error crowdsec in joomla

[Raxiel1987]

2024-08-01T17:03:30.006424816Z 2024/08/01 19:03:29 [error] 4153#4153: *4134 [client 151.15.29.137] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator Ge' with parameter 5' against variable TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: 15' ) [file "/usr/local/nginx/conf/conf.d/include/coreruleset/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.4.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "10.1.1.245"] [uri "/administrator/index.php"] [unique_id "172253180928.110070"] [ref ""], client: xxx.xxx.xxx.xx7, server: xxxxxxxxxt.tdl, request: "POST /administrator/index.php?option=com_config HTTP/2.0", host: "xxxxxxxx.tdl", referrer: "https://rxxxxxxx.tdl/administrator/index.php?option=com_config"

i get this error when try to save in the configuration
if i disable coreruleset all is working

[Zoey2936]

if coreruleset overblocks you either need to disable it or try to whitelist some actions

[Raxiel1987]

if i disable corelureset my websites are "less" secure? or if i have crowdsec installed i should be "secure"?

now i have modsecurity enabled but coreruleset disabled and crowdsec installed and running, as i show from logs it block request from russia and other regions, so i assumed is enabled right?

[Zoey2936]

depends on how you define security, since coreruleset breaks a lot of my sites, I use it only a few. For everything else personally crowdsec is enough for me

[Raxiel1987]

ok good to know so i only use crowdsec and modsecurity thanks :D