mirror of
https://github.com/openappsec/openappsec.git
synced 2025-11-18 10:10:36 +03:00
Compare commits
5 Commits
watchdog
...
prometheus
| Author | SHA1 | Date | |
|---|---|---|---|
|
a9e186b824 | ||
|
|
b2fbb5ae8a | ||
|
|
c71b361755 | ||
|
|
7c2fcbddcf | ||
|
|
9e85e5703c |
@@ -177,7 +177,7 @@ open-appsec code was audited by an independent third party in September-October
|
|||||||
See the [full report](https://github.com/openappsec/openappsec/blob/main/LEXFO-CHP20221014-Report-Code_audit-OPEN-APPSEC-v1.2.pdf).
|
See the [full report](https://github.com/openappsec/openappsec/blob/main/LEXFO-CHP20221014-Report-Code_audit-OPEN-APPSEC-v1.2.pdf).
|
||||||
|
|
||||||
### Reporting security vulnerabilities
|
### Reporting security vulnerabilities
|
||||||
If you've found a vulnerability or a potential vulnerability in open-appsec please let us know at security-alert@openappsec.io. We'll send a confirmation email to acknowledge your report within 24 hours, and we'll send an additional email when we've identified the issue positively or negatively.
|
If you've found a vulnerability or a potential vulnerability in open-appsec please let us know at securityalert@openappsec.io. We'll send a confirmation email to acknowledge your report within 24 hours, and we'll send an additional email when we've identified the issue positively or negatively.
|
||||||
|
|
||||||
|
|
||||||
# License
|
# License
|
||||||
|
|||||||
@@ -6,6 +6,7 @@ HTTP_TRANSACTION_HANDLER_SERVICE="install-cp-nano-service-http-transaction-handl
|
|||||||
ATTACHMENT_REGISTRATION_SERVICE="install-cp-nano-attachment-registration-manager.sh"
|
ATTACHMENT_REGISTRATION_SERVICE="install-cp-nano-attachment-registration-manager.sh"
|
||||||
ORCHESTRATION_INSTALLATION_SCRIPT="install-cp-nano-agent.sh"
|
ORCHESTRATION_INSTALLATION_SCRIPT="install-cp-nano-agent.sh"
|
||||||
CACHE_INSTALLATION_SCRIPT="install-cp-nano-agent-cache.sh"
|
CACHE_INSTALLATION_SCRIPT="install-cp-nano-agent-cache.sh"
|
||||||
|
PROMETHEUS_INSTALLATION_SCRIPT="install-cp-nano-service-prometheus.sh"
|
||||||
|
|
||||||
var_fog_address=
|
var_fog_address=
|
||||||
var_proxy=
|
var_proxy=
|
||||||
@@ -81,6 +82,10 @@ fi
|
|||||||
/nano-service-installers/$CACHE_INSTALLATION_SCRIPT --install
|
/nano-service-installers/$CACHE_INSTALLATION_SCRIPT --install
|
||||||
/nano-service-installers/$HTTP_TRANSACTION_HANDLER_SERVICE --install
|
/nano-service-installers/$HTTP_TRANSACTION_HANDLER_SERVICE --install
|
||||||
|
|
||||||
|
if [ "$PROMETHEUS" == "true" ]; then
|
||||||
|
/nano-service-installers/$PROMETHEUS_INSTALLATION_SCRIPT --install
|
||||||
|
fi
|
||||||
|
|
||||||
if [ "$CROWDSEC_ENABLED" == "true" ]; then
|
if [ "$CROWDSEC_ENABLED" == "true" ]; then
|
||||||
/nano-service-installers/$INTELLIGENCE_INSTALLATION_SCRIPT --install
|
/nano-service-installers/$INTELLIGENCE_INSTALLATION_SCRIPT --install
|
||||||
/nano-service-installers/$CROWDSEC_INSTALLATION_SCRIPT --install
|
/nano-service-installers/$CROWDSEC_INSTALLATION_SCRIPT --install
|
||||||
@@ -93,16 +98,25 @@ if [ -f "$FILE" ]; then
|
|||||||
fi
|
fi
|
||||||
|
|
||||||
touch /etc/cp/watchdog/wd.startup
|
touch /etc/cp/watchdog/wd.startup
|
||||||
/etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
|
|
||||||
active_watchdog_pid=$!
|
|
||||||
while true; do
|
while true; do
|
||||||
if [ -f /tmp/restart_watchdog ]; then
|
if [ -z "$init" ]; then
|
||||||
rm -f /tmp/restart_watchdog
|
init=true
|
||||||
kill -9 ${active_watchdog_pid}
|
|
||||||
fi
|
|
||||||
if [ ! "$(ps -f | grep cp-nano-watchdog | grep ${active_watchdog_pid})" ]; then
|
|
||||||
/etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
|
/etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
|
||||||
active_watchdog_pid=$!
|
sleep 5
|
||||||
|
active_watchdog_pid=$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")
|
||||||
fi
|
fi
|
||||||
|
|
||||||
|
current_watchdog_pid=$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")
|
||||||
|
if [ ! -f /tmp/restart_watchdog ] && [ "$current_watchdog_pid" != "$active_watchdog_pid" ]; then
|
||||||
|
echo "Error: Watchdog exited abnormally"
|
||||||
|
exit 1
|
||||||
|
elif [ -f /tmp/restart_watchdog ]; then
|
||||||
|
rm -f /tmp/restart_watchdog
|
||||||
|
kill -9 "$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")"
|
||||||
|
/etc/cp/watchdog/cp-nano-watchdog >/dev/null 2>&1 &
|
||||||
|
sleep 5
|
||||||
|
active_watchdog_pid=$(pgrep -f -x -o "/bin/(bash|sh) /etc/cp/watchdog/cp-nano-watchdog")
|
||||||
|
fi
|
||||||
|
|
||||||
sleep 5
|
sleep 5
|
||||||
done
|
done
|
||||||
|
|||||||
30
components/include/prometheus_comp.h
Executable file
30
components/include/prometheus_comp.h
Executable file
@@ -0,0 +1,30 @@
|
|||||||
|
#ifndef __PROMETHEUS_COMP_H__
|
||||||
|
#define __PROMETHEUS_COMP_H__
|
||||||
|
|
||||||
|
#include <memory>
|
||||||
|
|
||||||
|
#include "component.h"
|
||||||
|
#include "singleton.h"
|
||||||
|
|
||||||
|
#include "i_rest_api.h"
|
||||||
|
#include "i_messaging.h"
|
||||||
|
#include "generic_metric.h"
|
||||||
|
|
||||||
|
class PrometheusComp
|
||||||
|
:
|
||||||
|
public Component,
|
||||||
|
Singleton::Consume<I_RestApi>,
|
||||||
|
Singleton::Consume<I_Messaging>
|
||||||
|
{
|
||||||
|
public:
|
||||||
|
PrometheusComp();
|
||||||
|
~PrometheusComp();
|
||||||
|
|
||||||
|
void init() override;
|
||||||
|
|
||||||
|
private:
|
||||||
|
class Impl;
|
||||||
|
std::unique_ptr<Impl> pimpl;
|
||||||
|
};
|
||||||
|
|
||||||
|
#endif // __PROMETHEUS_COMP_H__
|
||||||
@@ -3,6 +3,7 @@ add_subdirectory(ips)
|
|||||||
add_subdirectory(layer_7_access_control)
|
add_subdirectory(layer_7_access_control)
|
||||||
add_subdirectory(local_policy_mgmt_gen)
|
add_subdirectory(local_policy_mgmt_gen)
|
||||||
add_subdirectory(orchestration)
|
add_subdirectory(orchestration)
|
||||||
|
add_subdirectory(prometheus)
|
||||||
add_subdirectory(rate_limit)
|
add_subdirectory(rate_limit)
|
||||||
add_subdirectory(waap)
|
add_subdirectory(waap)
|
||||||
add_subdirectory(central_nginx_manager)
|
add_subdirectory(central_nginx_manager)
|
||||||
|
|||||||
2
components/security_apps/prometheus/CMakeLists.txt
Executable file
2
components/security_apps/prometheus/CMakeLists.txt
Executable file
@@ -0,0 +1,2 @@
|
|||||||
|
add_library(prometheus_comp prometheus_comp.cc)
|
||||||
|
add_subdirectory(prometheus_ut)
|
||||||
200
components/security_apps/prometheus/prometheus_comp.cc
Executable file
200
components/security_apps/prometheus/prometheus_comp.cc
Executable file
@@ -0,0 +1,200 @@
|
|||||||
|
#include "prometheus_comp.h"
|
||||||
|
|
||||||
|
#include <string>
|
||||||
|
#include <map>
|
||||||
|
#include <vector>
|
||||||
|
#include <cereal/archives/json.hpp>
|
||||||
|
#include <cereal/types/map.hpp>
|
||||||
|
#include <cereal/types/vector.hpp>
|
||||||
|
#include <cereal/types/string.hpp>
|
||||||
|
#include <iostream>
|
||||||
|
#include <fstream>
|
||||||
|
|
||||||
|
#include "common.h"
|
||||||
|
#include "report/base_field.h"
|
||||||
|
#include "report/report_enums.h"
|
||||||
|
#include "log_generator.h"
|
||||||
|
#include "debug.h"
|
||||||
|
#include "rest.h"
|
||||||
|
#include "customized_cereal_map.h"
|
||||||
|
#include "i_messaging.h"
|
||||||
|
#include "prometheus_metric_names.h"
|
||||||
|
|
||||||
|
USE_DEBUG_FLAG(D_PROMETHEUS);
|
||||||
|
|
||||||
|
using namespace std;
|
||||||
|
using namespace ReportIS;
|
||||||
|
|
||||||
|
struct ServiceData
|
||||||
|
{
|
||||||
|
template <typename Archive>
|
||||||
|
void
|
||||||
|
serialize(Archive &ar)
|
||||||
|
{
|
||||||
|
ar(cereal::make_nvp("Service port", service_port));
|
||||||
|
}
|
||||||
|
|
||||||
|
int service_port;
|
||||||
|
};
|
||||||
|
|
||||||
|
class PrometheusMetricData
|
||||||
|
{
|
||||||
|
public:
|
||||||
|
PrometheusMetricData(const string &n, const string &t, const string &d) : name(n), type(t), description(d) {}
|
||||||
|
|
||||||
|
void
|
||||||
|
addElement(const string &labels, const string &value)
|
||||||
|
{
|
||||||
|
metric_labels_to_values[labels] = value;
|
||||||
|
}
|
||||||
|
|
||||||
|
ostream &
|
||||||
|
print(ostream &os)
|
||||||
|
{
|
||||||
|
if (metric_labels_to_values.empty()) return os;
|
||||||
|
|
||||||
|
string representative_name = "";
|
||||||
|
if (!name.empty()) {
|
||||||
|
auto metric_name = convertMetricName(name);
|
||||||
|
!metric_name.empty() ? representative_name = metric_name : representative_name = name;
|
||||||
|
}
|
||||||
|
|
||||||
|
if (!description.empty()) os << "# HELP " << representative_name << ' ' << description << '\n';
|
||||||
|
if (!name.empty()) os << "# TYPE " << representative_name << ' ' << type << '\n';
|
||||||
|
for (auto &entry : metric_labels_to_values) {
|
||||||
|
os << representative_name << entry.first << ' ' << entry.second << '\n';
|
||||||
|
}
|
||||||
|
os << '\n';
|
||||||
|
metric_labels_to_values.clear();
|
||||||
|
|
||||||
|
return os;
|
||||||
|
}
|
||||||
|
|
||||||
|
private:
|
||||||
|
|
||||||
|
string name;
|
||||||
|
string type;
|
||||||
|
string description;
|
||||||
|
map<string, string> metric_labels_to_values;
|
||||||
|
};
|
||||||
|
|
||||||
|
static ostream & operator<<(ostream &os, PrometheusMetricData &metric) { return metric.print(os); }
|
||||||
|
|
||||||
|
class PrometheusComp::Impl
|
||||||
|
{
|
||||||
|
public:
|
||||||
|
void
|
||||||
|
init()
|
||||||
|
{
|
||||||
|
Singleton::Consume<I_RestApi>::by<PrometheusComp>()->addGetCall(
|
||||||
|
"metrics",
|
||||||
|
[&] () { return getFormatedPrometheusMetrics(); }
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
void
|
||||||
|
addMetrics(const vector<PrometheusData> &metrics)
|
||||||
|
{
|
||||||
|
for(auto &metric : metrics) {
|
||||||
|
auto &metric_object = getDataObject(
|
||||||
|
metric.name,
|
||||||
|
metric.type,
|
||||||
|
metric.description
|
||||||
|
);
|
||||||
|
metric_object.addElement(metric.label, metric.value);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private:
|
||||||
|
PrometheusMetricData &
|
||||||
|
getDataObject(const string &name, const string &type, const string &description)
|
||||||
|
{
|
||||||
|
auto elem = prometheus_metrics.find(name);
|
||||||
|
if (elem == prometheus_metrics.end()) {
|
||||||
|
elem = prometheus_metrics.emplace(name, PrometheusMetricData(name, type, description)).first;
|
||||||
|
}
|
||||||
|
|
||||||
|
return elem->second;
|
||||||
|
}
|
||||||
|
|
||||||
|
map<string, ServiceData>
|
||||||
|
getServiceDetails()
|
||||||
|
{
|
||||||
|
map<string, ServiceData> registeredServices;
|
||||||
|
auto registered_services_file = getConfigurationWithDefault<string>(
|
||||||
|
getFilesystemPathConfig() + "/conf/orchestrations_registered_services.json",
|
||||||
|
"orchestration",
|
||||||
|
"Orchestration registered services"
|
||||||
|
);
|
||||||
|
ifstream file(registered_services_file);
|
||||||
|
if (!file.is_open()) {
|
||||||
|
dbgWarning(D_PROMETHEUS) << "Failed to open file: " << registered_services_file;
|
||||||
|
return registeredServices;
|
||||||
|
}
|
||||||
|
stringstream buffer;
|
||||||
|
buffer << file.rdbuf();
|
||||||
|
try {
|
||||||
|
cereal::JSONInputArchive archive(buffer);
|
||||||
|
archive(cereal::make_nvp("Registered Services", registeredServices));
|
||||||
|
} catch (const exception& e) {
|
||||||
|
dbgWarning(D_PROMETHEUS) << "Error parsing Registered Services JSON file: " << e.what();
|
||||||
|
}
|
||||||
|
|
||||||
|
return registeredServices;
|
||||||
|
}
|
||||||
|
|
||||||
|
void
|
||||||
|
getServicesMetrics()
|
||||||
|
{
|
||||||
|
dbgTrace(D_PROMETHEUS) << "Get all registered services metrics";
|
||||||
|
map<string, ServiceData> service_names_to_ports = getServiceDetails();
|
||||||
|
for (const auto &service : service_names_to_ports) {
|
||||||
|
I_Messaging *messaging = Singleton::Consume<I_Messaging>::by<PrometheusComp>();
|
||||||
|
MessageMetadata servie_metric_req_md("127.0.0.1", service.second.service_port);
|
||||||
|
servie_metric_req_md.setConnectioFlag(MessageConnectionConfig::ONE_TIME_CONN);
|
||||||
|
servie_metric_req_md.setConnectioFlag(MessageConnectionConfig::UNSECURE_CONN);
|
||||||
|
auto res = messaging->sendSyncMessage(
|
||||||
|
HTTPMethod::GET,
|
||||||
|
"/service-metrics",
|
||||||
|
string(""),
|
||||||
|
MessageCategory::GENERIC,
|
||||||
|
servie_metric_req_md
|
||||||
|
);
|
||||||
|
if (!res.ok()) {
|
||||||
|
dbgWarning(D_PROMETHEUS) << "Failed to get service metrics. Service: " << service.first;
|
||||||
|
continue;
|
||||||
|
}
|
||||||
|
stringstream buffer;
|
||||||
|
buffer << res.unpack().getBody();
|
||||||
|
cereal::JSONInputArchive archive(buffer);
|
||||||
|
vector<PrometheusData> metrics;
|
||||||
|
archive(cereal::make_nvp("metrics", metrics));
|
||||||
|
addMetrics(metrics);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
string
|
||||||
|
getFormatedPrometheusMetrics()
|
||||||
|
{
|
||||||
|
MetricScrapeEvent().notify();
|
||||||
|
getServicesMetrics();
|
||||||
|
stringstream result;
|
||||||
|
for (auto &metric : prometheus_metrics) {
|
||||||
|
result << metric.second;
|
||||||
|
}
|
||||||
|
dbgTrace(D_PROMETHEUS) << "Prometheus metrics: " << result.str();
|
||||||
|
return result.str();
|
||||||
|
}
|
||||||
|
|
||||||
|
map<string, PrometheusMetricData> prometheus_metrics;
|
||||||
|
};
|
||||||
|
|
||||||
|
PrometheusComp::PrometheusComp() : Component("Prometheus"), pimpl(make_unique<Impl>()) {}
|
||||||
|
|
||||||
|
PrometheusComp::~PrometheusComp() {}
|
||||||
|
|
||||||
|
void
|
||||||
|
PrometheusComp::init()
|
||||||
|
{
|
||||||
|
pimpl->init();
|
||||||
|
}
|
||||||
143
components/security_apps/prometheus/prometheus_metric_names.h
Executable file
143
components/security_apps/prometheus/prometheus_metric_names.h
Executable file
@@ -0,0 +1,143 @@
|
|||||||
|
#ifndef __PROMETHEUS_METRIC_NAMES_H__
|
||||||
|
#define __PROMETHEUS_METRIC_NAMES_H__
|
||||||
|
|
||||||
|
#include <string>
|
||||||
|
#include <unordered_map>
|
||||||
|
|
||||||
|
#include "debug.h"
|
||||||
|
|
||||||
|
USE_DEBUG_FLAG(D_PROMETHEUS);
|
||||||
|
|
||||||
|
std::string
|
||||||
|
convertMetricName(const std::string &original_metric_name)
|
||||||
|
{
|
||||||
|
static const std::unordered_map<std::string, std::string> original_to_representative_names = {
|
||||||
|
// HybridModeMetric
|
||||||
|
{"watchdogProcessStartupEventsSum", "nano_service_restarts_counter"},
|
||||||
|
// nginxAttachmentMetric
|
||||||
|
{"inspectVerdictSum", "traffic_inspection_verdict_inspect_counter"},
|
||||||
|
{"acceptVeridctSum", "traffic_inspection_verdict_accept_counter"},
|
||||||
|
{"dropVerdictSum", "traffic_inspection_verdict_drop_counter"},
|
||||||
|
{"injectVerdictSum", "traffic_inspection_verdict_inject_counter"},
|
||||||
|
{"irrelevantVerdictSum", "traffic_inspection_verdict_irrelevant_counter"},
|
||||||
|
{"irrelevantVerdictSum", "traffic_inspection_verdict_irrelevant_counter"},
|
||||||
|
{"reconfVerdictSum", "traffic_inspection_verdict_reconf_counter"},
|
||||||
|
{"responseInspection", "response_body_inspection_counter"},
|
||||||
|
// nginxIntakerMetric
|
||||||
|
{"successfullInspectionTransactionsSum", "successful_Inspection_counter"},
|
||||||
|
{"failopenTransactionsSum", "fail_open_Inspection_counter"},
|
||||||
|
{"failcloseTransactionsSum", "fail_close_Inspection_counter"},
|
||||||
|
{"transparentModeTransactionsSum", "transparent_mode_counter"},
|
||||||
|
{"totalTimeInTransparentModeSum", "total_time_in_transparent_mode_counter"},
|
||||||
|
{"reachInspectVerdictSum", "inspect_verdict_counter"},
|
||||||
|
{"reachAcceptVerdictSum", "accept_verdict_counter"},
|
||||||
|
{"reachDropVerdictSum", "drop_verdict_counter"},
|
||||||
|
{"reachInjectVerdictSum", "inject_verdict_counter"},
|
||||||
|
{"reachIrrelevantVerdictSum", "irrelevant_verdict_counter"},
|
||||||
|
{"reachReconfVerdictSum", "reconf_verdict_counter"},
|
||||||
|
{"requestCompressionFailureSum", "failed_requests_compression_counter"},
|
||||||
|
{"responseCompressionFailureSum", "failed_response_compression_counter"},
|
||||||
|
{"requestDecompressionFailureSum", "failed_requests_decompression_counter"},
|
||||||
|
{"responseDecompressionFailureSum", "failed_response_decompression_counter"},
|
||||||
|
{"requestCompressionSuccessSum", "successful_request_compression_counter"},
|
||||||
|
{"responseCompressionSuccessSum", "successful_response_compression_counter"},
|
||||||
|
{"requestDecompressionSuccessSum", "successful_request_decompression_counter"},
|
||||||
|
{"responseDecompressionSuccessSum", "successful_response_decompression_counter"},
|
||||||
|
{"skippedSessionsUponCorruptedZipSum", "corrupted_zip_skipped_session_counter"},
|
||||||
|
{"attachmentThreadReachedTimeoutSum", "thread_exceeded_processing_time_counter"},
|
||||||
|
{"registrationThreadReachedTimeoutSum", "failed_registration_thread_counter"},
|
||||||
|
{"requestHeaderThreadReachedTimeoutSum", "request_headers_processing_thread_timeouts_counter"},
|
||||||
|
{"requestBodyThreadReachedTimeoutSum", "request_body_processing_thread_timeouts_counter"},
|
||||||
|
{"respondHeaderThreadReachedTimeoutSum", "response_headers_processing_thread_timeouts_counter"},
|
||||||
|
{"respondBodyThreadReachedTimeoutSum", "response_body_processing_thread_timeouts_counter"},
|
||||||
|
{"attachmentThreadFailureSum", "thread_failures_counter"},
|
||||||
|
{"httpRequestProcessingReachedTimeoutSum", "request_processing_timeouts_counter"},
|
||||||
|
{"httpRequestsSizeSum", "requests_total_size_counter"},
|
||||||
|
{"httpResponsesSizeSum", "response_total_size_counter"},
|
||||||
|
{"httpRequestFailedToReachWebServerUpstreamSum", "requests_failed_reach_upstram_counter"},
|
||||||
|
{"overallSessionProcessTimeToVerdictAvgSample", "overall_processing_time_until_verdict_average"},
|
||||||
|
{"overallSessionProcessTimeToVerdictMaxSample", "overall_processing_time_until_verdict_max"},
|
||||||
|
{"overallSessionProcessTimeToVerdictMinSample", "overall_processing_time_until_verdict_min"},
|
||||||
|
{"requestProcessTimeToVerdictAvgSample", "requests_processing_time_until_verdict_average"},
|
||||||
|
{"requestProcessTimeToVerdictMaxSample", "requests_processing_time_until_verdict_max"},
|
||||||
|
{"requestProcessTimeToVerdictMinSample", "requests_processing_time_until_verdict_min"},
|
||||||
|
{"responseProcessTimeToVerdictAvgSample", "response_processing_time_until_verdict_average"},
|
||||||
|
{"responseProcessTimeToVerdictMaxSample", "response_processing_time_until_verdict_max"},
|
||||||
|
{"responseProcessTimeToVerdictMinSample", "response_processing_time_until_verdict_min"},
