<?php

/**
 * Stub que simula la salida del comando 'grep IP /var/log/nginx/modsec_audit.log' en DirectAdmin
 *
 * Este stub muestra:
 * 1. Intentos de acceso bloqueados por ModSecurity en nginx (DirectAdmin)
 * 2. Datos REALES de producción con mensajes y ruleId
 * 3. Formato JSON línea por línea
 *
 * Comando simulado: grep IP /var/log/nginx/modsec_audit.log
 * ESTRUCTURA DEFINITIVA: transaction.time_stamp, messages[].message, messages[].details.ruleId, transaction.request.uri
 */

return [
    'mod_security_da' => <<<'EOD'
{"transaction":{"client_ip":"216.244.66.195","time_stamp":"Thu Jun 26 05:31:50 2025","server_id":"907e4c82bfb7c5fa69f85324886a48ac03f5689a","client_port":41712,"host_ip":"5.135.93.67","host_port":443,"unique_id":"175091591055.351922","request":{"method":"GET","http_version":1.1,"uri":"/robots.txt","body":"","headers":{"Host":"www.amusicalbeniajan.org","Accept":"*/*","User-agent":"Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)","Accept-Charset":"utf-8;q=0.7,iso-8859-1;q=0.2,*;q=0.1"}},"response":{"http_code":406,"headers":{"Server":"nginx","Date":"Thu, 26 Jun 2025 05:31:50 GMT","Content-Length":"156","Content-Type":"text/html","Connection":"keep-alive"}},"producer":{"modsecurity":"ModSecurity v3.0.14 (Linux)","connector":"ModSecurity-nginx v1.0.3","secrules_engine":"Enabled","components":["OWASP_CRS/4.13.0\""]},"messages":[{"message":"Custom WAF Rules: WEB CRAWLER/BAD BOT","details":{"match":"Matched \"Operator `PmFromFile' with parameter `bad_bot_list.txt' against variable `REQUEST_HEADERS:User-agent' (Value: `Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)' )","reference":"o25,6v80,88t:lowercase","ruleId":"1100000","file":"/etc/modsecurity.d/00_bad_bots.conf","lineNumber":"2","data":"","severity":"2","ver":"","rev":"","tags":[],"maturity":"0","accuracy":"0"}}]}}
{"transaction":{"client_ip":"216.244.66.195","time_stamp":"Thu Jun 26 05:38:20 2025","server_id":"907e4c82bfb7c5fa69f85324886a48ac03f5689a","client_port":41713,"host_ip":"5.135.93.67","host_port":443,"unique_id":"175091592000.351923","request":{"method":"GET","http_version":1.1,"uri":"/?option=com_content&view=section&id=6&layout=blog&Itemid=1&limitstart=81","body":"","headers":{"Host":"www.amusicalbeniajan.org","Accept":"*/*","User-agent":"Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)","Accept-Charset":"utf-8;q=0.7,iso-8859-1;q=0.2,*;q=0.1"}},"response":{"http_code":406,"headers":{"Server":"nginx","Date":"Thu, 26 Jun 2025 05:38:20 GMT","Content-Length":"156","Content-Type":"text/html","Connection":"keep-alive"}},"producer":{"modsecurity":"ModSecurity v3.0.14 (Linux)","connector":"ModSecurity-nginx v1.0.3","secrules_engine":"Enabled","components":["OWASP_CRS/4.13.0\""]},"messages":[{"message":"Custom WAF Rules: WEB CRAWLER/BAD BOT","details":{"match":"Matched \"Operator `PmFromFile' with parameter `bad_bot_list.txt' against variable `REQUEST_HEADERS:User-agent' (Value: `Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)' )","reference":"o25,6v80,88t:lowercase","ruleId":"1100000","file":"/etc/modsecurity.d/00_bad_bots.conf","lineNumber":"2","data":"","severity":"2","ver":"","rev":"","tags":[],"maturity":"0","accuracy":"0"}}]}}
{"transaction":{"client_ip":"216.244.66.195","time_stamp":"Thu Jun 26 05:38:42 2025","server_id":"907e4c82bfb7c5fa69f85324886a48ac03f5689a","client_port":41714,"host_ip":"5.135.93.67","host_port":443,"unique_id":"175091592220.351924","request":{"method":"GET","http_version":1.1,"uri":"/category/novedades/escuela-novedades/?option=com_wgpicasa&view=wgpicasa&Itemid=38","body":"","headers":{"Host":"www.amusicalbeniajan.org","Accept":"*/*","User-agent":"Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)","Accept-Charset":"utf-8;q=0.7,iso-8859-1;q=0.2,*;q=0.1"}},"response":{"http_code":406,"headers":{"Server":"nginx","Date":"Thu, 26 Jun 2025 05:38:42 GMT","Content-Length":"156","Content-Type":"text/html","Connection":"keep-alive"}},"producer":{"modsecurity":"ModSecurity v3.0.14 (Linux)","connector":"ModSecurity-nginx v1.0.3","secrules_engine":"Enabled","components":["OWASP_CRS/4.13.0\""]},"messages":[{"message":"Custom WAF Rules: WEB CRAWLER/BAD BOT","details":{"match":"Matched \"Operator `PmFromFile' with parameter `bad_bot_list.txt' against variable `REQUEST_HEADERS:User-agent' (Value: `Mozilla/5.0 (compatible; DotBot/1.2; +https://opensiteexplorer.org/dotbot; help@moz.com)' )","reference":"o25,6v80,88t:lowercase","ruleId":"1100000","file":"/etc/modsecurity.d/00_bad_bots.conf","lineNumber":"2","data":"","severity":"2","ver":"","rev":"","tags":[],"maturity":"0","accuracy":"0"}}]}}
EOD,
];
