{"id":808,"date":"2016-04-12T07:42:39","date_gmt":"2016-04-12T05:42:39","guid":{"rendered":"http:\/\/www.netnea.com\/cms\/?p=808"},"modified":"2016-07-11T14:57:25","modified_gmt":"2016-07-11T12:57:25","slug":"xss-payload-from-reddit-used-against-owasp-modsecurity-core-rules","status":"publish","type":"post","link":"https:\/\/www.netnea.com\/cms\/2016\/04\/12\/xss-payload-from-reddit-used-against-owasp-modsecurity-core-rules\/","title":{"rendered":"XSS payload from Reddit used against OWASP ModSecurity Core Rules"},"content":{"rendered":"<p>Chaim Sanders of Trustwave shared a link to a <a href=\"https:\/\/medium.com\/@foospidy\/collecting-xss-subreddit-payloads-39ce458c934e#.tz1qx2w60\" target=\"_blank\">blogpost<\/a> with XSS extracted from <a href=\"https:\/\/reddit.com\/r\/xss\" target=\"_blank\">Reddit&#8217;s XSS<\/a> subreddit. I sat in the train the other day and thought I could kill time by taking a look at the traffic and how ModSecurity and the Core Rules would handle it.<\/p>\n<p>Here is the <a href=\"https:\/\/raw.githubusercontent.com\/foospidy\/payloads\/master\/other\/xss\/reddit_xss_get.txt\" target=\"_blank\">traffic in question<\/a>. Apparently, this is only the query-strings containing the attacks. First, I needed to transfer it into usable traffic. For simplicity, I created a bash script with curl calls. Naturally, the quotes and brackets are a bit of a hassle, but I finally got it working with the following loop:<\/p>\n<pre>$&gt; N=0;cat reddit_xss_get.txt | while read LINE; do \\\r\n  N=$((N+1)); \\\r\n  MYLINE=$(echo \"$LINE\" | \\\r\n    sed -e 's\/\\\\\"\/\\\\\\\\\\\\\"\/g' -e 's\/\\([^\\\\]\\)\"\/\\1\\\\\"\/g' -e \"s\/{\/\\\\\\{\/g\" \\\r\n        -e \"s\/}\/\\\\\\}\/g\" -e \"s\/\\[\/\\\\\\[\/g\" -e \"s\/]\/\\\\\\]\/g\"); \\\r\n  echo \"echo -n \\\"N=$N : \\\"\"; \\\r\n  echo \"curl --silent \\\"http:\/\/localhost\/index.html?a=1$MYLINE\\\"\"; \\\r\n  echo \"echo\"; \\\r\ndone &gt; run-reddit-css.sh\r\n<\/pre>\n<p>There are 572 different payloads in the file. When I first ran the resulting script <i>run-reddit-css.sh<\/i> against my server, I would get about 450 requests in the access log. I tuned the escaping in the loop above a bit and after a few iterations, I got all 572 requests correctly. The script would then look as follows:<\/p>\n<pre>echo -n \"N=1 : \"\r\ncurl --silent \"http:\/\/localhost\/index.html?a=1&amp;artistName=and%20courtesy%20of%20Apple%3C\/strong%3E%3F%3Ciframe%20src%3D%22http%3A\/\/www.reddit.com\/r\/xss\/new\/%22%20width%3D%22643%22%20height%3D%22239%22%20frameborder%3D%220%22%3E%3C\/iframe%3E%3Cbr\/%3EGood%20job,%20Apple&amp;thumbnailUrl=http%3A\/\/www.fireblog.com\/wp-content\/uploads\/2009\/04\/xss-threat3.jpg&amp;albumName=XSS%20Exploits\"\r\necho\r\necho -n \"N=2 : \"\r\ncurl --silent \"http:\/\/localhost\/index.html?a=1&amp;ErrMsg=%3Cimg%20src=%22http:\/\/imgur.com\/bTkSe.png%22%20\/%3E%3CSCRIPT%3Ealert%28%22xss%22%29%3C\/SCRIPT%3E\"\r\necho\r\necho -n \"N=3 : \"\r\ncurl --silent \"http:\/\/localhost\/index.html?a=1&amp;res=');%3C\/script%3E%3Ciframe%20width=500%20height=500%20src=\/\/bit.ly\/1628nB%3E%3C!--\"\r\n...\r\n<\/pre>\n<p>In order to get useful results, I ran this script against three different setups:<\/p>\n<ul>\n<li>ModSec CRS 2.2.9<\/li>\n<li>ModSec CRS 3.0.0 (dev) Paranoia Level 1<\/li>\n<li>ModSec CRS 3.0.0 (dev) Paranoia Level 2<\/li>\n<\/ul>\n<p>I usually disable a few rules so the IP repudiation is not taken into account (as I do not want to be locked out of the server after the first couple of requests) and User-Agent <em>curl<\/em> does not raise any eyebrowes. Here are the Ignore-Rules in question:<\/p>\n<pre># No Blocking via IP repudiation, based on previous requests\r\nSecRuleRemoveById 949100\r\nSecRuleRemoveById 981140\r\nSecRuleRemoveById 981175\r\n\r\n# No blocking of scanners based on UA\r\nSecRuleRemoveById 990002\r\nSecRuleRemoveById 913300\r\n<\/pre>\n<p>With that, I was ready to launch the payloads against my three setups. All went smooth.<\/p>\n<p>We have previously seen <a href=\"https:\/\/www.netnea.com\/cms\/2015\/12\/20\/modsec-crs-2-2-x-vs-3-0-0-dev\/\" target=\"_blank\">CRS 3.0.0 resulting in lower average anomaly scores<\/a> usually. Here are the averages:<\/p>\n<pre>modsec-positive-stats.txt-2.2.9:     51.0979\r\nmodsec-positive-stats.txt-3.0.0-pl1: 16.9668\r\nmodsec-positive-stats.txt-3.0.0-pl2: 37.2325\r\n<\/pre>\n<p>If you compare the distribution of CRS 3.0.0 PL1 and PL2, you see that PL2 generally shifts most of the requests to higher anomaly scores. This is clearly visible in the following graph (the detailed stats are attached at the end of the post):<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.netnea.com\/cms\/wp-content\/uploads\/2016\/04\/incoming-anomaly-scores-reddit-xss-vs-modsec-3.0.0-pl1and2.png\" alt=\"incoming-anomaly-scores-reddit-xss-vs-modsec-3.0.0-pl1and2\" width=\"640\" height=\"480\" \/><\/p>\n<p>So the upcoming Paranoia Mode in the development version of the Core Rules does what it is meant to do: It is more paranoid and brings more alerts.<\/p>\n<p>With CRS 2.2.9, 22 requests (of 572) passed without any alerts. With CRS 3.0.0 on Paranoia Level 1 (default), this number was 65, on PL 2 again 22 requests (which is by hazard the same number as with 2.2.9). So while it is good to see, that around 95% of the attacks were detected, it is not so cool that 5% went undetected.<\/p>\n<p>Which payload was undetected in 3.0.0 PL2?<\/p>\n<pre>Format:Line-Number Payload\r\n36 &amp;Ntk=All&amp;Ntx=mode+matchallpartial\r\n112 &amp;as2n32vujas83bn2932g=645492598632\r\n328 &amp;q=xss\r\n333 &amp;utm_source=twitterfeed&amp;utm_medium=twitter\r\n343 &amp;template=en_search_error&amp;postalCode=\\\\';alert(0)\/\/\r\n345 &amp;blogid=120\r\n366 &amp;p=37\r\n384 &amp;utm_source=feedburner&amp;utm_medium=feed&amp;utm_campaign=Feed%3A+zdnet%2Fsecurity+%28ZDNet+Zero+Day%29&amp;utm_content=Google+Reader\r\n421 &amp;t=2444\r\n423 &amp;source=20121104_final_push_video\r\n426 &amp;v=zTD4CYnm34c\r\n427 &amp;kid=TTB2\r\n430 &amp;v=s_78bk3dZcc\r\n434 &amp;md5=8780800e375e1ec86cb11a076dffcb61\r\n443 &amp;id=11\r\n445 &amp;sDNSLookup=ANY&amp;fDNSLookup=davealger.info\r\n507 &amp;error=catalogue.asp\r\n538 &amp;l-id=gb_category_search\r\n556 &amp;i=WmYmMm28\r\n557 &amp;q=foobar&amp;after=fizzbuzz\r\n559 &amp;gws_rd=ssl\r\n560 &amp;list=PLpr-xdpM8wG-ZTcHhFfAeBthNVZVEtkg9\r\n<\/pre>\n<p>Looking through this list, it looks that these attacks are not overly aggressive. To say the least. The author of the said list might have looked it through before publishing. There is one exception though, payload on line 343, which is in fact an XSS and I think it should be detected.<br \/>\nIf we look at 2.2.9, there is a single difference: The payload #343 was detected (but #446 was not).<\/p>\n<p>Which rules did detect #343 in 2.2.9?<\/p>\n<pre>958052 Cross-site Scripting (XSS) Attack\r\n973307 XSS Attack Detected\r\n973335 IE XSS Filters - Attack Detected.