Skip to content

appsec: Attacker Fingerprinting#2899

Merged
eliottness merged 8 commits into
mainfrom
eliott.bouhana/APPSEC-54278
Oct 1, 2024
Merged

appsec: Attacker Fingerprinting#2899
eliottness merged 8 commits into
mainfrom
eliott.bouhana/APPSEC-54278

Conversation

@eliottness

@eliottness eliottness commented Sep 30, 2024

Copy link
Copy Markdown
Contributor

What does this PR do?

This PR finishing to setup Attacker fingerprinting:

  • Support for server.business_logic.users.login.success address
  • Support for server.business_logic.users.login.failure address
  • Support for usr.session_id address
  • Add all missing capabilities from the remoteconfig client
  • Register fingerprinting capabilities at appsec start
  • Upgrade the default ruleset to include fingerprinting preprocessors

System-tests job: https://github.com/DataDog/dd-trace-go/actions/runs/11127586022

Motivation

Implementation of the Attacker Fingerprinting RFC

Reviewer's Checklist

  • Changed code has unit tests for its functionality at or near 100% coverage.
  • System-Tests covering this feature have been added and enabled with the va.b.c-dev version tag.
  • There is a benchmark for any new code, or changes to existing code.
  • If this interacts with the agent in a new way, a system test has been added.
  • Add an appropriate team label so this PR gets put in the right place for the release notes.
  • Non-trivial go.mod changes, e.g. adding new modules, are reviewed by @DataDog/dd-trace-go-guild.

Unsure? Have a question? Request a review!

@eliottness eliottness changed the title appsec: setup login success and failure address to attacker fingerprinting appsec: Attacker Fingerprinting Sep 30, 2024
@pr-commenter

pr-commenter Bot commented Sep 30, 2024

Copy link
Copy Markdown

Benchmarks

Benchmark execution time: 2024-10-01 15:18:36

Comparing candidate commit 332a14d in PR branch eliott.bouhana/APPSEC-54278 with baseline commit daa6823 in branch main.

Found 0 performance improvements and 1 performance regressions! Performance is the same for 58 metrics, 0 unstable metrics.

scenario:BenchmarkSampleWAFContext-24

  • 🟥 execution_time [+4.399µs; +5.726µs] or [+2.425%; +3.157%]

Signed-off-by: Eliott Bouhana <[email protected]>
Signed-off-by: Eliott Bouhana <[email protected]>
Signed-off-by: Eliott Bouhana <[email protected]>
…at would not have been sent if empty to always sent

Signed-off-by: Eliott Bouhana <[email protected]>
Signed-off-by: Eliott Bouhana <[email protected]>
@eliottness
eliottness force-pushed the eliott.bouhana/APPSEC-54278 branch from 93c8e7e to 332a14d Compare October 1, 2024 14:34
@eliottness
eliottness marked this pull request as ready for review October 1, 2024 14:34
@eliottness
eliottness requested review from a team as code owners October 1, 2024 14:34
@eliottness
eliottness merged commit e5a17f2 into main Oct 1, 2024
@eliottness
eliottness deleted the eliott.bouhana/APPSEC-54278 branch October 1, 2024 15:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants