Sandbox is wrong about in which PL a payload would be detected.

Describe the bug

More a minor / cosmetic problem.

Sending a request against the sandbox with

#!/usr/bin/env python3

import json
import requests

URL = "https://sandbox.coreruleset.org/"

message = {}

headers = {
    "X-Backend": "nginx",
    "X-CRS-Paranoia-Level": "2",
    "X-Format-Output": "txt-matched-rules-extended",
}
response = requests.get(URL, headers=headers)
print(response.text)

results in

This payload has been tested against the OWASP ModSecurity Core Rule Set 
web application firewall. The test was executed using the nginx engine and CRS version 3.3.2.

The payload is being detected by triggering the following rules:

913101 PL2 Found User-Agent associated with scripting/generic HTTP client
949110 PL1 Inbound Anomaly Score Exceeded (Total Score: 5)

CRS therefore detects this payload starting with paranoia level 1.

I think the last sentence is wrong.

While there is a PL1 rule in the log, it is only the anomaly score rule. The rule which detects the payload is only in paranoia level 2. So in PL1, the payload would not be detected.

[mirkodziadzka-avi]

@fzipi Seems to work fine and as expected. Thank You.

[fzipi]

Thanks for filing this! Closing now.