\r\n<\/pre>\n<p>Apparently, these Anti-XSS rules were all evicted from 3.0.0 likely because of too many false positives. Maybe they had some merits after all. I did not look into the rules which passed ModSec 3.0.0 with paranoia level 1, but the idea of that setting is to have less false positives and accept some false negatives instead. So it is likely some XSS payloads went unnoticed.<\/p>\n<p>Let&#8217;s return to the rules that triggered alerts:<\/p>\n<p><strong>Rule Summary for CRS 2.2.9<\/strong><\/p>\n<pre>Format:Number-of-Alerts Rule-ID Rule-Message\r\n1 950007 Blind SQL Injection Attack\r\n1 958004 Cross-site Scripting (XSS) Attack\r\n1 958006 Cross-site Scripting (XSS) Attack\r\n1 960209 Argument name too long\r\n1 981241 Detects conditional SQL injection attempts\r\n1 981260 SQL Hex Encoding Identified\r\n2 950107 URL Encoding Abuse Attack Attempt\r\n3 960901 Invalid character in request\r\n3 973301 XSS Attack Detected\r\n3 973317 IE XSS Filters - Attack Detected.\r\n3 973324 IE XSS Filters - Attack Detected.\r\n3 981257 Detects MySQL comment-\/space-obfuscated injections and backtick termination\r\n4 958407 Cross-site Scripting (XSS) Attack\r\n4 981248 Detects chained SQL injection attempts 1\/2\r\n5 950120 Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference\/Link\r\n6 950001 SQL Injection Attack\r\n6 958039 Cross-site Scripting (XSS) Attack\r\n6 958056 Cross-site Scripting (XSS) Attack\r\n6 973316 IE XSS Filters - Attack Detected.\r\n6 973327 IE XSS Filters - Attack Detected.\r\n7 950109 Multiple URL Encoding Detected\r\n7 959073 SQL Injection Attack\r\n8 958057 Cross-site Scripting (XSS) Attack\r\n9 973302 XSS Attack Detected\r\n9 981240 Detects MySQL comments, conditions and ch(a)r injections\r\n10 973306 XSS Attack Detected\r\n10 973313 XSS Attack Detected\r\n11 973305 XSS Attack Detected\r\n11 973346 IE XSS Filters - Attack Detected.\r\n12 958409 Cross-site Scripting (XSS) Attack\r\n13 958417 Cross-site Scripting (XSS) Attack\r\n13 973332 IE XSS Filters - Attack Detected.\r\n18 958404 Cross-site Scripting (XSS) Attack\r\n19 973330 IE XSS Filters - Attack Detected.\r\n19 973333 IE XSS Filters - Attack Detected.\r\n23 981246 Detects basic SQL authentication bypass attempts 3\/3\r\n26 958007 Cross-site Scripting (XSS) Attack\r\n26 981231 SQL Comment Sequence Detected.\r\n26 981242 Detects classic SQL injection probings 1\/2\r\n27 960034 HTTP protocol version is not allowed by policy\r\n27 960911 Invalid HTTP Request Line\r\n31 958001 Cross-site Scripting (XSS) Attack\r\n37 981244 Detects basic SQL authentication bypass attempts 1\/3\r\n38 958413 Cross-site Scripting (XSS) Attack\r\n38 981319 SQL Injection Attack: SQL Operator Detected\r\n39 958030 Cross-site Scripting (XSS) Attack\r\n56 973304 XSS Attack Detected\r\n58 973311 XSS Attack Detected\r\n68 958003 Cross-site Scripting (XSS) Attack\r\n70 973338 XSS Filter - Category 3: Javascript URI Vector\r\n78 973303 XSS Attack Detected\r\n82 973334 IE XSS Filters - Attack Detected.\r\n85 973337 XSS Filter - Category 2: Event Handler Vector\r\n188 973310 XSS Attack Detected\r\n218 981243 Detects classic SQL injection probings 2\/2\r\n321 981245 Detects basic SQL authentication bypass attempts 2\/3\r\n330 981318 SQL Injection Attack: Common Injection Testing Detected\r\n351 973335 IE XSS Filters - Attack Detected.\r\n353 973331 IE XSS Filters - Attack Detected.\r\n353 973336 XSS Filter - Category 1: Script Tag Vector\r\n358 958051 Cross-site Scripting (XSS) Attack\r\n370 950901 SQL Injection Attack: SQL Tautology Detected.\r\n422 960024 Meta-Character Anomaly Detection Alert - Repetative Non-Word Characters\r\n434 973300 Possible XSS Attack Detected - HTML Tag Handler\r\n482 973307 XSS Attack Detected\r\n485 958052 Cross-site Scripting (XSS) Attack\r\n545 981173 Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded\r\n<\/pre>\n<p><strong>Rule Summary for CRS 3.0.0 (dev) Paranoia Level 1 (=default)<\/strong><\/p>\n<pre>1 920360 Argument name too long\r\n1 942230 Detects conditional SQL injection attempts\r\n2 920220 URL Encoding Abuse Attack Attempt\r\n3 920270 Invalid character in request\r\n3 941230 IE XSS Filters - Attack Detected.\r\n3 941300 IE XSS Filters - Attack Detected.\r\n6 941140 XSS Filter - Category 4: Javascript URI Vector\r\n8 933120 PHP Injection Attack: Configuration Directive Found\r\n11 941170 NoScript XSS InjectionChecker: Attribute Injection\r\n11 941210 IE XSS Filters - Attack Detected.\r\n19 921150 HTTP Header Injection Attack via payload (CR\/LF deteced)\r\n27 920100 Invalid HTTP Request Line\r\n27 920430 HTTP protocol version is not allowed by policy\r\n85 941120 XSS Filter - Category 2: Event Handler Vector\r\n92 941180 Node-Validator Blacklist Keywords\r\n149 942100 SQL Injection Attack Detected via LibInjection\r\n165 932100 Remote Command Execution (RCE) Attempt\r\n356 941110 XSS Filter - Category 1: Script Tag Vector\r\n460 941100 XSS Attack Detected via Libinjection\r\n479 941160 NoScript XSS InjectionChecker: HTML Injection\r\n<\/pre>\n<p><strong>Rule Summary for CRS 3.0.0 (dev) Paranoia Level 2<\/strong><\/p>\n<pre>1 920360 Argument name too long\r\n1 942230 Detects conditional SQL injection attempts\r\n1 942450 SQL Hex Encoding Identified\r\n2 920220 URL Encoding Abuse Attack Attempt\r\n3 920270 Invalid character in request\r\n3 941230 IE XSS Filters - Attack Detected.\r\n3 941300 IE XSS Filters - Attack Detected.\r\n3 942200 Detects MySQL comment-\/space-obfuscated injections and backtick termination\r\n4 942210 Detects chained SQL injection attempts 1\/2\r\n5 931130 Possible Remote File Inclusion (RFI) Attack: Off-Domain Reference\/Link\r\n6 941140 XSS Filter - Category 4: Javascript URI Vector\r\n6 942150 SQL Injection Attack\r\n7 920230 Multiple URL Encoding Detected\r\n7 942410 SQL Injection Attack\r\n8 933120 PHP Injection Attack: Configuration Directive Found\r\n9 942300 Detects MySQL comments, conditions and ch(a)r injections\r\n11 941170 NoScript XSS InjectionChecker: Attribute Injection\r\n11 941210 IE XSS Filters - Attack Detected.\r\n13 941330 IE XSS Filters - Attack Detected.\r\n19 921150 HTTP Header Injection Attack via payload (CR\/LF deteced)\r\n19 941340 IE XSS Filters - Attack Detected.\r\n23 942340 Detects basic SQL authentication bypass attempts 3\/3\r\n26 942330 Detects classic SQL injection probings 1\/2\r\n26 942440 SQL Comment Sequence Detected.\r\n27 920100 Invalid HTTP Request Line\r\n27 920430 HTTP protocol version is not allowed by policy\r\n37 942180 Detects basic SQL authentication bypass attempts 1\/3\r\n38 942120 SQL Injection Attack: SQL Operator Detected\r\n85 941120 XSS Filter - Category 2: Event Handler Vector\r\n92 941180 Node-Validator Blacklist Keywords\r\n149 942100 SQL Injection Attack Detected via LibInjection\r\n164 932100 Remote Command Execution (RCE) Attempt\r\n218 942370 Detects classic SQL injection probings 2\/2\r\n321 942260 Detects basic SQL authentication bypass attempts 2\/3\r\n328 942110 SQL Injection Attack: Common Injection Testing Detected\r\n356 941110 XSS Filter - Category 1: Script Tag Vector\r\n371 942130 SQL Injection Attack: SQL Tautology Detected.