|
||||||
|
{"requestBodySizeUponTimeoutAvgSample", "request_body_size_average"},
|
||||||
|
{"requestBodySizeUponTimeoutMaxSample", "request_body_size_max"},
|
||||||
|
{"requestBodySizeUponTimeoutMinSample", "request_body_size_min"},
|
||||||
|
{"responseBodySizeUponTimeoutAvgSample", "response_body_size_average"},
|
||||||
|
{"responseBodySizeUponTimeoutMaxSample", "response_body_size_max"},
|
||||||
|
{"responseBodySizeUponTimeoutMinSample", "response_body_size_min"},
|
||||||
|
// WaapTelemetrics
|
||||||
|
{"reservedNgenA", "total_requests_counter"},
|
||||||
|
{"reservedNgenB", "unique_sources_counter"},
|
||||||
|
{"reservedNgenC", "requests_blocked_by_force_and_exception_counter"},
|
||||||
|
{"reservedNgenD", "requests_blocked_by_waf_counter"},
|
||||||
|
{"reservedNgenE", "requests_blocked_by_open_api_counter"},
|
||||||
|
{"reservedNgenF", "requests_blocked_by_bot_protection_counter"},
|
||||||
|
{"reservedNgenG", "requests_threat_level_info_and_no_threat_counter"},
|
||||||
|
{"reservedNgenH", "requests_threat_level_low_counter"},
|
||||||
|
{"reservedNgenI", "requests_threat_level_medium_counter"},
|
||||||
|
{"reservedNgenJ", "requests_threat_level_high_counter"},
|
||||||
|
// WaapTrafficTelemetrics
|
||||||
|
{"reservedNgenA", "post_requests_counter"},
|
||||||
|
{"reservedNgenB", "get_requests_counter"},
|
||||||
|
{"reservedNgenC", "put_requests_counter"},
|
||||||
|
{"reservedNgenD", "patch_requests_counter"},
|
||||||
|
{"reservedNgenE", "delete_requests_counter"},
|
||||||
|
{"reservedNgenF", "other_requests_counter"},
|
||||||
|
{"reservedNgenG", "2xx_status_code_responses_counter"},
|
||||||
|
{"reservedNgenH", "4xx_status_code_responses_counter"},
|
||||||
|
{"reservedNgenI", "5xx_status_code_responses_counter"},
|
||||||
|
{"reservedNgenJ", "requests_time_latency_average"},
|
||||||
|
// WaapAttackTypesMetrics
|
||||||
|
{"reservedNgenA", "sql_injection_attacks_type_counter"},
|
||||||
|
{"reservedNgenB", "vulnerability_scanning_attacks_type_counter"},
|
||||||
|
{"reservedNgenC", "path_traversal_attacks_type_counter"},
|
||||||
|
{"reservedNgenD", "ldap_injection_attacks_type_counter"},
|
||||||
|
{"reservedNgenE", "evasion_techniques_attacks_type_counter"},
|
||||||
|
{"reservedNgenF", "remote_code_execution_attacks_type_counter"},
|
||||||
|
{"reservedNgenG", "xml_extern_entity_attacks_type_counter"},
|
||||||
|
{"reservedNgenH", "cross_site_scripting_attacks_type_counter"},
|
||||||
|
{"reservedNgenI", "general_attacks_type_counter"},
|
||||||
|
// AssetsMetric
|
||||||
|
{"numberOfProtectedApiAssetsSample", "api_assets_counter"},
|
||||||
|
{"numberOfProtectedWebAppAssetsSample", "web_api_assets_counter"},
|
||||||
|
{"numberOfProtectedAssetsSample", "all_assets_counter"},
|
||||||
|
// IPSMetric
|
||||||
|
{"preventEngineMatchesSample", "prevent_action_matches_counter"},
|
||||||
|
{"detectEngineMatchesSample", "detect_action_matches_counter"},
|
||||||
|
{"ignoreEngineMatchesSample", "ignore_action_matches_counter"},
|
||||||
|
// CPUMetric
|
||||||
|
{"cpuMaxSample", "cpu_usage_percentage_max"},
|
||||||
|
{"cpuAvgSample", "cpu_usage_percentage_average"},
|
||||||
|
{"cpuSample", "cpu_usage_percentage_last_value"},
|
||||||
|
// LogMetric
|
||||||
|
{"logQueueMaxSizeSample", "logs_queue_size_max"},
|
||||||
|
{"logQueueAvgSizeSample", "logs_queue_size_average"},
|
||||||
|
{"logQueueCurrentSizeSample", "logs_queue_size_last_value"},
|
||||||
|
{"sentLogsSum", "logs_sent_counter"},
|
||||||
|
{"sentLogsBulksSum", "bulk_logs_sent_counter"},
|
||||||
|
// MemoryMetric
|
||||||
|
{"serviceVirtualMemorySizeMaxSample", "service_virtual_memory_size_kb_max"},
|
||||||
|
{"serviceVirtualMemorySizeMinSample", "service_virtual_memory_size_kb_min"},
|
||||||
|
{"serviceVirtualMemorySizeAvgSample", "service_virtual_memory_size_kb_average"},
|
||||||
|
{"serviceRssMemorySizeMaxSample", "service_physical_memory_size_kb_max"},
|
||||||
|
{"serviceRssMemorySizeMinSample", "service_physical_memory_size_kb_min"},
|
||||||
|
{"serviceRssMemorySizeAvgSample", "service_physical_memory_size_kb_average"},
|
||||||
|
{"generalTotalMemorySizeMaxSample", "general_total_used_memory_max"},
|
||||||
|
{"generalTotalMemorySizeMinSample", "general_total_used_memory_min"},
|
||||||
|
{"generalTotalMemorySizeAvgSample", "general_total_used_memory_average"},
|
||||||
|
};
|
||||||
|
|
||||||
|
auto metric_names = original_to_representative_names.find(original_metric_name);
|
||||||
|
if (metric_names != original_to_representative_names.end()) return metric_names->second;
|
||||||
|
dbgDebug(D_PROMETHEUS)
|
||||||
|
<< "Metric don't have a representative name, originl name: "
|
||||||
|
<< original_metric_name;
|
||||||
|
return "";
|
||||||
|
}
|
||||||
|
|
||||||
|
#endif // __PROMETHEUS_METRIC_NAMES_H__
|
||||||
8
components/security_apps/prometheus/prometheus_ut/CMakeLists.txt
Executable file
8
components/security_apps/prometheus/prometheus_ut/CMakeLists.txt
Executable file
@@ -0,0 +1,8 @@
|
|||||||
|
link_directories(${BOOST_ROOT}/lib)
|
||||||
|
link_directories(${BOOST_ROOT}/lib ${CMAKE_BINARY_DIR}/core/shmem_ipc)
|
||||||
|
|
||||||
|
add_unit_test(
|
||||||
|
prometheus_ut
|
||||||
|
"prometheus_ut.cc"
|
||||||
|
"prometheus_comp;logging;agent_details;waap_clib;table;singleton;time_proxy;metric;event_is;connkey;http_transaction_data;generic_rulebase;generic_rulebase_evaluators;ip_utilities;intelligence_is_v2;-lboost_regex;messaging;"
|
||||||
|
)
|
||||||
79
components/security_apps/prometheus/prometheus_ut/prometheus_ut.cc
Executable file
79
components/security_apps/prometheus/prometheus_ut/prometheus_ut.cc
Executable file
@@ -0,0 +1,79 @@
|
|||||||
|
#include "prometheus_comp.h"
|
||||||
|
|
||||||
|
#include <sstream>
|
||||||
|
#include <fstream>
|
||||||
|
#include <vector>
|
||||||
|
|
||||||
|
#include "cmock.h"
|
||||||
|
#include "cptest.h"
|
||||||
|
#include "maybe_res.h"
|
||||||
|
#include "debug.h"
|
||||||
|
#include "config.h"
|
||||||
|
#include "environment.h"
|
||||||
|
#include "config_component.h"
|
||||||
|
#include "agent_details.h"
|
||||||
|
#include "time_proxy.h"
|
||||||
|
#include "mock/mock_mainloop.h"
|
||||||
|
#include "mock/mock_rest_api.h"
|
||||||
|
#include "mock/mock_messaging.h"
|
||||||
|
|
||||||
|
using namespace std;
|
||||||
|
using namespace testing;
|
||||||
|
|
||||||
|
USE_DEBUG_FLAG(D_PROMETHEUS);
|
||||||
|
|
||||||
|
class PrometheusCompTest : public Test
|
||||||
|
{
|
||||||
|
public:
|
||||||
|
PrometheusCompTest()
|
||||||
|
{
|
||||||
|
EXPECT_CALL(mock_rest, mockRestCall(_, "declare-boolean-variable", _)).WillOnce(Return(false));
|
||||||
|
env.preload();
|
||||||
|
config.preload();
|
||||||
|
env.init();
|
||||||
|
|
||||||
|
EXPECT_CALL(
|
||||||
|
mock_rest,
|
||||||
|
addGetCall("metrics", _)
|
||||||
|
).WillOnce(DoAll(SaveArg<1>(&get_metrics_func), Return(true)));
|
||||||
|
|
||||||
|
prometheus_comp.init();
|
||||||
|
}
|
||||||
|
|
||||||
|
::Environment env;
|
||||||
|
ConfigComponent config;
|
||||||
|
PrometheusComp prometheus_comp;
|
||||||
|
StrictMock<MockRestApi> mock_rest;
|
||||||
|
StrictMock<MockMainLoop> mock_ml;
|
||||||
|
NiceMock<MockMessaging> mock_messaging;
|
||||||
|
unique_ptr<ServerRest> agent_uninstall;
|
||||||
|
function<string()> get_metrics_func;
|
||||||
|
CPTestTempfile status_file;
|
||||||
|
string registered_services_file_path;
|
||||||
|
|
||||||
|
};
|
||||||
|
|
||||||
|
TEST_F(PrometheusCompTest, checkAddingMetric)
|
||||||
|
{
|
||||||
|
registered_services_file_path = cptestFnameInSrcDir(string("registered_services.json"));
|
||||||
|
setConfiguration(registered_services_file_path, "orchestration", "Orchestration registered services");
|
||||||
|
string metric_body = "{\n"
|
||||||
|
" \"metrics\": [\n"
|
||||||
|
" {\n"
|
||||||
|
" \"metric_name\": \"watchdogProcessStartupEventsSum\",\n"
|
||||||
|
" \"metric_type\": \"counter\",\n"
|
||||||
|
" \"metric_description\": \"\",\n"
|
||||||
|
" \"labels\": \"{method=\\\"post\\\",code=\\\"200\\\"}\",\n"
|
||||||
|
" \"value\": \"1534\"\n"
|
||||||
|
" }\n"
|
||||||
|
" ]\n"
|
||||||
|
"}";
|
||||||
|
|
||||||
|
string message_body;
|
||||||
|
EXPECT_CALL(mock_messaging, sendSyncMessage(_, "/service-metrics", _, _, _))
|
||||||
|
.Times(2).WillRepeatedly(Return(HTTPResponse(HTTPStatusCode::HTTP_OK, metric_body)));
|
||||||
|
|
||||||
|
string metric_str = "# TYPE nano_service_restarts_counter counter\n"
|
||||||
|
"nano_service_restarts_counter{method=\"post\",code=\"200\"} 1534\n\n";
|
||||||
|
EXPECT_EQ(metric_str, get_metrics_func());
|
||||||
|
}
|
||||||
32
components/security_apps/prometheus/prometheus_ut/registered_services.json
Executable file
32
components/security_apps/prometheus/prometheus_ut/registered_services.json
Executable file
@@ -0,0 +1,32 @@
|
|||||||
|
{
|
||||||
|
"Registered Services": {
|
||||||
|
"cp-nano-orchestration": {
|
||||||
|
"Service name": "cp-nano-orchestration",
|
||||||
|
"Service ID": "cp-nano-orchestration",
|
||||||
|
"Service port": 7777,
|
||||||
|
"Relevant configs": [
|
||||||
|
"zones",
|
||||||
|
"triggers",
|
||||||
|
"rules",
|
||||||
|
"registration-data",
|
||||||
|
"parameters",
|
||||||
|
"orchestration",
|
||||||
|
"exceptions",
|
||||||
|
"agent-intelligence"
