From e1188b41750e678e8b385e8078bfa405ca79267a Mon Sep 17 00:00:00 2001
From: root <root@jabali.lan>
Date: Fri, 30 Jan 2026 23:42:20 +0200
Subject: [PATCH] Capture Host header from audit log requests

---
 bin/jabali-agent | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/bin/jabali-agent b/bin/jabali-agent
index a653efa..1c143c2 100755
--- a/bin/jabali-agent
+++ b/bin/jabali-agent
@@ -780,6 +780,10 @@ function wafAuditLogList(array $params): array
             $current['host'] = trim($matches[1]);
             continue;
         }
+        if (preg_match('/^Host:\s*(.+)$/', $line, $matches)) {
+            $current['host'] = trim($matches[1]);
+            continue;
+        }
 
         if (!str_contains($line, 'ModSecurity:')) {
             continue;