\r\n422 942460 Meta-Character Anomaly Detection Alert - Repetative Non-Word Characters\r\n434 941320 Possible XSS Attack Detected - HTML Tag Handler\r\n460 941100 XSS Attack Detected via Libinjection\r\n479 941160 NoScript XSS InjectionChecker: HTML Injection\r\n545 942430 Restricted SQL Character Anomaly Detection Alert - Total # of special characters exceeded\r\n<\/pre>\n<p>It&#8217;s nice to see that libinject is doing a good job here for the 3.0.0 rules (it&#8217;s not active in CRS 2.2.9; here it is active in rule 941100).<\/p>\n<p>As usual, the workhorse of anomaly detection 942430 (in 2.2.9, this rule was\u00a0981173) is adding many, many alerts for Paranoia Level 2. Unfortunately, this is also the case with legitimate traffic. There are still discussions on <a href=\"https:\/\/github.com\/SpiderLabs\/owasp-modsecurity-crs\/issues\/317\" target=\"_blank\">what to do with this rule<\/a>, but the most likely outcome is, that we are going to raise the limits a bit (and add a stricter sibling at higher Paranoia Level 3 and on and PL 4).<\/p>\n<p>So what do all these stats tell us? ModSecurity does a decent job with detecting XSS. There is a small hole with 3.0.0, that we should look into. But otherwise, things look neat.<\/p>\n<p>If you think, this is interesting research and if you would like to discuss the results, then please join the<a href=\"https:\/\/lists.owasp.org\/mailman\/listinfo\/owasp-modsecurity-core-rule-set\" target=\"_blank\"> OWASP ModSecurity Core Rules Mailinglist<\/a>, where we try to improve the ruleset in an open process.<\/p>\n<p>&nbsp;<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" src=\"\/cms\/wp-content\/uploads\/2016\/07\/portrait-round-300x300.png\" width=\"100\" height=\"100\" \/> Christian Folini <a class=\"twitter-follow-button\" href=\"https:\/\/twitter.com\/ChrFolini\" data-show-count=\"false\">Follow @ChrFolini<\/a> <a class=\"twitter-share-button\" href=\"https:\/\/twitter.com\/share\" data-show-count=\"false\">Tweet<\/a><br \/>\n<script src=\"\/\/platform.twitter.com\/widgets.js\" async=\"\" charset=\"utf-8\"><\/script><\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>&nbsp;<\/p>\n<p>P.S. before I forget, these are the detailed anomaly scores for the various setups:<\/p>\n<p><strong>Anomaly Score Stats for 2.2.9<\/strong><\/p>\n<pre>INCOMING Num of req. | % of req. | Sum of % | Missing %\r\nNumber of incoming req. (total) | 572 | 100.0000% | 100.0000% | 0.0000%\r\n\r\nEmpty or miss. incoming score | 0 | 0.0000% | 0.0000% | 100.0000%\r\nReqs with incoming score of 0 | 22 | 3.8461% | 3.8461% | 96.1539%\r\nReqs with incoming score of 1 | 0 | 0.0000% | 3.8461% | 96.1539%\r\nReqs with incoming score of 2 | 0 | 0.0000% | 3.8461% | 96.1539%\r\nReqs with incoming score of 3 | 0 | 0.0000% | 3.8461% | 96.1539%\r\nReqs with incoming score of 4 | 0 | 0.0000% | 3.8461% | 96.1539%\r\nReqs with incoming score of 5 | 8 | 1.3986% | 5.2447% | 94.7553%\r\nReqs with incoming score of 6 | 0 | 0.0000% | 5.2447% | 94.7553%\r\nReqs with incoming score of 7 | 0 | 0.0000% | 5.2447% | 94.7553%\r\nReqs with incoming score of 8 | 2 | 0.3496% | 5.5944% | 94.4056%\r\nReqs with incoming score of 9 | 0 | 0.0000% | 5.5944% | 94.4056%\r\nReqs with incoming score of 10 | 5 | 0.8741% | 6.4685% | 93.5315%\r\nReqs with incoming score of 11 | 0 | 0.0000% | 6.4685% | 93.5315%\r\nReqs with incoming score of 12 | 0 | 0.0000% | 6.4685% | 93.5315%\r\nReqs with incoming score of 13 | 1 | 0.1748% | 6.6433% | 93.3567%\r\nReqs with incoming score of 14 | 0 | 0.0000% | 6.6433% | 93.3567%\r\nReqs with incoming score of 15 | 5 | 0.8741% | 7.5174% | 92.4826%\r\nReqs with incoming score of 16 | 0 | 0.0000% | 7.5174% | 92.4826%\r\nReqs with incoming score of 17 | 0 | 0.0000% | 7.5174% | 92.4826%\r\nReqs with incoming score of 18 | 4 | 0.6993% | 8.2167% | 91.7833%\r\nReqs with incoming score of 19 | 0 | 0.0000% | 8.2167% | 91.7833%\r\nReqs with incoming score of 20 | 14 | 2.4475% | 10.6643% | 89.3357%\r\nReqs with incoming score of 21 | 2 | 0.3496% | 11.0139% | 88.9861%\r\nReqs with incoming score of 22 | 0 | 0.0000% | 11.0139% | 88.9861%\r\nReqs with incoming score of 23 | 8 | 1.3986% | 12.4125% | 87.5875%\r\nReqs with incoming score of 24 | 0 | 0.0000% | 12.4125% | 87.5875%\r\nReqs with incoming score of 25 | 1 | 0.1748% | 12.5874% | 87.4126%\r\nReqs with incoming score of 26 | 9 | 1.5734% | 14.1608% | 85.8392%\r\nReqs with incoming score of 27 | 0 | 0.0000% | 14.1608% | 85.8392%\r\nReqs with incoming score of 28 | 2 | 0.3496% | 14.5104% | 85.4896%\r\nReqs with incoming score of 29 | 0 | 0.0000% | 14.5104% | 85.4896%\r\nReqs with incoming score of 30 | 0 | 0.0000% | 14.5104% | 85.4896%\r\nReqs with incoming score of 31 | 21 | 3.6713% | 18.1818% | 81.8182%\r\nReqs with incoming score of 32 | 0 | 0.0000% | 18.1818% | 81.8182%\r\nReqs with incoming score of 33 | 15 | 2.6223% | 20.8041% | 79.1959%\r\nReqs with incoming score of 34 | 1 | 0.1748% | 20.9790% | 79.0210%\r\nReqs with incoming score of 35 | 0 | 0.0000% | 20.9790% | 79.0210%\r\nReqs with incoming score of 36 | 19 | 3.3216% | 24.3006% | 75.6994%\r\nReqs with incoming score of 37 | 0 | 0.0000% | 24.3006% | 75.6994%\r\nReqs with incoming score of 38 | 9 | 1.5734% | 25.8741% | 74.1259%\r\nReqs with incoming score of 39 | 0 | 0.0000% | 25.8741% | 74.1259%\r\nReqs with incoming score of 40 | 0 | 0.0000% | 25.8741% | 74.1259%\r\nReqs with incoming score of 41 | 17 | 2.9720% | 28.8461% | 71.1539%\r\nReqs with incoming score of 42 | 0 | 0.0000% | 28.8461% | 71.1539%\r\nReqs with incoming score of 43 | 24 | 4.1958% | 33.0419% | 66.9581%\r\nReqs with incoming score of 44 | 1 | 0.1748% | 33.2167% | 66.7833%\r\nReqs with incoming score of 45 | 4 | 0.6993% | 33.9160% | 66.0840%\r\nReqs with incoming score of 46 | 49 | 8.5664% | 42.4825% | 57.5175%\r\nReqs with incoming score of 47 | 0 | 0.0000% | 42.4825% | 57.5175%\r\nReqs with incoming score of 48 | 15 | 2.6223% | 45.1048% | 54.8952%\r\nReqs with incoming score of 49 | 1 | 0.1748% | 45.2797% | 54.7203%\r\nReqs with incoming score of 50 | 0 | 0.0000% | 45.2797% | 54.7203%\r\nReqs with incoming score of 51 | 60 | 10.4895% | 55.7692% | 44.2308%\r\nReqs with incoming score of 52 | 0 | 0.0000% | 55.7692% | 44.2308%\r\nReqs with incoming score of 53 | 12 | 2.0979% | 57.8671% | 42.1329%\r\nReqs with incoming score of 54 | 1 | 0.1748% | 58.0419% | 41.9581%\r\nReqs with incoming score of 55 | 1 | 0.1748% | 58.2167% | 41.7833%\r\nReqs with incoming score of 56 | 17 | 2.9720% | 61.1888% | 38.8112%\r\nReqs with incoming score of 57 | 1 | 0.1748% | 61.3636% | 38.6364%\r\nReqs with incoming score of 58 | 19 | 3.3216% | 64.6853% | 35.3147%\r\nReqs with incoming score of 59 | 1 | 0.1748% | 64.8601% | 35.1399%\r\nReqs with incoming score of 60 | 0 | 0.0000% | 64.8601% | 35.1399%\r\nReqs with incoming score of 61 | 47 | 8.2167% | 73.0769% | 26.9231%\r\nReqs with incoming score of 62 | 1 | 0.1748% | 73.2517% | 26.7483%\r\nReqs with incoming score of 63 | 3 | 0.5244% | 73.7762% | 26.2238%\r\nReqs with incoming score of 64 | 0 | 0.0000% | 73.7762% | 26.2238%\r\nReqs with incoming score of 65 | 0 | 0.0000% | 73.7762% | 26.2238%\r\nReqs with incoming score of 66 | 97 | 16.9580% | 90.7342% | 9.2658%\r\nReqs with