Capture Host header from audit log requests

2026-01-30 23:42:20 +02:00
parent ef601d0a88
commit e1188b4175
1 changed files with 4 additions and 0 deletions
--- a/bin/jabali-agent
+++ b/bin/jabali-agent
@@ -780,6 +780,10 @@ function wafAuditLogList(array $params): array
            $current['host'] = trim($matches[1]);
            continue;
        }
+        if (preg_match('/^Host:\s*(.+)$/', $line, $matches)) {
+            $current['host'] = trim($matches[1]);
+            continue;
+        }

        if (!str_contains($line, 'ModSecurity:')) {
            continue;