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"cp-nano-prometheus": {
|
||||||
|
"Service name": "cp-nano-prometheus",
|
||||||
|
"Service ID": "cp-nano-prometheus",
|
||||||
|
"Service port": 7465,
|
||||||
|
"Relevant configs": [
|
||||||
|
"zones",
|
||||||
|
"triggers",
|
||||||
|
"rules",
|
||||||
|
"parameters",
|
||||||
|
"exceptions",
|
||||||
|
"agent-intelligence"
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@@ -41,7 +41,6 @@ static in6_addr applyMaskV6(const in6_addr& addr, uint8_t prefixLength) {
|
|||||||
in6_addr maskedAddr = addr;
|
in6_addr maskedAddr = addr;
|
||||||
int fullBytes = prefixLength / 8;
|
int fullBytes = prefixLength / 8;
|
||||||
int remainingBits = prefixLength % 8;
|
int remainingBits = prefixLength % 8;
|
||||||
uint8_t partialByte = maskedAddr.s6_addr[fullBytes];
|
|
||||||
|
|
||||||
// Mask full bytes
|
// Mask full bytes
|
||||||
for (int i = fullBytes; i < 16; ++i) {
|
for (int i = fullBytes; i < 16; ++i) {
|
||||||
@@ -51,7 +50,7 @@ static in6_addr applyMaskV6(const in6_addr& addr, uint8_t prefixLength) {
|
|||||||
// Mask remaining bits
|
// Mask remaining bits
|
||||||
if (remainingBits > 0) {
|
if (remainingBits > 0) {
|
||||||
uint8_t mask = ~((1 << (8 - remainingBits)) - 1);
|
uint8_t mask = ~((1 << (8 - remainingBits)) - 1);
|
||||||
maskedAddr.s6_addr[fullBytes] = partialByte & mask;
|
maskedAddr.s6_addr[fullBytes] &= mask;
|
||||||
}
|
}
|
||||||
|
|
||||||
return maskedAddr;
|
return maskedAddr;
|
||||||
|
|||||||
@@ -1093,9 +1093,12 @@ void Waf2Transaction::add_request_hdr(const char* name, int name_len, const char
|
|||||||
void Waf2Transaction::end_request_hdrs() {
|
void Waf2Transaction::end_request_hdrs() {
|
||||||
dbgFlow(D_WAAP) << "[transaction:" << this << "] end_request_hdrs";
|
dbgFlow(D_WAAP) << "[transaction:" << this << "] end_request_hdrs";
|
||||||
m_isScanningRequired = setCurrentAssetContext();
|
m_isScanningRequired = setCurrentAssetContext();
|
||||||
|
if (m_siteConfig != NULL)
|
||||||
extractEnvSourceIdentifier();
|
{
|
||||||
|
// getOverrideState also extracts the source identifier and populates m_source_identifier
|
||||||
|
// but the State itself is not needed now
|
||||||
|
Waap::Override::State overrideState = getOverrideState(m_siteConfig);
|
||||||
|
}
|
||||||
m_pWaapAssetState->m_requestsMonitor->logSourceHit(m_source_identifier);
|
m_pWaapAssetState->m_requestsMonitor->logSourceHit(m_source_identifier);
|
||||||
IdentifiersEvent ids(m_source_identifier, m_pWaapAssetState->m_assetId);
|
IdentifiersEvent ids(m_source_identifier, m_pWaapAssetState->m_assetId);
|
||||||
ids.notify();
|
ids.notify();
|
||||||
|
|||||||
@@ -594,6 +594,8 @@ Waap::Override::State Waf2Transaction::getOverrideState(IWaapConfig* sitePolicy)
|
|||||||
overrideState.applyOverride(*overridePolicy, WaapOverrideFunctor(*this), m_matchedOverrideIds, true);
|
overrideState.applyOverride(*overridePolicy, WaapOverrideFunctor(*this), m_matchedOverrideIds, true);
|
||||||
}
|
}
|
||||||
|
|
||||||
|
extractEnvSourceIdentifier();
|
||||||
|
|
||||||
if (overridePolicy) { // later we will run response overrides
|
if (overridePolicy) { // later we will run response overrides
|
||||||
m_overrideState.applyOverride(*overridePolicy, WaapOverrideFunctor(*this), m_matchedOverrideIds, false);
|
m_overrideState.applyOverride(*overridePolicy, WaapOverrideFunctor(*this), m_matchedOverrideIds, false);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -1,434 +0,0 @@
|
|||||||
ype: object
|
|
||||||
properties:
|
|
||||||
policies:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
default:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
custom-response:
|
|
||||||
type: string
|
|
||||||
exceptions:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
mode:
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
type: string
|
|
||||||
practices:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
source-identifiers:
|
|
||||||
type: string
|
|
||||||
triggers:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
trusted-sources:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- mode
|
|
||||||
- practices
|
|
||||||
- triggers
|
|
||||||
specific-rules:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
properties:
|
|
||||||
host:
|
|
||||||
type: string
|
|
||||||
custom-response:
|
|
||||||
type: string
|
|
||||||
exceptions:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
mode:
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
type: string
|
|
||||||
practices:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
source-identifiers:
|
|
||||||
type: string
|
|
||||||
triggers:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
trusted-sources:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- mode
|
|
||||||
- host
|
|
||||||
- practices
|
|
||||||
- triggers
|
|
||||||
type: object
|
|
||||||
practices:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
anti-bot:
|
|
||||||
properties:
|
|
||||||
injected-URIs:
|
|
||||||
items:
|
|
||||||
properties:
|
|
||||||
uri:
|
|
||||||
type: string
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
override-mode:
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- as-top-level
|
|
||||||
type: string
|
|
||||||
default: "inactive"
|
|
||||||
validated-URIs:
|
|
||||||
items:
|
|
||||||
properties:
|
|
||||||
uri:
|
|
||||||
type: string
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
type: object
|
|
||||||
openapi-schema-validation:
|
|
||||||
properties:
|
|
||||||
files:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
override-mode:
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- as-top-level
|
|
||||||
type: string
|
|
||||||
type: object
|
|
||||||
snort-signatures:
|
|
||||||
properties:
|
|
||||||
files:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
override-mode:
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- as-top-level
|
|
||||||
type: string
|
|
||||||
type: object
|
|
||||||
web-attacks:
|
|
||||||
properties:
|
|
||||||
max-body-size-kb:
|
|
||||||
type: integer
|
|
||||||
max-header-size-bytes:
|
|
||||||
type: integer
|
|
||||||
max-object-depth:
|
|
||||||
type: integer
|
|
||||||
max-url-size-bytes:
|
|
||||||
type: integer
|
|
||||||
minimum-confidence:
|
|
||||||
enum:
|
|
||||||
- medium
|
|
||||||
- high
|
|
||||||
- critical
|
|
||||||
type: string
|
|
||||||
override-mode:
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- as-top-level
|
|
||||||
type: string
|
|
||||||
protections:
|
|
||||||
properties:
|
|
||||||
csrf-enabled:
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
type: string
|
|
||||||
error-disclosure-enabled:
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
type: string
|
|
||||||
non-valid-http-methods:
|
|
||||||
type: boolean
|
|
||||||
open-redirect-enabled:
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
type: string
|
|
||||||
type: object
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- name
|
|
||||||
custom-responses:
|
|
||||||
type: array
|
|
||||||
minItems: 0
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
http-response-code:
|
|
||||||
maximum: 599
|
|
||||||
minimum: 100
|
|
||||||
default: 403
|
|
||||||
type: integer
|
|
||||||
message-body:
|
|
||||||
type: string
|
|
||||||
default: "Attack blocked by web application protection"
|
|
||||||
message-title:
|
|
||||||
type: string
|
|
||||||
default: "Openappsec's <b>Application Security</b> has detected an attack and blocked it."
|
|
||||||
mode:
|
|
||||||
enum:
|
|
||||||
- block-page
|
|
||||||
- response-code-only
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- name
|
|
||||||
log-triggers:
|
|
||||||
type: array
|
|
||||||
minItems: 0
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
access-control-logging:
|
|
||||||
properties:
|
|
||||||
allow-events:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
drop-events:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
type: object
|
|
||||||
additional-suspicious-events-logging:
|
|
||||||
properties:
|
|
||||||
enabled:
|
|
||||||
type: boolean
|
|
||||||
default true:
|
|
||||||
minimum-severity:
|
|
||||||
enum:
|
|
||||||
- high
|
|
||||||
- critical
|
|
||||||
type: string
|
|
||||||
default: "high"
|
|
||||||
response-body:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
response-code:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
type: object
|
|
||||||
appsec-logging:
|
|
||||||
properties:
|
|
||||||
all-web-requests:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
detect-events:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
prevent-events:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
type: object
|
|
||||||
extended-logging:
|
|
||||||
properties:
|
|
||||||
http-headers:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
request-body:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
url-path:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
url-query:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
type: object
|
|
||||||
log-destination:
|
|
||||||
properties:
|
|
||||||
cef-service:
|
|
||||||
minItems: 0
|
|
||||||
items:
|
|
||||||
properties:
|
|
||||||
address:
|
|
||||||
type: string
|
|
||||||
port:
|
|
||||||
type: integer
|
|
||||||
proto:
|
|
||||||
enum:
|
|
||||||
- tcp
|
|
||||||
- udp
|
|
||||||
type: string
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
cloud:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
stdout:
|
|
||||||
properties:
|
|
||||||
format:
|
|
||||||
enum:
|
|
||||||
- json
|
|
||||||
- json-formatted
|
|
||||||
type: string
|
|
||||||
default: json
|
|
||||||
type: object
|
|
||||||
syslog-service:
|
|
||||||
minItems: 0
|
|
||||||
items:
|
|
||||||
properties:
|
|
||||||
address:
|
|
||||||
type: string
|
|
||||||
port:
|
|
||||||
type: integer
|
|
||||||
type: object
|
|
||||||
type: array
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- name
|
|
||||||
exceptions:
|
|
||||||
type: array
|
|
||||||
minItems: 0
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
action:
|
|
||||||
enum:
|
|
||||||
- skip
|
|
||||||
- accept
|
|
||||||
- drop
|
|
||||||
- suppressLog
|
|
||||||
type: string
|
|
||||||
comment:
|
|
||||||
type: string
|
|
||||||
countryCode:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
countryName:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
hostName:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
paramName:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
paramValue:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
protectionName:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
sourceIdentifier:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
sourceIp:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
url:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
required:
|
|
||||||
- name
|
|
||||||
- action
|
|
||||||
trusted-sources:
|
|
||||||
type: array
|
|
||||||
minItems: 0
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
minNumOfSources:
|
|
||||||
type: integer
|
|
||||||
minimum: 1
|
|
||||||
default: 3
|
|
||||||
sources-identifiers:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
required:
|
|
||||||
- name
|
|
||||||
- sources-identifiers
|
|
||||||
source-identifiers:
|
|
||||||
type: array
|
|
||||||
minItems: 0
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
identifiers:
|
|
||||||
type: array
|
|
||||||
minItems: 1
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
source-identifier:
|
|
||||||
enum:
|
|
||||||
- headerkey
|
|
||||||
- JWTKey
|
|
||||||
- cookie
|
|
||||||
- sourceip
|
|
||||||
- x-forwarded-for
|
|
||||||
type: string
|
|
||||||
value:
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
type: array
|
|
||||||
required:
|
|
||||||
- source-identifier
|
|
||||||
required:
|
|
||||||
- name
|
|
||||||
- identifiers
|
|
||||||
additionalProperties: false
|
|
||||||
@@ -1,752 +0,0 @@
|
|||||||
type: object
|
|
||||||
properties:
|
|
||||||
apiVersion:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- v1beta1
|
|
||||||
- v1beta2
|
|
||||||
policies:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
appsecClassName:
|
|
||||||
type: string
|
|
||||||
default:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- mode
|
|
||||||
- threatPreventionPractices
|
|
||||||
- accessControlPractices
|
|
||||||
properties:
|
|
||||||
mode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
default: detect-learn
|
|
||||||
threatPreventionPractices:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
accessControlPractices:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
customResponse:
|
|
||||||
type: string
|
|
||||||
default: "403"
|
|
||||||
triggers:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
sourceIdentifiers:
|
|
||||||
type: string
|
|
||||||
trustedSources:
|
|
||||||
type: string
|
|
||||||
exceptions:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
specificRules:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
host:
|
|
||||||
type: string
|
|
||||||
mode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
default: detect-learn
|
|
||||||
threatPreventionPractices:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
accessControlPractices:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
triggers:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
customResponse:
|
|
||||||
type: string
|
|
||||||
sourceIdentifiers:
|
|
||||||
type: string
|
|
||||||
trustedSources:
|
|
||||||
type: string
|
|
||||||
exceptions:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
logTriggers:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- accessControlLogging
|
|
||||||
- appsecLogging
|
|
||||||
- additionalSuspiciousEventsLogging
|
|
||||||
- extendedLogging
|
|
||||||
- logDestination
|
|
||||||
properties:
|
|
||||||
appsecClassName:
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
accessControlLogging:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
allowEvents:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
dropEvents:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
appsecLogging:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
detectEvents:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
preventEvents:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
allWebRequests:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
additionalSuspiciousEventsLogging:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
enabled:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
minSeverity:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- high
|
|
||||||
- critical
|
|
||||||
default: high
|
|
||||||
responseBody:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
responseCode:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
extendedLogging:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
urlPath:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
urlQuery:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
httpHeaders:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
requestBody:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
logDestination:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
cloud:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
local-tuning:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
syslogService:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
address:
|
|
||||||
type: string
|
|
||||||
port:
|
|
||||||
type: integer
|
|
||||||
logToAgent:
|
|
||||||
type: boolean
|
|
||||||
default: true
|
|
||||||
stdout:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
format:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- json
|
|
||||||
- json-formatted
|
|
||||||
default: json
|
|
||||||
cefService:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
address:
|
|
||||||
type: string
|
|
||||||
port:
|
|
||||||
type: integer
|
|
||||||
proto:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- tcp
|
|
||||||
- udp
|
|
||||||
threatPreventionPractices:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- webAttacks
|
|
||||||
- intrusionPrevention
|
|
||||||
- fileSecurity
|
|
||||||
- snortSignatures
|
|
||||||
properties:
|
|
||||||
appsecClassName:
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
practiceMode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- inherited
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
default: inherited
|
|
||||||
webAttacks:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- overrideMode
|
|
||||||
properties:
|
|
||||||
overrideMode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inactive
|
|
||||||
minimumConfidence:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- medium
|
|
||||||
- high
|
|
||||||
- critical
|
|
||||||
default: high
|
|
||||||
maxUrlSizeBytes:
|
|
||||||
type: integer
|
|
||||||
default: 32768
|
|
||||||
maxObjectDepth:
|
|
||||||
type: integer
|
|
||||||
default: 40
|
|
||||||
maxBodySizeKb:
|
|
||||||
type: integer
|
|
||||||
default: 1000000
|
|
||||||
maxHeaderSizeBytes:
|
|
||||||
type: integer
|
|
||||||
default: 102400
|
|
||||||
protections:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
csrfProtection:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inactive
|
|
||||||
errorDisclosure:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inactive
|
|
||||||
openRedirect:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inactive
|
|
||||||
nonValidHttpMethods:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
antiBot:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- overrideMode
|
|
||||||
properties:
|
|
||||||
overrideMode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inactive
|
|
||||||
injectedUris:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
uri:
|
|
||||||
type: string
|
|
||||||
validatedUris:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
uri:
|
|
||||||
type: string
|
|
||||||
snortSignatures:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- overrideMode
|
|
||||||
properties:
|
|
||||||
overrideMode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inactive
|
|
||||||
configmap:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
files:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
schemaValidation:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- overrideMode
|
|
||||||
properties:
|
|
||||||
overrideMode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inactive
|
|
||||||
enforcementLevel:
|
|
||||||
type: string
|
|
||||||
configmap:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
files:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
intrusionPrevention:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- overrideMode
|
|
||||||
properties:
|
|
||||||
overrideMode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inactive
|
|
||||||
maxPerformanceImpact:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- low
|
|
||||||
- medium
|
|
||||||
- high
|
|
||||||
default: medium
|
|
||||||
minSeverityLevel:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- low
|
|
||||||
- medium
|
|
||||||
- high
|
|
||||||
- critical
|
|
||||||
default: medium
|
|
||||||
minCveYear:
|
|
||||||
type: integer
|
|
||||||
default: 2016
|
|
||||||
highConfidenceEventAction:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inherited
|
|
||||||
mediumConfidenceEventAction:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inherited
|
|
||||||
lowConfidenceEventAction:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: detect
|
|
||||||
fileSecurity:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- overrideMode
|
|
||||||
properties:
|
|
||||||
overrideMode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent-learn
|
|
||||||
- detect-learn
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inactive
|
|
||||||
minSeverityLevel:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- low
|
|
||||||
- medium
|
|
||||||
- high
|
|
||||||
- critical
|
|
||||||
default: medium
|
|
||||||
highConfidenceEventAction:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inherited
|
|
||||||
mediumConfidenceEventAction:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inherited
|
|
||||||
lowConfidenceEventAction:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: detect
|
|
||||||
archiveInspection:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
extractArchiveFiles:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
scanMaxFileSize:
|
|
||||||
type: integer
|
|
||||||
default: 10
|
|
||||||
scanMaxFileSizeUnit:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- bytes
|
|
||||||
- KB
|
|
||||||
- MB
|
|
||||||
- GB
|
|
||||||
default: MB
|
|
||||||
archivedFilesWithinArchivedFiles:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited #as set in overrideMode for fileSecurity
|
|
||||||
default: inherited
|
|
||||||
archivedFilesWhereContentExtractionFailed:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited #as set in overrideMode for fileSecurity
|
|
||||||
default: inherited
|
|
||||||
largeFileInspection:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
fileSizeLimit:
|
|
||||||
type: integer
|
|
||||||
default: 10
|
|
||||||
fileSizeLimitUnit:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- bytes
|
|
||||||
- KB
|
|
||||||
- MB
|
|
||||||
- GB
|
|
||||||
default: MB
|
|
||||||
filesExceedingSizeLimitAction:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited #as set in overrideMode for fileSecurity
|
|
||||||
default: inherited
|
|
||||||
unnamedFilesAction:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited #as set in overrideMode for fileSecurity
|
|
||||||
default: inherited
|
|
||||||
threatEmulationEnabled:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
accessControlPractices:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- rateLimit
|
|
||||||
properties:
|
|
||||||
appsecClassName:
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
practiceMode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- inherited #inherited from mode set in policy
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
default: inherited
|
|
||||||
rateLimit:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- overrideMode
|
|
||||||
properties:
|
|
||||||
overrideMode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
- inactive
|
|
||||||
- inherited
|
|
||||||
default: inactive
|
|
||||||
rules:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
action: # currently not supported
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- inherited
|
|
||||||
- prevent
|
|
||||||
- detect
|
|
||||||
default: inherited
|
|
||||||
condition: # currently not supported
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- key
|
|
||||||
- value
|
|
||||||
properties:
|
|
||||||
key:
|
|
||||||
type: string
|
|
||||||
value:
|
|
||||||
type: string
|
|
||||||
uri:
|
|
||||||
type: string
|
|
||||||
limit:
|
|
||||||
type: integer
|
|
||||||
unit:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- minute
|
|
||||||
- second
|
|
||||||
default: minute
|
|
||||||
triggers:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
comment:
|
|
||||||
type: string
|
|
||||||
customResponses:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- mode
|
|
||||||
properties:
|
|
||||||
appsecClassName:
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
mode:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- block-page
|
|
||||||
- redirect
|
|
||||||
- response-code-only
|
|
||||||
default: response-code-only
|
|
||||||
messageTitle:
|
|
||||||
type: string
|
|
||||||
messageBody:
|
|
||||||
type: string
|
|
||||||
httpResponseCode:
|
|
||||||
type: integer
|
|
||||||
minimum: 100
|
|
||||||
maximum: 599
|
|
||||||
default: 403
|
|
||||||
redirectUrl:
|
|
||||||
type: string
|
|
||||||
redirectAddXEventId:
|
|
||||||
type: boolean
|
|
||||||
default: false
|
|
||||||
sourcesIdentifiers:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- sourcesIdentifiers
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
sourcesIdentifiers:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- identifier
|
|
||||||
properties:
|
|
||||||
identifier:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- headerkey
|
|
||||||
- JWTKey
|
|
||||||
- cookie
|
|
||||||
- sourceip
|
|
||||||
- x-forwarded-for
|
|
||||||
default: sourceip
|
|
||||||
value:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
exceptions:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- action
|
|
||||||
- condition
|
|
||||||
properties:
|
|
||||||
appsecClassName:
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
action:
|
|
||||||
type: string
|
|
||||||
enum:
|
|
||||||
- skip
|
|
||||||
- accept
|
|
||||||
- drop
|
|
||||||
- suppressLog
|
|
||||||
default: accept
|
|
||||||
condition:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- key
|
|
||||||
- value
|
|
||||||
properties:
|
|
||||||
key:
|
|
||||||
type: string
|
|
||||||
value:
|
|
||||||
type: string
|
|
||||||
trustedSources:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
required:
|
|
||||||
- minNumOfSources
|
|
||||||
- sourcesIdentifiers
|
|
||||||
properties:
|
|
||||||
appsecClassName:
|
|
||||||
type: string
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
minNumOfSources:
|
|
||||||
type: integer
|
|
||||||
default: 3
|
|
||||||
sourcesIdentifiers:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
policyActivations:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
appsecClassName:
|
|
||||||
type: string
|
|
||||||
enabledPolicies:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: object
|
|
||||||
properties:
|
|
||||||
name:
|
|
||||||
type: string
|
|
||||||
hosts:
|
|
||||||
type: array
|
|
||||||
items:
|
|
||||||
type: string
|
|
||||||
required:
|
|
||||||
- hosts
|
|
||||||
required:
|
|
||||||
- enabledPolicies
|
|
||||||
additionalProperties: false
|
|
||||||
@@ -332,7 +332,17 @@ vector<PrometheusData>
|
|||||||
GenericMetric::getPromMetricsData()
|
GenericMetric::getPromMetricsData()
|
||||||
{
|
{
|
||||||
vector<PrometheusData> all_metrics;
|
vector<PrometheusData> all_metrics;
|
||||||
if (!getProfileAgentSettingWithDefault(false, "prometheus")) return all_metrics;
|
bool enable_prometheus = false;
|
||||||
|
auto prometheus_settings = getProfileAgentSetting<bool>("prometheus");
|
||||||
|
if (prometheus_settings.ok()) {
|
||||||
|
enable_prometheus = prometheus_settings.unpack();
|
||||||
|
} else {
|
||||||
|
const char *prometheus_env = getenv("PROMETHEUS");
|
||||||
|
if (prometheus_env != nullptr) {
|
||||||
|
enable_prometheus = string(prometheus_env) == "true";
|
||||||
|
}
|
||||||
|
}
|
||||||
|
if (!enable_prometheus) return all_metrics;
|
||||||
dbgTrace(D_METRICS) << "Get prometheus metrics";
|
dbgTrace(D_METRICS) << "Get prometheus metrics";
|
||||||
|
|
||||||
for (auto &calc : prometheus_calcs) {
|
for (auto &calc : prometheus_calcs) {
|
||||||
|
|||||||
@@ -11,6 +11,7 @@ set(COMMON_LIBRARIES "-lngen_core;-lcompression_utils;-lssl;-lcrypto;-lz;-lboost
|
|||||||
include(packaging.cmake)
|
include(packaging.cmake)
|
||||||
|
|
||||||
add_subdirectory(orchestration)
|
add_subdirectory(orchestration)
|
||||||
|
add_subdirectory(prometheus)
|
||||||
add_subdirectory(agent_cache)
|
add_subdirectory(agent_cache)
|
||||||
add_subdirectory(http_transaction_handler)
|
add_subdirectory(http_transaction_handler)
|
||||||
add_subdirectory(attachment_registration_manager)
|
add_subdirectory(attachment_registration_manager)
|
||||||
|
|||||||
@@ -29,4 +29,5 @@ cpview_metric_provider="cpviewMetricProvider 8282"
|
|||||||
hello_world="hello_world"
|
hello_world="hello_world"
|
||||||
crowdsec_aux="crowdsecAux 8081"
|
crowdsec_aux="crowdsecAux 8081"
|
||||||
central_nginx_manager="centralNginxManager 7555"
|
central_nginx_manager="centralNginxManager 7555"
|
||||||
|
prometheus="prometheus 7465"
|
||||||
# ## Please do not remove this comment - newline at end of file required.
|
# ## Please do not remove this comment - newline at end of file required.
|
||||||
|
|||||||
@@ -647,6 +647,9 @@ install_watchdog()
|
|||||||
echo "ExecStart=ip netns exec CTX0000${VS_ID} ${FILESYSTEM_PATH}/${WATCHDOG_PATH}/cp-nano-watchdog" >> /etc/systemd/system/${NANO_AGENT_SERVICE_FILE}
|
echo "ExecStart=ip netns exec CTX0000${VS_ID} ${FILESYSTEM_PATH}/${WATCHDOG_PATH}/cp-nano-watchdog" >> /etc/systemd/system/${NANO_AGENT_SERVICE_FILE}
|
||||||
fi
|
fi
|
||||||
echo "Environment=\"FILESYSTEM_PATH=${FILESYSTEM_PATH}\"" >> /etc/systemd/system/${NANO_AGENT_SERVICE_FILE}
|
echo "Environment=\"FILESYSTEM_PATH=${FILESYSTEM_PATH}\"" >> /etc/systemd/system/${NANO_AGENT_SERVICE_FILE}
|
||||||
|
if [ -n "${PROMETHEUS}" ] ; then
|
||||||
|
echo "Environment=\"PROMETHEUS=${PROMETHEUS}\"" >> /etc/systemd/system/${NANO_AGENT_SERVICE_FILE}
|
||||||
|
fi
|
||||||
|
|
||||||
cp_exec "systemctl daemon-reload"
|
cp_exec "systemctl daemon-reload"
|
||||||
cp_exec "systemctl enable nano_agent"
|
cp_exec "systemctl enable nano_agent"
|
||||||
|
|||||||
30
nodes/prometheus/CMakeLists.txt
Executable file
30
nodes/prometheus/CMakeLists.txt
Executable file
@@ -0,0 +1,30 @@
|
|||||||
|
add_subdirectory(package)
|
||||||
|
|
||||||
|
add_executable(prometheus main.cc)
|
||||||
|
|
||||||
|
target_link_libraries(prometheus
|
||||||
|
-Wl,--start-group
|
||||||
|
${COMMON_LIBRARIES}
|
||||||
|
|
||||||
|
generic_rulebase
|
||||||
|
generic_rulebase_evaluators
|
||||||
|
ip_utilities
|
||||||
|
version
|
||||||
|
signal_handler
|
||||||
|
|
||||||
|
prometheus_comp
|
||||||
|
http_transaction_data
|
||||||
|
-Wl,--end-group
|
||||||
|
)
|
||||||
|
|
||||||
|
add_dependencies(prometheus ngen_core)
|
||||||
|
|
||||||
|
install(TARGETS prometheus DESTINATION bin)
|
||||||
|
install(TARGETS prometheus DESTINATION prometheus_service/bin)
|
||||||
|
|
||||||
|
gen_package(
|
||||||
|
install-cp-nano-service-prometheus.sh
|
||||||
|
prometheus_service
|
||||||
|
./install-cp-nano-prometheus.sh
|
||||||
|
Check Point Prometheus Agent Version ${PACKAGE_VERSION} Install Package
|
||||||
|
)
|
||||||
15
nodes/prometheus/main.cc
Executable file
15
nodes/prometheus/main.cc
Executable file
@@ -0,0 +1,15 @@
|
|||||||
|
#include "components_list.h"
|
||||||
|
#include "prometheus_comp.h"
|
||||||
|
|
||||||
|
int
|
||||||
|
main(int argc, char **argv)
|
||||||
|
{
|
||||||
|
NodeComponents<PrometheusComp> comps;
|
||||||
|
|
||||||
|
comps.registerGlobalValue<bool>("Is Rest primary routine", true);
|
||||||
|
comps.registerGlobalValue<uint>("Nano service API Port Primary", 7465);
|
||||||
|
comps.registerGlobalValue<uint>("Nano service API Port Alternative", 7466);
|
||||||
|
comps.registerGlobalValue<bool>("Nano service API Allow Get From External IP", true);
|
||||||
|
|
||||||
|
return comps.run("Prometheus Service", argc, argv);
|
||||||
|
}
|
||||||
4
nodes/prometheus/package/CMakeLists.txt
Executable file
4
nodes/prometheus/package/CMakeLists.txt
Executable file
@@ -0,0 +1,4 @@
|
|||||||
|
install(FILES install-cp-nano-prometheus.sh DESTINATION prometheus_service/ PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ)
|
||||||
|
install(FILES cp-nano-prometheus.cfg DESTINATION prometheus_service/conf PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ)
|
||||||
|
install(FILES cp-nano-prometheus-conf.json DESTINATION prometheus_service/conf PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ)
|
||||||
|
install(FILES cp-nano-prometheus-debug-conf.json DESTINATION prometheus_service/conf PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ)
|
||||||
21
nodes/prometheus/package/cp-nano-prometheus-conf.json
Executable file
21
nodes/prometheus/package/cp-nano-prometheus-conf.json
Executable file
@@ -0,0 +1,21 @@
|
|||||||
|
{
|
||||||
|
"connection": {
|
||||||
|
"Nano service API Port Primary": [
|
||||||
|
{
|
||||||
|
"value": 7465
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"Nano service API Port Alternative": [
|
||||||
|
{
|
||||||
|
"value": 7466
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
"message": {
|
||||||
|
"Connection timeout": [
|
||||||
|
{
|
||||||
|
"value": 10000000
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
}
|
||||||
11
nodes/prometheus/package/cp-nano-prometheus-debug-conf.json
Executable file
11
nodes/prometheus/package/cp-nano-prometheus-debug-conf.json
Executable file
@@ -0,0 +1,11 @@
|
|||||||
|
{
|
||||||
|
"Debug": [
|
||||||
|
{
|
||||||
|
"Streams": [
|
||||||
|
{
|
||||||
|
"Output": "nano_agent/cp-nano-prometheus.dbg"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
0
nodes/prometheus/package/cp-nano-prometheus.cfg
Executable file
0
nodes/prometheus/package/cp-nano-prometheus.cfg
Executable file
164
nodes/prometheus/package/install-cp-nano-prometheus.sh
Executable file
164
nodes/prometheus/package/install-cp-nano-prometheus.sh
Executable file
@@ -0,0 +1,164 @@
|
|||||||
|
#!/bin/sh
|
||||||
|
|
||||||
|
#Nano Service Details
|
||||||
|
NANO_SERVICE_NAME="prometheus"
|
||||||
|
NANO_SERVICE_BIN_NAME="cp-nano-prometheus"
|
||||||
|
NANO_SERVICE_INSTALLATION_FOLDER="prometheus"
|
||||||
|
ATTACHMENT_BIN_NAME="cp-nano-prometheus"
|
||||||
|
|
||||||
|
#Installable Names
|
||||||
|
CFG_FILE_NAME="cp-nano-prometheus.cfg"
|
||||||
|
DBG_CONF_FILE_NAME="cp-nano-prometheus-debug-conf.json"
|
||||||
|
SERVICE_CONF_FILE_NAME="cp-nano-prometheus-conf.json"
|
||||||
|
NANO_SERVICE_BIN="prometheus"
|
||||||
|
ATTACHMENT_BIN="prometheus_attachment"
|
||||||
|
|
||||||
|
#Const variables
|
||||||
|
FORCE_STDOUT=true
|
||||||
|
INSTALLATION_TIME=$(date)
|
||||||
|
CP_NANO_LOG_PATH="/var/log/nano_agent"
|
||||||
|
CP_NANO_CONF_PATH="/etc/cp/conf"
|
||||||
|
NANO_SERVICE_INSTALLATION_PATH="/etc/cp/${NANO_SERVICE_INSTALLATION_FOLDER}"
|
||||||
|
NANO_SERVICE_BIN_PATH=${NANO_SERVICE_INSTALLATION_PATH}/${NANO_SERVICE_BIN_NAME}
|
||||||
|
NANO_SERVICE_CFG_PATH=${NANO_SERVICE_BIN_PATH}.cfg
