From 511ede1f6e90e60a6d7053261351189a5e943ea0 Mon Sep 17 00:00:00 2001
From: Felipe Zipitria <fzipi@fing.edu.uy>
Date: Sun, 13 Sep 2026 09:33:38 -0700
Subject: [PATCH 1/2] Add plugin.yaml descriptor

Adds the machine-readable plugin descriptor defined in
coreruleset/plugin-registry#37, per the rollout plan in
coreruleset/plugin-registry#21.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 plugin.yaml | 71 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 71 insertions(+)
 create mode 100644 plugin.yaml

diff --git a/plugin.yaml b/plugin.yaml
new file mode 100644
index 0000000..7d96c37
--- /dev/null
+++ b/plugin.yaml
@@ -0,0 +1,71 @@
+schema_version: 1
+
+plugin:
+  name: "machine-learning-integration-plugin"
+  description: "Scores requests with a pluggable machine learning model and blocks or reduces false positives based on the resulting anomaly score."
+  long_description: |
+    Integrates a machine learning anomaly model into the CRS request evaluation
+    pipeline. A ModSecurity rule calls a Lua script, which forwards request
+    metadata (method, path, arguments, file names/sizes, hour, day) to an
+    external Flask server over HTTP. The server scores the request with a
+    pluggable ML model and returns a pass/deny status that the plugin rules
+    act on.
+
+    The plugin supports two modes: false positive detection mode, where only
+    requests whose CRS inbound anomaly score already exceeds a threshold are
+    re-checked by the ML model, and general detection mode, where every
+    request is scored by the ML model. The shipped ML server stubs the model
+    with a random score generator; operators supply their own trained model.
+  type: "official"
+  category: "detection"
+  status: "draft"
+  license: "Apache-2.0"
+  authors:
+    - name: "OWASP CRS Team"
+      url: "https://coreruleset.org"
+  repository: "https://github.com/coreruleset/machine-learning-integration-plugin"
+  keywords:
+    - "machine-learning"
+    - "anomaly-detection"
+    - "false-positive-reduction"
+
+rule_id_range:
+  start: 9516000
+  end: 9516999
+
+compatibility:
+  crs_version: ">=4.0.0"
+
+configuration:
+  file: "plugins/machine-learning-config.conf"
+  variables:
+    - name: "tx.machine-learning-plugin_enabled"
+      type: "boolean"
+      default: 1
+      description: "Enable or disable the plugin (0 to disable)"
+      required: false
+
+    - name: "tx.machine-learning-plugin_mode"
+      type: "integer"
+      default: 2
+      min: 1
+      max: 2
+      description: >-
+        Operating mode: 1 = false positive detection mode (only requests
+        whose CRS inbound anomaly score already exceeds the threshold are
+        scored by the ML model), 2 = general detection mode (every request
+        is scored by the ML model)
+
+    - name: "tx.machine-learning-plugin_ml_server_url"
+      type: "string"
+      default: "http://127.0.0.1:5000/"
+      description: "URL of the Flask ml_model_server that scores requests and returns an anomaly status"
+      example: "http://127.0.0.1:5000/"
+
+    - name: "tx.machine-learning-plugin_inbound_ml_threshold"
+      type: "integer"
+      default: 0
+      description: >-
+        Threshold compared against the CRS inbound anomaly score to decide
+        when the ML model should evaluate a request in false positive
+        detection mode (mode 1)

From 38e8b1d62bcc4c4c76844c8f1bb26a8219a6244d Mon Sep 17 00:00:00 2001
From: Felipe Zipitria <fzipi@fing.edu.uy>
Date: Sun, 13 Sep 2026 09:35:03 -0700
Subject: [PATCH 2/2] Fix configuration.file path in plugin.yaml

The repo's conf file lives under plugin/ (singular), not plugins/ as
the plugin-schema.json naming convention expects. Point at the real
path instead of a nonexistent plugins/ one; this makes the descriptor
accurate but not schema-compliant until the directory is renamed or
the schema pattern is relaxed to also accept plugin/.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
---
 plugin.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/plugin.yaml b/plugin.yaml
index 7d96c37..c91edb2 100644
--- a/plugin.yaml
+++ b/plugin.yaml
@@ -37,7 +37,12 @@ compatibility:
   crs_version: ">=4.0.0"
 
 configuration:
-  file: "plugins/machine-learning-config.conf"
+  # NOTE: this repo keeps its conf file under `plugin/` (singular), not the
+  # `plugins/` directory convention `plugin-schema.json` expects, so this path
+  # does not satisfy the schema's `configuration.file` pattern. Flagged for a
+  # maintainer decision (rename the directory vs. relax the schema pattern)
+  # rather than papering over it with a path that doesn't exist in this repo.
+  file: "plugin/machine-learning-config.conf"
   variables:
     - name: "tx.machine-learning-plugin_enabled"
       type: "boolean"