New metric "Matched Rules"

[matheusmattioli]

Hello!

In the README we have some metrics with the prefix waf_filter, but it stores only the rules that interrupted a transaction and the total interruptions captured, it is very useful, however, when we are tailoring/troubleshooting our internal configuration of Coraza, it's important to know all the rules triggered and analyzed by the WAF in a specific transaction. Because, in case of false positives, we could understand better what causes the blocking through analysis of the rules triggered. And, with the export of a metric to Prometheus, we also could identify all the matched rules through panels in dashboards like Grafana instead of logs.

I already wrote code to implement this new metric and tested it, could i submit a Pull Request?

[fzipi]

Of course you can!

[jcchavezs]

Hi @matheusmattioli thanks for coming by and apologies for not coming back to you before. I wonder if we truly need such metrics for troubleshooting. Audit logs will provide you such data so I am not sure about we truly needing to export it as metrics. As for the FP concern we willing to monitor the metrics on matched rules that can make sense but segregating them by transaction ID sounds like we can get that from audit logs (WIP in #263). WDYT?