incoming score of 67 | 0 | 0.0000% | 90.7342% | 9.2658%\r\nReqs with incoming score of 68 | 2 | 0.3496% | 91.0839% | 8.9161%\r\nReqs with incoming score of 69 | 0 | 0.0000% | 91.0839% | 8.9161%\r\nReqs with incoming score of 70 | 0 | 0.0000% | 91.0839% | 8.9161%\r\nReqs with incoming score of 71 | 7 | 1.2237% | 92.3076% | 7.6924%\r\nReqs with incoming score of 72 | 0 | 0.0000% | 92.3076% | 7.6924%\r\nReqs with incoming score of 73 | 1 | 0.1748% | 92.4825% | 7.5175%\r\nReqs with incoming score of 74 | 0 | 0.0000% | 92.4825% | 7.5175%\r\nReqs with incoming score of 75 | 0 | 0.0000% | 92.4825% | 7.5175%\r\nReqs with incoming score of 76 | 13 | 2.2727% | 94.7552% | 5.2448%\r\nReqs with incoming score of 77 | 0 | 0.0000% | 94.7552% | 5.2448%\r\nReqs with incoming score of 78 | 1 | 0.1748% | 94.9300% | 5.0700%\r\nReqs with incoming score of 79 | 0 | 0.0000% | 94.9300% | 5.0700%\r\nReqs with incoming score of 80 | 0 | 0.0000% | 94.9300% | 5.0700%\r\nReqs with incoming score of 81 | 3 | 0.5244% | 95.4545% | 4.5455%\r\nReqs with incoming score of 82 | 0 | 0.0000% | 95.4545% | 4.5455%\r\nReqs with incoming score of 83 | 1 | 0.1748% | 95.6293% | 4.3707%\r\nReqs with incoming score of 84 | 0 | 0.0000% | 95.6293% | 4.3707%\r\nReqs with incoming score of 85 | 0 | 0.0000% | 95.6293% | 4.3707%\r\nReqs with incoming score of 86 | 3 | 0.5244% | 96.1538% | 3.8462%\r\nReqs with incoming score of 87 | 0 | 0.0000% | 96.1538% | 3.8462%\r\nReqs with incoming score of 88 | 0 | 0.0000% | 96.1538% | 3.8462%\r\nReqs with incoming score of 89 | 0 | 0.0000% | 96.1538% | 3.8462%\r\nReqs with incoming score of 90 | 0 | 0.0000% | 96.1538% | 3.8462%\r\nReqs with incoming score of 91 | 2 | 0.3496% | 96.5034% | 3.4966%\r\nReqs with incoming score of 92 | 0 | 0.0000% | 96.5034% | 3.4966%\r\nReqs with incoming score of 93 | 0 | 0.0000% | 96.5034% | 3.4966%\r\nReqs with incoming score of 94 | 0 | 0.0000% | 96.5034% | 3.4966%\r\nReqs with incoming score of 95 | 0 | 0.0000% | 96.5034% | 3.4966%\r\nReqs with incoming score of 96 | 1 | 0.1748% | 96.6783% | 3.3217%\r\nReqs with incoming score of 97 | 0 | 0.0000% | 96.6783% | 3.3217%\r\nReqs with incoming score of 98 | 8 | 1.3986% | 98.0769% | 1.9231%\r\nReqs with incoming score of 99 | 0 | 0.0000% | 98.0769% | 1.9231%\r\nReqs with incoming score of 100 | 0 | 0.0000% | 98.0769% | 1.9231%\r\nReqs with incoming score of 101 | 0 | 0.0000% | 98.0769% | 1.9231%\r\nReqs with incoming score of 102 | 0 | 0.0000% | 98.0769% | 1.9231%\r\nReqs with incoming score of 103 | 0 | 0.0000% | 98.0769% | 1.9231%\r\nReqs with incoming score of 104 | 0 | 0.0000% | 98.0769% | 1.9231%\r\nReqs with incoming score of 105 | 0 | 0.0000% | 98.0769% | 1.9231%\r\nReqs with incoming score of 106 | 1 | 0.1748% | 98.2517% | 1.7483%\r\nReqs with incoming score of 107 | 0 | 0.0000% | 98.2517% | 1.7483%\r\nReqs with incoming score of 108 | 0 | 0.0000% | 98.2517% | 1.7483%\r\nReqs with incoming score of 109 | 0 | 0.0000% | 98.2517% | 1.7483%\r\nReqs with incoming score of 110 | 0 | 0.0000% | 98.2517% | 1.7483%\r\nReqs with incoming score of 111 | 1 | 0.1748% | 98.4265% | 1.5735%\r\nReqs with incoming score of 112 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 113 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 114 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 115 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 116 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 117 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 118 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 119 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 120 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 121 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 122 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 123 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 124 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 125 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 126 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 127 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 128 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 129 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 130 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 131 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 132 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 133 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 134 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 135 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 136 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 137 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 138 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 139 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 140 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 141 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 142 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 143 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 144 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 145 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 146 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 147 | 0 | 0.0000% | 98.4265% | 1.5735%\r\nReqs with incoming score of 148 | 1 | 0.1748% | 98.6013% | 1.3987%\r\nReqs with incoming score of 149 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 150 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 151 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 152 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 153 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 154 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 155 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 156 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 157 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 158 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 159 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 160 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 161 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 162 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 163 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 164 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 165 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 166 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 167 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 168 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 169 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 170 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 171 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 172 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 173 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 174 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 175 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 176 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 177 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 178 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 179 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 180 