I was playing about with PHPBB 3 and it triggers a mod security rule, the Ossec Hids notification reports rule ID 400018, so I added this to the asl-exclude.conf

<LocationMatch /var/www/vhosts/domain.co.uk/httpdocs/forum>
SecRuleRemoveById 400018
</LocationMatch>

This covers the directory that PHPBB is installed in but does NOT seem to stop the rule being triggered, so I have to do this instead which isn't ideal:

# PHPBB Posts with URLs
SecRuleRemoveById 400018

Is something wrong with the how I wrote the first rule ??

Thanks .........

actually if you could paste the message from the ASL gui into a message to support@atomicorp.com that would be great.