## SecRuleUpdate dialog

The <kbd>➗ Modify</kbd> dialog allows to change flags for rules, such
as logging or distruptive actions. It also combines SecRuleUpdateTarget
changes, so input parameters can be exempt from rules. It's not overly
practical in a GUI tool, but again provides a good starting point for
adapting behaviour and has some tooltip help.


Looks more complicated than it is. You usually just want to change
the colorful flags for some rules. Params and control options are
less useful usually.

The <kbd>Save</kbd> will apply whatever the preview box atop this
dialog shows. So technically you could edit the generated directives.
(They only update whenever a significant input or checkbox is changed.)


## Target/Vars

Defines which input variables you want to remove from the rule condition /
check.

 * You don't usually want to change rules that check any `TX.*`
   variables, but `REQUEST_*` or `ARGS` for example.
 * You can select from some of the default options, or add custom names
   in either of the input fields.
 * Additional targets could be comma-separated (`ARGS:user,ARGS:pw`).
   Though it's easier to just  invoke the dialog repeatedly or use any
   editor (F4) afterwards.
 * The **Transforms** are applied to those input fields before any `@rx`
   condition is tested.


## Actions/Flags

You can have one of the disruptive actions enabled (allow/pass or deny,
drop, block, or pause). Whereas logging options are freely combinable.

 * The "pause" option can be set under Params, but is actually a flag
   (perhaps best comined with "block", or rarely "pass").
 * "chain" and "skip" are options that cannot/should not be overridden,
   hence greyed out.
 * The "status" option takes effect when the action is "deny".


## Actions/Params

Parameterized options are presented with an input field or dropdown here.
Though you probably don't want to change rule message or logdata.

 * "redirect" is another disruptive option (best combined with "block").
 * But disabling "ctl:ruleEngine" can sometimes be useful, if you have
   a custom rule that should exempt all other rules from running.
 * "phase" is another option which can't really be changed.


## Actions/Control

Some additional flags are presented below the fold. Along with the lesser
used options from some rules.

 * Meta attributes like "ver" and "severity" are not very useful here.
 * But changing the "ctl:auditEngine" or its logParts could be useful
   for debugging individual rules.