Skip to content

[modsecurity] Update documentation#17410

Open
ilyannn wants to merge 11 commits intoelastic:mainfrom
ilyannn:update-modsecurity-documentation
Open

[modsecurity] Update documentation#17410
ilyannn wants to merge 11 commits intoelastic:mainfrom
ilyannn:update-modsecurity-documentation

Conversation

@ilyannn
Copy link
Contributor

@ilyannn ilyannn commented Feb 13, 2026

Summary

  • Add service_info.md knowledge base with reviewed, fact-checked integration details
  • Rewrite documentation using elastic-package update documentation to follow the new template structure
  • Add docs_structure_enforced validation
  • Bump version to 1.23.0

Breaking Changes in Docs

Compared to the previous docs, we:

  • fix the error where the docs referred to ModSecurity v3 with Apache, even though the original issue referred to v2
  • use modsec-audit.json file name in examples rather than modsec_audit.json
  • do not describe the importance of SecAuditLogType Serial as critical
  • only suggest ABFHJZ parts as an example (was ABDEFHIJZ previously)

Kibana rendering

Note the code in numbered list looks like this but this apparently how our rendering works (perhaps we should reduce the indent of code in the lists in this case?). GitHub does not like this formatting either.

image

Test plan

  • elastic-package check passes (tested with both system and dev builds)
  • Verify README renders correctly in Kibana integration UI
  • Review generated documentation for accuracy against service_info.md ground truth

Closes https://github.com/elastic/integration-experience/issues/456

🤖 These documentation changes have been largely GenAI-generated as per our protocol. Additionally, Claude Code was used for factual review and as a harness for editing/commit/PR generation under our editorial supervision.

ilyannn and others added 2 commits February 13, 2026 19:45
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@github-actions
Copy link
Contributor

github-actions bot commented Feb 13, 2026

Vale Linting Results

Summary: 9 warnings, 5 suggestions found

⚠️ Warnings (9)
File Line Rule Message
packages/modsecurity/_dev/build/docs/README.md 75 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/modsecurity/_dev/build/docs/README.md 75 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/modsecurity/_dev/build/docs/README.md 97 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/modsecurity/docs/README.md 75 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/modsecurity/docs/README.md 75 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/modsecurity/docs/README.md 97 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/modsecurity/docs/README.md 194 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'using' instead of 'via'.
packages/modsecurity/docs/knowledge_base/service_info.md 65 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
packages/modsecurity/docs/knowledge_base/service_info.md 87 Elastic.Latinisms Latin terms and abbreviations are a common source of confusion. Use 'and so on' instead of 'etc'.
💡 Suggestions (5)
File Line Rule Message
packages/modsecurity/_dev/build/docs/README.md 3 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/modsecurity/_dev/build/docs/README.md 97 Elastic.Semicolons Use semicolons judiciously.
packages/modsecurity/docs/README.md 3 Elastic.WordChoice Consider using 'can, might' instead of 'may', unless the term is in the UI.
packages/modsecurity/docs/README.md 97 Elastic.Semicolons Use semicolons judiciously.
packages/modsecurity/docs/knowledge_base/service_info.md 87 Elastic.Semicolons Use semicolons judiciously.

The Vale linter checks documentation changes against the Elastic Docs style guide.

To use Vale locally or report issues, refer to Elastic style guide for Vale.

@ilyannn ilyannn added documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:modsecurity ModSecurity Audit (Community supported) Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience] labels Feb 13, 2026
ilyannn and others added 8 commits February 13, 2026 20:47
Replace Latin term "via" with "using"/"through" and "see" with "get"
per Elastic docs style guide.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add ModSecurity v2 for Apache (v2.9.x) to compatibility section
- Soften Part K exclusion from "must"/"CRITICAL" to recommendation
- Clarify event.original requires preserve_original_event enabled
- Fix inconsistent SecAuditLogParts in troubleshooting section

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Reflects factual corrections in service_info.md:
- Compatibility section now notes v2 Apache test coverage
- Part K exclusion softened to recommendation
- Validation step clarifies event.original requires opt-in
- Consistent SecAuditLogParts across setup and troubleshooting

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove two Gemini-generated AI disclaimers not present in other
integration docs. Replace "via" with "using" per Elastic style guide.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Align troubleshooting recommendation with setup section.
Part H (audit trailer) contains useful action and timing data.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Remove link to this same integration doc page and generic
Elastic Agent Troubleshooting link from vendor documentation sections.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@ilyannn ilyannn self-assigned this Feb 13, 2026
@elastic-vault-github-plugin-prod
Copy link

elastic-vault-github-plugin-prod bot commented Feb 13, 2026

🚀 Benchmarks report

Package modsecurity 👍(0) 💚(0) 💔(1)

Expand to view
Data stream Previous EPS New EPS Diff (%) Result
auditlog 1203.37 834.03 -369.34 (-30.69%) 💔

To see the full report comment with /test benchmark fullreport

… vendor sections

The Apache support was added in PR elastic#3363 for ModSecurity v2 (2.9.x),
not v3 with the Apache connector. Updated compatibility to reflect
what is actually tested. Removed duplicate vendor resource sections
and circular self-referencing links.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@ilyannn ilyannn marked this pull request as ready for review February 13, 2026 23:53
@ilyannn ilyannn requested a review from a team as a code owner February 13, 2026 23:53
@elasticmachine
Copy link

Pinging @elastic/integration-experience (Team:Integration-Experience)

@elasticmachine
Copy link

💚 Build Succeeded

History

cc @ilyannn

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

documentation Improvements or additions to documentation. Applied to PRs that modify *.md files. enhancement New feature or request Integration:modsecurity ModSecurity Audit (Community supported) Team:Integration-Experience Security Integrations Integration Experience [elastic/integration-experience]

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants