“setvar:ip.docs_block-counter” Unable to resolve

[nanchen114]

SecRule REQUEST_FILENAME|ARGS|ARGS_NAMES|!ARGS:/hilit/|!ARGS:/hilight/|!ARGS:/highlight/|!ARGS:/body/|!ARGS:/post/|!ARGS:/txt|!ARGS:resolution|!ARGS:tiny_vals|!ARGS:/description/|!ARGS:title|!ARGS:/content/|!ARGS:/title/|!ARGS:/systemfilter/|!ARGS:parent_name|!ARGS:/^config_setting/|!ARGS:name|!ARGS:v_zZ_ConfDir|!ARGS:/keyword/|!ARGS:/desc/|!ARGS:/summary/|!ARGS:csum|!ARGS:suffix|!ARGS:prefix|!ARGS:/note/|!ARGS:/solution/|!ARGS:/msg/|!ARGS:/highlight/|!ARGS:/text/|!ARGS:/search/|!ARGS:/subject/|!ARGS:/message/|!ARGS:/post/|!ARGS:/resolution/|!ARGS:/problem/|!ARGS:/data/ "(?:\b(?:.(?:ht(?:access|passwd|group)|www_?acl)|global.asa|httpd.conf|boot.ini|web.config)\b|( |^|..)/etc/|/.(?:history|bash_history|sh_history|env)$)" "phase:2,deny,status:403,capture,t:none,t:urlDecodeUni,t:htmlEntityDecode,t:cmdLine,ctl:auditLogParts=+E,deny,log,auditlog,msg:'Attempt to access protected file remotely',id:'390709',rev:30,logdata:'%{TX.0}',severity:'2'"

[M4tteoP]

Hey @nanchen114, could you please elaborate a bit more on the issue you are reporting? Based on the title looks like you are trying to set a variable, but I can't see that action in the reported rule

[github-actions]

This issue has been open 30 days waiting for feedback. Remove the stale label or comment, or this will be closed in 14 days.

[fzipi]

ping @nanchen114