clarify logging if triggering inband or outofband rules
This commit is contained in:
parent
0379574b14
commit
24d2c264a7
|
@ -54,12 +54,18 @@ func LogWaapEvent(evt *types.Event, logger *log.Entry) {
|
||||||
req = req[:10] + ".."
|
req = req[:10] + ".."
|
||||||
}
|
}
|
||||||
|
|
||||||
if evt.Parsed["interrupted"] == "true" {
|
if evt.Meta["waap_interrupted"] == "true" {
|
||||||
logger.WithFields(log.Fields{
|
logger.WithFields(log.Fields{
|
||||||
"module": "waf",
|
"module": "waf",
|
||||||
"source": evt.Parsed["source_ip"],
|
"source": evt.Parsed["source_ip"],
|
||||||
"target_uri": req,
|
"target_uri": req,
|
||||||
}).Infof("%s blocked on %s (%d rules) [%v]", evt.Parsed["source_ip"], req, len(evt.Waap.MatchedRules), evt.Waap.GetRuleIDs())
|
}).Infof("%s blocked on %s (%d rules) [%v]", evt.Parsed["source_ip"], req, len(evt.Waap.MatchedRules), evt.Waap.GetRuleIDs())
|
||||||
|
} else if evt.Parsed["outofband_interrupted"] == "true" {
|
||||||
|
logger.WithFields(log.Fields{
|
||||||
|
"module": "waf",
|
||||||
|
"source": evt.Parsed["source_ip"],
|
||||||
|
"target_uri": req,
|
||||||
|
}).Infof("%s out-of-band blocking rules on %s (%d rules) [%v]", evt.Parsed["source_ip"], req, len(evt.Waap.MatchedRules), evt.Waap.GetRuleIDs())
|
||||||
} else {
|
} else {
|
||||||
logger.WithFields(log.Fields{
|
logger.WithFields(log.Fields{
|
||||||
"module": "waf",
|
"module": "waf",
|
||||||
|
@ -68,7 +74,6 @@ func LogWaapEvent(evt *types.Event, logger *log.Entry) {
|
||||||
}).Debugf("%s triggerd non-blocking rules on %s (%d rules) [%v]", evt.Parsed["source_ip"], req, len(evt.Waap.MatchedRules), evt.Waap.GetRuleIDs())
|
}).Debugf("%s triggerd non-blocking rules on %s (%d rules) [%v]", evt.Parsed["source_ip"], req, len(evt.Waap.MatchedRules), evt.Waap.GetRuleIDs())
|
||||||
}
|
}
|
||||||
|
|
||||||
//log.Infof("%s", evt.Waap)
|
|
||||||
}
|
}
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
@ -92,13 +97,15 @@ func (r *WafRunner) AccumulateTxToEvent(tx experimental.FullTransaction, kind st
|
||||||
if evt.Meta == nil {
|
if evt.Meta == nil {
|
||||||
evt.Meta = map[string]string{}
|
evt.Meta = map[string]string{}
|
||||||
}
|
}
|
||||||
evt.Parsed["interrupted"] = "true"
|
if kind == InBand {
|
||||||
evt.Parsed["action"] = tx.Interruption().Action
|
evt.Meta["waap_interrupted"] = "true"
|
||||||
|
|
||||||
//log.Infof("action: %s", tx.Interruption().Action)
|
|
||||||
|
|
||||||
evt.Meta["waap_interrupted"] = "1"
|
|
||||||
evt.Meta["waap_action"] = tx.Interruption().Action
|
evt.Meta["waap_action"] = tx.Interruption().Action
|
||||||
|
evt.Parsed["inband_interrupted"] = "true"
|
||||||
|
evt.Parsed["inband_action"] = tx.Interruption().Action
|
||||||
|
} else {
|
||||||
|
evt.Parsed["outofband_interrupted"] = "true"
|
||||||
|
evt.Parsed["outofband_action"] = tx.Interruption().Action
|
||||||
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
if evt.Waap.Vars == nil {
|
if evt.Waap.Vars == nil {
|
||||||
|
|
Loading…
Reference in a new issue