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 181 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 182 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 183 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 184 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 185 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 186 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 187 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 188 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 189 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 190 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 191 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 192 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 193 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 194 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 195 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 196 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 197 | 0 | 0.0000% | 98.6013% | 1.3987%\r\nReqs with incoming score of 198 | 1 | 0.1748% | 98.7762% | 1.2238%\r\nReqs with incoming score of 199 | 0 | 0.0000% | 98.7762% | 1.2238%\r\nReqs with incoming score of 200 | 0 | 0.0000% | 98.7762% | 1.2238%\r\nReqs with incoming score of 201 | 0 | 0.0000% | 98.7762% | 1.2238%\r\nReqs with incoming score of 202 | 6 | 1.0489% | 99.8251% | 0.1749%\r\nReqs with incoming score of 203 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 204 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 205 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 206 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 207 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 208 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 209 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 210 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 211 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 212 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 213 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 214 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 215 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 216 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 217 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 218 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 219 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 220 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 221 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 222 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 223 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 224 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 225 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 226 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 227 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 228 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 229 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 230 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 231 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 232 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 233 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 234 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 235 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 236 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 237 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 238 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 239 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 240 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 241 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 242 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 243 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 244 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 245 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 246 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 247 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 248 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 249 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 250 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 251 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 252 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 253 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 254 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 255 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 256 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 257 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 258 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 259 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 260 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 261 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 262 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 263 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 264 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 265 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 266 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 267 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 268 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 269 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 270 | 0 | 0.0000% | 99.8251% | 0.1749%\r\nReqs with incoming score of 271 | 1 | 0.1748% | 99.9999% | 0.0001%\r\n\r\nIncoming average: 51.0979 Median 51.0000 Standard deviation 27.9241\r\n<\/pre>\n<p><strong>Anomaly Score Stats for 3.0.0 (dev) Paranoia Level 1(default)<\/strong><\/p>\n<pre>INCOMING                     Num of req. | % of req. |  Sum of % | Missing %\r\nNumber of incoming req. (total) |    572 | 100.0000% | 100.0000% |   0.0000%\r\n\r\nEmpty or miss. incoming score   |      0 |   0.0000% |   0.0000% | 100.0000%\r\nReqs with incoming score of   0 |     65 |  11.3636% |  11.3636% |  88.6364%\r\nReqs with incoming score of   1 |      0 |   0.0000% |  11.3636% |  88.6364%\r\nReqs with incoming score of   2 |      0 |   0.0000% |  11.3636% |  88.6364%\r\nReqs with incoming score of   3 |      0 |   0.0000% |  11.3636% |  88.6364%\r\nReqs with incoming score of   4 |      0 |   0.0000% |  11.3636% |  88.6364%\r\nReqs with incoming score of   5 |     21 |   3.6713% |  15.0349% |  84.9651%\r\nReqs with incoming score of   6 |      0 |   0.0000% |  15.0349% |  84.9651%\r\nReqs with incoming score of   7 |      0 |   0.0000% |  15.0349% |  84.9651%\r\nReqs with incoming score of   8 |      0 |   0.0000% |  15.0349% |  84.9651%\r\nReqs with incoming score of   9 |      0 |   0.0000% |  15.0349% |  84.9651%\r\nReqs with incoming score of  10 |     27 |   4.7202% |  19.7552% |  80.2448%\r\nReqs with incoming score of  11 |      0 |   0.0000% |  19.7552% |  80.2448%\r\nReqs with incoming score of  12 |      1 |   0.1748% |  19.9300% |  80.0700%\r\nReqs with incoming score of  13 |      0 |   0.0000% |  19.9300% |  80.0700%\r\nReqs with incoming score of  14 |      0 |   0.0000% |  19.9300% |  80.0700%\r\nReqs with incoming score of  15 |    220 |  38.4615% |  58.3916% |  41.6084%\r\nReqs with