|
||||||
|
ATTACHMENT_BIN_PATH=${NANO_SERVICE_INSTALLATION_PATH}/${ATTACHMENT_BIN_NAME}
|
||||||
|
DBG_CONF_PATH=${CP_NANO_CONF_PATH}/${NANO_SERVICE_BIN_NAME}-debug-conf.json
|
||||||
|
SERVICE_CONF_PATH=${CP_NANO_CONF_PATH}/${NANO_SERVICE_BIN_NAME}-conf.json
|
||||||
|
DBG_FILE_PATH=${CP_NANO_LOG_PATH}/${NANO_SERVICE_BIN_NAME}.dbg
|
||||||
|
INSTALLATION_LOG_FILE=${CP_NANO_LOG_PATH}/${NANO_SERVICE_BIN_NAME}-install.log
|
||||||
|
|
||||||
|
mkdir -p ${CP_NANO_LOG_PATH}
|
||||||
|
touch ${DBG_FILE_PATH}
|
||||||
|
|
||||||
|
cp_print()
|
||||||
|
{
|
||||||
|
var_text=$1
|
||||||
|
var_std_out=$2
|
||||||
|
touch $INSTALLATION_LOG_FILE
|
||||||
|
if [ -n "$var_std_out" ]; then
|
||||||
|
if [ "$var_std_out" = "true" ]; then
|
||||||
|
printf "%b\n" "$var_text"
|
||||||
|
fi
|
||||||
|
fi
|
||||||
|
printf "%b\n" "$var_text" >> $INSTALLATION_LOG_FILE
|
||||||
|
}
|
||||||
|
|
||||||
|
cp_exec()
|
||||||
|
{
|
||||||
|
var_cmd=$1
|
||||||
|
var_std_out=$2
|
||||||
|
# Send exec output to RES
|
||||||
|
RES=$($var_cmd 2>&1)
|
||||||
|
if [ -n "$RES" ]; then
|
||||||
|
cp_print "$RES" "$var_std_out"
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
set_configuration()
|
||||||
|
{
|
||||||
|
cp_exec "cp -n conf/${DBG_CONF_FILE_NAME} $DBG_CONF_PATH"
|
||||||
|
cp_exec "/etc/cp/scripts/cpnano_debug --default --service prometheus"
|
||||||
|
cp_exec "cp -n conf/${SERVICE_CONF_FILE_NAME} $SERVICE_CONF_PATH"
|
||||||
|
}
|
||||||
|
|
||||||
|
run_installation()
|
||||||
|
{
|
||||||
|
cp_print "Starting installation of Check Point ${NANO_SERVICE_NAME} Nano service [$INSTALLATION_TIME]\n" $FORCE_STDOUT
|
||||||
|
|
||||||
|
cp_exec "/etc/cp/watchdog/cp-nano-watchdog --un-register ${ATTACHMENT_BIN_PATH}"
|
||||||
|
cp_exec "/etc/cp/watchdog/cp-nano-watchdog --un-register ${NANO_SERVICE_BIN_PATH}"
|
||||||
|
|
||||||
|
att_path=$ATTACHMENT_BIN_PATH
|
||||||
|
cmd_pid_att=$(ps -eo pid,cmd,args | awk -v srv=${att_path} '{if($2 ~ srv || $3 ~ srv) print $1}')
|
||||||
|
srv_path=$NANO_SERVICE_BIN_NAME
|
||||||
|
cmd_pid_srv=$(ps -eo pid,cmd,args | awk -v srv=${srv_path} '{if($2 ~ srv || $3 ~ srv) print $1}')
|
||||||
|
|
||||||
|
if [ -n "$cmd_pid_att" ]; then
|
||||||
|
cp_print "Killing running instance(pid=$cmd_pid_att) of the prometheus attachment on installation"
|
||||||
|
kill -9 "$cmd_pid_att"
|
||||||
|
fi
|
||||||
|
if [ -n "$cmd_pid_srv" ]; then
|
||||||
|
cp_print "Killing running instance(pid=$cmd_pid_srv) of the prometheus service on installation"
|
||||||
|
kill -9 "$cmd_pid_srv"
|
||||||
|
fi
|
||||||
|
|
||||||
|
cp_exec "mkdir -p ${NANO_SERVICE_INSTALLATION_PATH}"
|
||||||
|
cp_exec "cp -f bin/${NANO_SERVICE_BIN} ${NANO_SERVICE_BIN_PATH}"
|
||||||
|
cp_exec "chmod +x ${NANO_SERVICE_BIN_PATH}"
|
||||||
|
cp_exec "cp -f conf/${CFG_FILE_NAME} ${NANO_SERVICE_CFG_PATH}"
|
||||||
|
cp_exec "chmod 600 ${NANO_SERVICE_CFG_PATH}"
|
||||||
|
|
||||||
|
set_configuration
|
||||||
|
|
||||||
|
cp_exec "/etc/cp/watchdog/cp-nano-watchdog --register ${NANO_SERVICE_BIN_PATH}"
|
||||||
|
cp_exec "/etc/cp/watchdog/cp-nano-watchdog --register ${ATTACHMENT_BIN_PATH}"
|
||||||
|
|
||||||
|
cp_print "Installation completed successfully." $FORCE_STDOUT
|
||||||
|
}
|
||||||
|
|
||||||
|
usage()
|
||||||
|
{
|
||||||
|
echo "Check Point: available flags are"
|
||||||
|
echo "--install : install ${NANO_SERVICE_NAME} Nano Service"
|
||||||
|
echo "--uninstall : remove ${NANO_SERVICE_NAME} Nano Service"
|
||||||
|
echo "--pre_install_test : run Pre-installation test for ${NANO_SERVICE_NAME} Nano Service install package"
|
||||||
|
echo "--post_install_test : run Post-installation test for ${NANO_SERVICE_NAME} Nano Service install package"
|
||||||
|
exit 255
|
||||||
|
}
|
||||||
|
|
||||||
|
run_uninstall()
|
||||||
|
{
|
||||||
|
cp_exec "/etc/cp/watchdog/cp-nano-watchdog --un-register ${ATTACHMENT_BIN_PATH}"
|
||||||
|
cp_exec "/etc/cp/watchdog/cp-nano-watchdog --un-register ${NANO_SERVICE_BIN_PATH}"
|
||||||
|
|
||||||
|
cp_exec "rm -rf ${NANO_SERVICE_INSTALLATION_PATH}"
|
||||||
|
cp_exec "rm -rf ${NANO_SERVICE_CONF_DIR}"
|
||||||
|
}
|
||||||
|
|
||||||
|
run_pre_install_test()
|
||||||
|
{
|
||||||
|
cp_print "Starting Pre-installation test of Check Point ${NANO_SERVICE_NAME} Nano service installation package [$INSTALLATION_TIME]\n" $FORCE_STDOUT
|
||||||
|
|
||||||
|
cp_print "Successfully finished pre-installation test for Check Point ${NANO_SERVICE_NAME} Nano service installation package [$INSTALLATION_TIME]\n" $FORCE_STDOUT
|
||||||
|
exit 0
|
||||||
|
}
|
||||||
|
|
||||||
|
run_post_install_test()
|
||||||
|
{
|
||||||
|
cp_print "Starting Post-installation test of Check Point ${NANO_SERVICE_NAME} Nano service installation package [$INSTALLATION_TIME]\n" $FORCE_STDOUT
|
||||||
|
|
||||||
|
if ! cat /etc/cp/watchdog/wd.services | grep -q ${NANO_SERVICE_BIN_PATH}; then
|
||||||
|
cp_print "Failed to register ${NANO_SERVICE_NAME} Nano service to the watchdog\n" $FORCE_STDOUT
|
||||||
|
exit 255
|
||||||
|
fi
|
||||||
|
|
||||||
|
cp_print "Successfully finished post-installation test for Check Point ${NANO_SERVICE_NAME} Nano service installation package [$INSTALLATION_TIME]\n" $FORCE_STDOUT
|
||||||
|
exit 0
|
||||||
|
|
||||||
|
}
|
||||||
|
|
||||||
|
run()
|
||||||
|
{
|
||||||
|
if [ '--install' = "$1" ]; then
|
||||||
|
run_installation "${@}"
|
||||||
|
elif [ '--uninstall' = "$1" ]; then
|
||||||
|
run_uninstall
|
||||||
|
elif [ '--pre_install_test' = "$1" ]; then
|
||||||
|
run_pre_install_test
|
||||||
|
elif [ '--post_install_test' = "$1" ]; then
|
||||||
|
run_post_install_test
|
||||||
|
else
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
}
|
||||||
|
|
||||||
|
if [ "$(id -u)" != "0" ]; then
|
||||||
|
echo "Administrative privileges required for this Package (use su or sudo)"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
shift
|
||||||
|
run "${@}"
|
||||||
|
|
||||||
|
exit 0
|
||||||
Reference in New Issue
Block a user