Function AppsecEventGeneration

pkg/acquisition/modules/appsec/utils.go:104–271

(inEvt pipeline.Event, request *http.Request)

}

func AppsecEventGeneration(inEvt pipeline.Event, request *http.Request) (*pipeline.Event, error) {
	// if the request didn't trigger inband rules or out-of-band rules, we don't want to generate an event to LAPI/CAPI
	if !inEvt.Appsec.HasInBandMatches && !inEvt.Appsec.HasOutBandMatches {
		return nil, nil
	}

	evt := pipeline.Event{}
	evt.Type = pipeline.APPSEC
	evt.Process = true
	// Carry hook-published vars onto the overflow event so downstream
	// consumers of the APPSEC alert (not just the LOG event) can see them.
	if len(inEvt.Appsec.HookVars) > 0 {
		evt.Appsec.HookVars = inEvt.Appsec.HookVars
	}
	sourceIP := inEvt.Parsed["source_ip"]
	source := models.Source{
		Value: &sourceIP,
		IP:    sourceIP,
		Scope: new(types.Ip),
	}

	// Enrich source with GeoIP data
	if err := AppsecEventGenerationGeoIPEnrich(&source); err != nil {
		log.Errorf("unable to enrich source with GeoIP data : %s", err)
	}

	// Build overflow
	evt.Overflow.Sources = make(map[string]models.Source)
	evt.Overflow.Sources[sourceIP] = source

	alert := models.Alert{}
	alert.Capacity = new(int32(1))
	alert.Events = make([]*models.Event, len(evt.Appsec.MatchedRules))

	now := time.Now().UTC().Format(time.RFC3339)

	// Create one event (in the overflow) per matched rule
	for _, rule := range inEvt.Appsec.MatchedRules {
		event := models.Event{}
		meta := models.Meta{}

		if rule_name, ok := rule["name"].(string); ok {
			meta = append(meta, &models.MetaItems0{
				Key:   "rule_name",
				Value: rule_name,
			})
		}
		if msg, ok := rule["msg"].(string); ok {
			meta = append(meta, &models.MetaItems0{
				Key:   "message",
				Value: msg,
			})
		}
		if uri, ok := rule["uri"].(string); ok {
			meta = append(meta, &models.MetaItems0{
				Key:   "uri",
				Value: uri,
			})