incoming score of  16 |      0 |   0.0000% |  58.3916% |  41.6084%\r\nReqs with incoming score of  17 |      0 |   0.0000% |  58.3916% |  41.6084%\r\nReqs with incoming score of  18 |      0 |   0.0000% |  58.3916% |  41.6084%\r\nReqs with incoming score of  19 |      0 |   0.0000% |  58.3916% |  41.6084%\r\nReqs with incoming score of  20 |    125 |  21.8531% |  80.2447% |  19.7553%\r\nReqs with incoming score of  21 |      0 |   0.0000% |  80.2447% |  19.7553%\r\nReqs with incoming score of  22 |      0 |   0.0000% |  80.2447% |  19.7553%\r\nReqs with incoming score of  23 |      1 |   0.1748% |  80.4195% |  19.5805%\r\nReqs with incoming score of  24 |      0 |   0.0000% |  80.4195% |  19.5805%\r\nReqs with incoming score of  25 |     63 |  11.0139% |  91.4335% |   8.5665%\r\nReqs with incoming score of  26 |      0 |   0.0000% |  91.4335% |   8.5665%\r\nReqs with incoming score of  27 |      0 |   0.0000% |  91.4335% |   8.5665%\r\nReqs with incoming score of  28 |      1 |   0.1748% |  91.6083% |   8.3917%\r\nReqs with incoming score of  29 |      0 |   0.0000% |  91.6083% |   8.3917%\r\nReqs with incoming score of  30 |     19 |   3.3216% |  94.9300% |   5.0700%\r\nReqs with incoming score of  31 |      0 |   0.0000% |  94.9300% |   5.0700%\r\nReqs with incoming score of  32 |      0 |   0.0000% |  94.9300% |   5.0700%\r\nReqs with incoming score of  33 |      0 |   0.0000% |  94.9300% |   5.0700%\r\nReqs with incoming score of  34 |      0 |   0.0000% |  94.9300% |   5.0700%\r\nReqs with incoming score of  35 |     15 |   2.6223% |  97.5524% |   2.4476%\r\nReqs with incoming score of  36 |      0 |   0.0000% |  97.5524% |   2.4476%\r\nReqs with incoming score of  37 |      0 |   0.0000% |  97.5524% |   2.4476%\r\nReqs with incoming score of  38 |      0 |   0.0000% |  97.5524% |   2.4476%\r\nReqs with incoming score of  39 |      0 |   0.0000% |  97.5524% |   2.4476%\r\nReqs with incoming score of  40 |      2 |   0.3496% |  97.9020% |   2.0980%\r\nReqs with incoming score of  41 |      0 |   0.0000% |  97.9020% |   2.0980%\r\nReqs with incoming score of  42 |      0 |   0.0000% |  97.9020% |   2.0980%\r\nReqs with incoming score of  43 |      0 |   0.0000% |  97.9020% |   2.0980%\r\nReqs with incoming score of  44 |      0 |   0.0000% |  97.9020% |   2.0980%\r\nReqs with incoming score of  45 |      2 |   0.3496% |  98.2517% |   1.7483%\r\nReqs with incoming score of  46 |      0 |   0.0000% |  98.2517% |   1.7483%\r\nReqs with incoming score of  47 |      0 |   0.0000% |  98.2517% |   1.7483%\r\nReqs with incoming score of  48 |      0 |   0.0000% |  98.2517% |   1.7483%\r\nReqs with incoming score of  49 |      0 |   0.0000% |  98.2517% |   1.7483%\r\nReqs with incoming score of  50 |      1 |   0.1748% |  98.4265% |   1.5735%\r\nReqs with incoming score of  51 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  52 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  53 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  54 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  55 |      1 |   0.1748% |  98.6013% |   1.3987%\r\nReqs with incoming score of  56 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of  57 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of  58 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of  59 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of  60 |      7 |   1.2237% |  99.8251% |   0.1749%\r\nReqs with incoming score of  61 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  62 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  63 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  64 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  65 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  66 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  67 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  68 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  69 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  70 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  71 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  72 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  73 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  74 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  75 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  76 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  77 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  78 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  79 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  80 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  81 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  82 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  83 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  84 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  85 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  86 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  87 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  88 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  89 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  90 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  91 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  92 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  93 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  94 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  95 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  96 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  97 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  98 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of  99 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 100 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 101 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 102 |      1 |   0.1748% | 100.0000% |   0.0000%\r\n\r\nIncoming average:  16.9668    Median  15.0000    Standard deviation  10.4738\r\n<\/pre>\n<p><strong>Anomaly Score Stats for 3.0.0 (dev) Paranoia Level 2<\/strong><\/p>\n<pre>INCOMING                     Num of req. | % of req. |  Sum of % | Missing %\r\nNumber of incoming req. (total) |    572 | 100.0000% | 100.0000% |   0.0000%\r\n\r\nEmpty or miss. incoming score   |      0 |   0.0000% |   0.0000% | 100.0000%\r\nReqs with incoming score of   0 |     22 |   3.8461% |   3.8461% |  96.1539%\r\nReqs with incoming score of   1 |      0 |   0.0000% |   3.8461% |  96.1539%\r\nReqs with incoming score of   2 |      0 |   0.0000% |   3.8461% |  96.1539%\r\nReqs with incoming score of   3 |      7 |   1.2237% |   5.0699% |  94.9301%\r\nReqs with incoming score of   4 |      0 |   0.0000% |   5.0699% |  94.9301%\r\nReqs with incoming score of   5 |      9 |   1.5734% |   6.6433% |  93.3567%\r\nReqs with incoming score of   6 |      7 |   1.2237% |   7.8671% |  92.1329%\r\nReqs with incoming score of   7 |      0 |   0.0000% |   7.8671% |  92.1329%\r\nReqs with incoming score of   8 |      1 |   0.1748% |   8.0419% |  91.9581%\r\nReqs with incoming score of   9 |     18 |   3.1468% |  11.1888% |  88.8112%\r\nReqs with