SecRule REMOTE_ADDR "@rbl sbl-xbl.spamhaus.org"
"phase:1,id:'981138',t:none,pass,nolog,auditlog,msg:'RBL Match for SPAM Source',
tag:'AUTOMATION/MALICIOUS',severity:'2',setvar:'tx.msg=%{rule.msg}',
setvar:tx.automation_score=+%{tx.warning_anomaly_score},
setvar:tx.anomaly_score=+%{tx.warning_anomaly_score},
setvar:tx.%{rule.id}-AUTOMATION/MALICIOUS-%{matched_var_name}=%{matched_var},
setvar:ip.spammer=1,expirevar:ip.spammer=86400,setvar:ip.previous_rbl_check=1,
expirevar:ip.previous_rbl_check=86400,skipAfter:END_RBL_CHECK"