Conversation
Adds the machine-readable plugin descriptor defined in coreruleset/plugin-registry#37, per the rollout plan in coreruleset/plugin-registry#21. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
The repo's conf file lives under plugin/ (singular), not plugins/ as the plugin-schema.json naming convention expects. Point at the real path instead of a nonexistent plugins/ one; this makes the descriptor accurate but not schema-compliant until the directory is renamed or the schema pattern is relaxed to also accept plugin/. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
EsadCetiner
requested changes
Sep 14, 2026
Comment on lines
+39
to
+76
| configuration: | ||
| # NOTE: this repo keeps its conf file under `plugin/` (singular), not the | ||
| # `plugins/` directory convention `plugin-schema.json` expects, so this path | ||
| # does not satisfy the schema's `configuration.file` pattern. Flagged for a | ||
| # maintainer decision (rename the directory vs. relax the schema pattern) | ||
| # rather than papering over it with a path that doesn't exist in this repo. | ||
| file: "plugin/machine-learning-config.conf" | ||
| variables: | ||
| - name: "tx.machine-learning-plugin_enabled" | ||
| type: "boolean" | ||
| default: 1 | ||
| description: "Enable or disable the plugin (0 to disable)" | ||
| required: false | ||
|
|
||
| - name: "tx.machine-learning-plugin_mode" | ||
| type: "integer" | ||
| default: 2 | ||
| min: 1 | ||
| max: 2 | ||
| description: >- | ||
| Operating mode: 1 = false positive detection mode (only requests | ||
| whose CRS inbound anomaly score already exceeds the threshold are | ||
| scored by the ML model), 2 = general detection mode (every request | ||
| is scored by the ML model) | ||
|
|
||
| - name: "tx.machine-learning-plugin_ml_server_url" | ||
| type: "string" | ||
| default: "http://127.0.0.1:5000/" | ||
| description: "URL of the Flask ml_model_server that scores requests and returns an anomaly status" | ||
| example: "http://127.0.0.1:5000/" | ||
|
|
||
| - name: "tx.machine-learning-plugin_inbound_ml_threshold" | ||
| type: "integer" | ||
| default: 0 | ||
| description: >- | ||
| Threshold compared against the CRS inbound anomaly score to decide | ||
| when the ML model should evaluate a request in false positive | ||
| detection mode (mode 1) |
Member
There was a problem hiding this comment.
A couple of config options are missing:
- tx.machine-learning-plugin_inbound_ml_status
- tx.machine-learning-plugin_inbound_ml_pass_flag
- tx.machine-learning-plugin_inbound_ml_deny_flag
- tx.machine-learning-plugin_inbound_ml_anomaly_score
Member
|
Opened a PR to store the plugins file in |
Member
Author
|
Do we even want to keep this plugin? I feel like it doesn't add any value. |
Member
|
@fzipi There's probably a lot of plugins we should remove, I'm not even sure if this plugin works. It might be worth adding it to the agenda to discuss. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
plugin.yaml, the machine-readable plugin descriptor, per Move the plugin registry list to a different format plugin-registry#21 and validated against coreruleset/plugin-registry'splugin-schema.json(schema_version 1). This plugin is still in draft status, soconfigurationreflects the planned/conventional shape rather than existing code.Test plan
check-jsonschema --schemafile plugin-schema.json plugin.yaml🤖 Generated with Claude Code