You may ask if there isn't a way to match a string that ends with a certain other sub-string, without having to bother with escaping dots and putting dollar signs at the ends of lines. There is actually an operator that does just that—it's called @endsWith. This operator returns true if the targeted value ends with the specified string. If, as in the example above, we wanted to block remote hosts from microsoft.com, we could do it by using @endsWith in the following manner:
SecRule REMOTE_HOST "@endsWith .microsoft.com" deny
If we wanted to negate the above rule, and instead block any domain that is not from Microsoft, we could have done it in the following way:
SecRule REMOTE_HOST "!@endsWith .microsoft.com" deny
It is good practice to use simple string matching whenever you don't need to utilize the power of regular expressions, as it is very much easier to get a regular expression wrong than it is to get unexpected results with simple string matching.
The following...