incoming score of  10 |      8 |   1.3986% |  12.5874% |  87.4126%\r\nReqs with incoming score of  11 |      4 |   0.6993% |  13.2867% |  86.7133%\r\nReqs with incoming score of  12 |      0 |   0.0000% |  13.2867% |  86.7133%\r\nReqs with incoming score of  13 |      3 |   0.5244% |  13.8111% |  86.1889%\r\nReqs with incoming score of  14 |      6 |   1.0489% |  14.8601% |  85.1399%\r\nReqs with incoming score of  15 |      4 |   0.6993% |  15.5594% |  84.4406%\r\nReqs with incoming score of  16 |      4 |   0.6993% |  16.2587% |  83.7413%\r\nReqs with incoming score of  17 |      0 |   0.0000% |  16.2587% |  83.7413%\r\nReqs with incoming score of  18 |      9 |   1.5734% |  17.8321% |  82.1679%\r\nReqs with incoming score of  19 |      6 |   1.0489% |  18.8811% |  81.1189%\r\nReqs with incoming score of  20 |      0 |   0.0000% |  18.8811% |  81.1189%\r\nReqs with incoming score of  21 |      1 |   0.1748% |  19.0559% |  80.9441%\r\nReqs with incoming score of  22 |      0 |   0.0000% |  19.0559% |  80.9441%\r\nReqs with incoming score of  23 |     17 |   2.9720% |  22.0279% |  77.9721%\r\nReqs with incoming score of  24 |      2 |   0.3496% |  22.3776% |  77.6224%\r\nReqs with incoming score of  25 |      0 |   0.0000% |  22.3776% |  77.6224%\r\nReqs with incoming score of  26 |     10 |   1.7482% |  24.1258% |  75.8742%\r\nReqs with incoming score of  27 |      0 |   0.0000% |  24.1258% |  75.8742%\r\nReqs with incoming score of  28 |     17 |   2.9720% |  27.0979% |  72.9021%\r\nReqs with incoming score of  29 |      5 |   0.8741% |  27.9720% |  72.0280%\r\nReqs with incoming score of  30 |      0 |   0.0000% |  27.9720% |  72.0280%\r\nReqs with incoming score of  31 |     26 |   4.5454% |  32.5174% |  67.4826%\r\nReqs with incoming score of  32 |      0 |   0.0000% |  32.5174% |  67.4826%\r\nReqs with incoming score of  33 |     15 |   2.6223% |  35.1398% |  64.8602%\r\nReqs with incoming score of  34 |     10 |   1.7482% |  36.8881% |  63.1119%\r\nReqs with incoming score of  35 |      4 |   0.6993% |  37.5874% |  62.4126%\r\nReqs with incoming score of  36 |     58 |  10.1398% |  47.7272% |  52.2728%\r\nReqs with incoming score of  37 |      0 |   0.0000% |  47.7272% |  52.2728%\r\nReqs with incoming score of  38 |      2 |   0.3496% |  48.0769% |  51.9231%\r\nReqs with incoming score of  39 |     60 |  10.4895% |  58.5664% |  41.4336%\r\nReqs with incoming score of  40 |      0 |   0.0000% |  58.5664% |  41.4336%\r\nReqs with incoming score of  41 |     55 |   9.6153% |  68.1818% |  31.8182%\r\nReqs with incoming score of  42 |      0 |   0.0000% |  68.1818% |  31.8182%\r\nReqs with incoming score of  43 |      0 |   0.0000% |  68.1818% |  31.8182%\r\nReqs with incoming score of  44 |     50 |   8.7412% |  76.9230% |  23.0770%\r\nReqs with incoming score of  45 |      0 |   0.0000% |  76.9230% |  23.0770%\r\nReqs with incoming score of  46 |     19 |   3.3216% |  80.2447% |  19.7553%\r\nReqs with incoming score of  47 |      1 |   0.1748% |  80.4195% |  19.5805%\r\nReqs with incoming score of  48 |      1 |   0.1748% |  80.5944% |  19.4056%\r\nReqs with incoming score of  49 |     26 |   4.5454% |  85.1398% |  14.8602%\r\nReqs with incoming score of  50 |      0 |   0.0000% |  85.1398% |  14.8602%\r\nReqs with incoming score of  51 |      7 |   1.2237% |  86.3636% |  13.6364%\r\nReqs with incoming score of  52 |      1 |   0.1748% |  86.5384% |  13.4616%\r\nReqs with incoming score of  53 |      1 |   0.1748% |  86.7132% |  13.2868%\r\nReqs with incoming score of  54 |     13 |   2.2727% |  88.9860% |  11.0140%\r\nReqs with incoming score of  55 |      0 |   0.0000% |  88.9860% |  11.0140%\r\nReqs with incoming score of  56 |      6 |   1.0489% |  90.0349% |   9.9651%\r\nReqs with incoming score of  57 |      1 |   0.1748% |  90.2097% |   9.7903%\r\nReqs with incoming score of  58 |      1 |   0.1748% |  90.3846% |   9.6154%\r\nReqs with incoming score of  59 |     14 |   2.4475% |  92.8321% |   7.1679%\r\nReqs with incoming score of  60 |      0 |   0.0000% |  92.8321% |   7.1679%\r\nReqs with incoming score of  61 |      2 |   0.3496% |  93.1818% |   6.8182%\r\nReqs with incoming score of  62 |      1 |   0.1748% |  93.3566% |   6.6434%\r\nReqs with incoming score of  63 |      0 |   0.0000% |  93.3566% |   6.6434%\r\nReqs with incoming score of  64 |      9 |   1.5734% |  94.9300% |   5.0700%\r\nReqs with incoming score of  65 |      0 |   0.0000% |  94.9300% |   5.0700%\r\nReqs with incoming score of  66 |      4 |   0.6993% |  95.6293% |   4.3707%\r\nReqs with incoming score of  67 |      1 |   0.1748% |  95.8041% |   4.1959%\r\nReqs with incoming score of  68 |      0 |   0.0000% |  95.8041% |   4.1959%\r\nReqs with incoming score of  69 |      2 |   0.3496% |  96.1538% |   3.8462%\r\nReqs with incoming score of  70 |      0 |   0.0000% |  96.1538% |   3.8462%\r\nReqs with incoming score of  71 |      0 |   0.0000% |  96.1538% |   3.8462%\r\nReqs with incoming score of  72 |      1 |   0.1748% |  96.3286% |   3.6714%\r\nReqs with incoming score of  73 |      1 |   0.1748% |  96.5034% |   3.4966%\r\nReqs with incoming score of  74 |      2 |   0.3496% |  96.8531% |   3.1469%\r\nReqs with incoming score of  75 |      0 |   0.0000% |  96.8531% |   3.1469%\r\nReqs with incoming score of  76 |      0 |   0.0000% |  96.8531% |   3.1469%\r\nReqs with incoming score of  77 |      0 |   0.0000% |  96.8531% |   3.1469%\r\nReqs with incoming score of  78 |      0 |   0.0000% |  96.8531% |   3.1469%\r\nReqs with incoming score of  79 |      0 |   0.0000% |  96.8531% |   3.1469%\r\nReqs with incoming score of  80 |      0 |   0.0000% |  96.8531% |   3.1469%\r\nReqs with incoming score of  81 |      8 |   1.3986% |  98.2517% |   1.7483%\r\nReqs with incoming score of  82 |      1 |   0.1748% |  98.4265% |   1.5735%\r\nReqs with incoming score of  83 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  84 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  85 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  86 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  87 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  88 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  89 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  90 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  91 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  92 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  93 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  94 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  95 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  96 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  97 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  98 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of  99 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 100 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 101 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 102 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 103 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 104 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 