Class: Contrast::Agent::Reporting::ApplicationDefendAttackActivity

Inherits:
ReportableHash show all
Defined in:
lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb

Overview

This is the new ApplicationDefendAttackActivity class which will include the attacks sent by the source.

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods inherited from ReportableHash

#event_json, #valid?

Methods included from Components::Logger::InstanceMethods

#cef_logger, #logger

Constructor Details

#initialize ⇒ ApplicationDefendAttackActivity

Returns a new instance of ApplicationDefendAttackActivity.



26
27
28
29
 
# File 'lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb', line 26

def initialize
  @start_time = start_time
  super()
end

Instance Attribute Details

#blocked ⇒ Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity

Returns:



14
15
16
 
# File 'lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb', line 14

def blocked
  @blocked
end

#exploited ⇒ Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity

Returns:



16
17
18
 
# File 'lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb', line 16

def exploited
  @exploited
end

#ineffective ⇒ Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity

Returns:



18
19
20
 
# File 'lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb', line 18

def ineffective
  @ineffective
end

#response_type ⇒ Contrast::Agent::Reporting::ResponseType (readonly)

Helper method to determine before hand the response type and iv needed for access

Returns:



24
25
26
 
# File 'lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb', line 24

def response_type
  @response_type
end

#suspicious ⇒ Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity

Returns:



20
21
22
 
# File 'lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb', line 20

def suspicious
  @suspicious
end

Instance Method Details

#attach_data(attack_result) ⇒ Contrast::Agent::Reporting::Defend::AttackSampleActivity

Parameters:

Returns:

  • (Contrast::Agent::Reporting::Defend::AttackSampleActivity) 


55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
 
# File 'lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb', line 55

def attach_data attack_result
  attack_sample_activity = Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity.new
  attack_sample_activity.attach_data(attack_result)
  @response_type = attack_result.response
  case response_type
  when ::Contrast::Agent::Reporting::ResponseType::BLOCKED,
      ::Contrast::Agent::Reporting::ResponseType::BLOCKED_AT_PERIMETER

    @blocked = attack_sample_activity
  when ::Contrast::Agent::Reporting::ResponseType::MONITORED
    @exploited = attack_sample_activity
  when ::Contrast::Agent::Reporting::ResponseType::PROBED
    @ineffective = attack_sample_activity
  when ::Contrast::Agent::Reporting::ResponseType::SUSPICIOUS
    @suspicious = attack_sample_activity
  end
end

#start_time ⇒ Object 



73
74
75
 
# File 'lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb', line 73

def start_time
  Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0
end

#to_controlled_hash ⇒ Object 



31
32
33
34
35
36
37
38
39
40
41
42
43
44
 
# File 'lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb', line 31

def to_controlled_hash
  blocked_hash = blocked&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH
  exploited_hash = exploited&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH
  ineffective_hash = ineffective&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH
  suspicious_hash = suspicious&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH
  validate(blocked_hash, exploited_hash, ineffective_hash, suspicious_hash)
  {
      startTime: @start_time,
      blocked: blocked_hash,
      exploited: exploited_hash,
      ineffective: ineffective_hash,
      suspicious: suspicious_hash
  }
end

#validate(blocked_hash, exploited_hash, ineffective_hash, suspicious_hash) ⇒ Object

Raises:

  • (ArgumentError) 


46
47
48
49
50
51
 
# File 'lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb', line 46

def validate blocked_hash, exploited_hash, ineffective_hash, suspicious_hash
  raise(ArgumentError, 'Start Time for is not presented') unless @start_time
  return unless [blocked_hash, exploited_hash, ineffective_hash, suspicious_hash].all?(&:empty?)

  raise(ArgumentError, 'At least one of the samples must be populated')
end