Macro Expansion

Macros allow for using placeholders in rules that will be expanded out to their values at runtime. Only variable expansion is supported; the syntax is the same in ModSecurity v2 and libModSecurity v3.

Format:

%{VARIABLE}
%{COLLECTION.VARIABLE}

Macro expansion can be used in actions such as initcol, setsid, setuid, setvar, setenv, logdata and msg. Operators that are evaluated at runtime support expansion in their parameter; the entries in Operators note where this applies. Such operators include @beginsWith, @endsWith, @contains, @within, @streq, @eq, @ge, @gt, @le and @lt. You can use macro expansion in operators that are “compiled” at load time, such as @rx, but the pattern is then recompiled on every evaluation, which has an impact on efficiency.

Some values you may want to expand include: TX, REMOTE_ADDR, USERID, HIGHEST_SEVERITY, MATCHED_VAR, MATCHED_VAR_NAME, MULTIPART_STRICT_ERROR, RULE, SESSION and SESSIONID, among others.