missing an Accept Header"] [severity "CRITICAL"] [tag "PROTOCOL_VIOLATION/MISSING_HEADER_ACCEPT"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
  Message: Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/httpd/modsecurity_crs/base_rules/modsecurity_crs_21_protocol_anomalies.conf"] [line "66"] [id "960009"] [rev "2.2.1"] [msg "Request Missing a User Agent Header"] [severity "NOTICE"] [tag "PROTOCOL_VIOLATION/MISSING_HEADER_UA"] [tag "WASCTC/WASC-21"] [tag "OWASP_TOP_10/A7"] [tag "PCI/6.5.10"]
  Message: Warning. Operator LT matched 5 at TX:inbound_anomaly_score. [file "/etc/httpd/modsecurity_crs/base_rules/modsecurity_crs_60_correlation.conf"] [line "33"] [id "981203"] [msg "Inbound Anomaly Score (Total Inbound Score: 4, SQLi=5, XSS=): Request Missing a User Agent Header"]
  Stopwatch: 1322015557122593 24656 (- - -)
  Stopwatch2: 1322015557122593 24656; combined=23703, p1=214, p2=23251, p3=2, p4=67, p5=168, sr=88, sw=1, l=0, gc=0
  Producer: ModSecurity for Apache/2.6.1 (http://www.modsecurity.org/); core ruleset/2.2.1.
  Server: Apache/2.2.3 (CentOS)
  </code></pre>