105 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 106 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 107 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 108 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 109 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 110 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 111 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 112 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 113 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 114 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 115 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 116 |      0 |   0.0000% |  98.4265% |   1.5735%\r\nReqs with incoming score of 117 |      1 |   0.1748% |  98.6013% |   1.3987%\r\nReqs with incoming score of 118 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 119 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 120 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 121 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 122 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 123 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 124 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 125 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 126 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 127 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 128 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 129 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 130 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 131 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 132 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 133 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 134 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 135 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 136 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 137 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 138 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 139 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 140 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 141 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 142 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 143 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 144 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 145 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 146 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 147 |      0 |   0.0000% |  98.6013% |   1.3987%\r\nReqs with incoming score of 148 |      6 |   1.0489% |  99.6503% |   0.3497%\r\nReqs with incoming score of 149 |      0 |   0.0000% |  99.6503% |   0.3497%\r\nReqs with incoming score of 150 |      0 |   0.0000% |  99.6503% |   0.3497%\r\nReqs with incoming score of 151 |      0 |   0.0000% |  99.6503% |   0.3497%\r\nReqs with incoming score of 152 |      0 |   0.0000% |  99.6503% |   0.3497%\r\nReqs with incoming score of 153 |      0 |   0.0000% |  99.6503% |   0.3497%\r\nReqs with incoming score of 154 |      1 |   0.1748% |  99.8251% |   0.1749%\r\nReqs with incoming score of 155 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 156 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 157 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 158 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 159 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 160 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 161 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 162 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 163 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 164 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 165 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 166 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 167 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 168 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 169 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 170 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 171 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 172 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 173 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 174 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 175 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 176 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 177 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 178 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 179 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 180 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 181 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 182 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 183 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 184 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 185 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 186 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 187 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 188 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 189 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 190 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 191 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 192 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 193 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 194 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 195 |      0 |   0.0000% |  99.8251% |   0.1749%\r\nReqs with incoming score of 196 |      1 |   0.1748% |  99.9999% |   0.0001%\r\n\r\nIncoming average:  37.2325    Median  39.0000    Standard deviation  22.1551\r\n<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Chaim Sanders of Trustwave shared a link to a blogpost with XSS extracted from Reddit&#8217;s XSS subreddit. I sat in the train the other day and thought I could kill time by taking a look at the traffic and how ModSecurity and the Core Rules would handle it. Here is the traffic in question. Apparently, [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":811,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[33,10,15],"class_list":{"0":"post-808","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security","8":"tag-core-rules","9":"tag-modsecurity","10":"tag-security-2","11":"czr-hentry"},"_links":{"self":[{"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/posts\/808","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/comments?post=808"}],"version-history":[{"count":18,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/posts\/808\/revisions"}],"predecessor-version":[{"id":878,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/posts\/808\/revisions\/878"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/media\/811"}],"wp:attachment":[{"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/media?parent=808"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/categories?post=808"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.netnea.com\/cms\/wp-json\/wp\/v2\/tags?post=808"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}