Update appsec metrics with event_rules_version tag (#8354)

sezen-datadog · web-flow · commit 40f82243ba77 · 2025-02-10T10:41:34.000+01:00
* Update metrics for java: appsec.rasp.rule.eval, appsec.rasp.rule.match and appsec.rasp.timeout (event_rules_version tag)
diff --git a/internal-api/src/main/java/datadog/trace/api/telemetry/WafMetricCollector.java b/internal-api/src/main/java/datadog/trace/api/telemetry/WafMetricCollector.java
@@ -328,7 +328,8 @@ public RaspRuleEval(final long counter, final RuleType ruleType, final String wa
               ? new String[] {
                 "rule_type:" + ruleType.type,
                 "rule_variant:" + ruleType.variant,
-                "waf_version:" + wafVersion
+                "waf_version:" + wafVersion,
+                "event_rules_version:" + rulesVersion
               }
               : new String[] {"rule_type:" + ruleType.type, "waf_version:" + wafVersion});
     }
@@ -343,7 +344,8 @@ public RaspRuleMatch(final long counter, final RuleType ruleType, final String w
               ? new String[] {
                 "rule_type:" + ruleType.type,
                 "rule_variant:" + ruleType.variant,
-                "waf_version:" + wafVersion
+                "waf_version:" + wafVersion,
+                "event_rules_version:" + rulesVersion
               }
               : new String[] {"rule_type:" + ruleType.type, "waf_version:" + wafVersion});
     }
@@ -358,7 +360,8 @@ public RaspTimeout(final long counter, final RuleType ruleType, final String waf
               ? new String[] {
                 "rule_type:" + ruleType.type,
                 "rule_variant:" + ruleType.variant,
-                "waf_version:" + wafVersion
+                "waf_version:" + wafVersion,
+                "event_rules_version:" + rulesVersion
               }
               : new String[] {"rule_type:" + ruleType.type, "waf_version:" + wafVersion});
     }
diff --git a/internal-api/src/test/groovy/datadog/trace/api/telemetry/WafMetricCollectorTest.groovy b/internal-api/src/test/groovy/datadog/trace/api/telemetry/WafMetricCollectorTest.groovy
@@ -314,21 +314,36 @@ class WafMetricCollectorTest extends DDSpecification {
     raspRuleEval.value == 3
     raspRuleEval.namespace == 'appsec'
     raspRuleEval.metricName == 'rasp.rule.eval'
-    raspRuleEval.tags.toSet() == ['rule_type:command_injection', 'rule_variant:'+ruleType.variant, 'waf_version:waf_ver1'].toSet()
+    raspRuleEval.tags.toSet() == [
+      'rule_type:command_injection',
+      'rule_variant:'+ruleType.variant,
+      'waf_version:waf_ver1',
+      'event_rules_version:rules.1'
+    ].toSet()
 
     def raspRuleMatch = (WafMetricCollector.RaspRuleMatch)metrics[2]
     raspRuleMatch.type == 'count'
     raspRuleMatch.value == 1
     raspRuleMatch.namespace == 'appsec'
     raspRuleMatch.metricName == 'rasp.rule.match'
-    raspRuleMatch.tags.toSet() == ['rule_type:command_injection', 'rule_variant:'+ruleType.variant, 'waf_version:waf_ver1'].toSet()
+    raspRuleMatch.tags.toSet() == [
+      'rule_type:command_injection',
+      'rule_variant:'+ruleType.variant,
+      'waf_version:waf_ver1',
+      'event_rules_version:rules.1'
+    ].toSet()
 
     def raspTimeout = (WafMetricCollector.RaspTimeout)metrics[3]
     raspTimeout.type == 'count'
     raspTimeout.value == 1
     raspTimeout.namespace == 'appsec'
     raspTimeout.metricName == 'rasp.timeout'
-    raspTimeout.tags.toSet() == ['rule_type:command_injection', 'rule_variant:'+ruleType.variant, 'waf_version:waf_ver1'].toSet()
+    raspTimeout.tags.toSet() == [
+      'rule_type:command_injection',
+      'rule_variant:'+ruleType.variant,
+      'waf_version:waf_ver1',
+      'event_rules_version:rules.1'
+    ].toSet()
 
     where:
     ruleType << [RuleType.COMMAND_INJECTION, RuleType.SHELL_INJECTION]

Original file line number	Diff line number	Diff line change
`@@ -328,7 +328,8 @@ public RaspRuleEval(final long counter, final RuleType ruleType, final String wa`
`328`	`328`	`? new String[] {`
`329`	`329`	`"rule_type:" + ruleType.type,`
`330`	`330`	`"rule_variant:" + ruleType.variant,`
`331`		`- "waf_version:" + wafVersion`
	`331`	`+ "waf_version:" + wafVersion,`
	`332`	`+ "event_rules_version:" + rulesVersion`
`332`	`333`	`}`
`333`	`334`	`: new String[] {"rule_type:" + ruleType.type, "waf_version:" + wafVersion});`
`334`	`335`	`}`
`@@ -343,7 +344,8 @@ public RaspRuleMatch(final long counter, final RuleType ruleType, final String w`
`343`	`344`	`? new String[] {`
`344`	`345`	`"rule_type:" + ruleType.type,`
`345`	`346`	`"rule_variant:" + ruleType.variant,`
`346`		`- "waf_version:" + wafVersion`
	`347`	`+ "waf_version:" + wafVersion,`
	`348`	`+ "event_rules_version:" + rulesVersion`
`347`	`349`	`}`
`348`	`350`	`: new String[] {"rule_type:" + ruleType.type, "waf_version:" + wafVersion});`
`349`	`351`	`}`
`@@ -358,7 +360,8 @@ public RaspTimeout(final long counter, final RuleType ruleType, final String waf`
`358`	`360`	`? new String[] {`
`359`	`361`	`"rule_type:" + ruleType.type,`
`360`	`362`	`"rule_variant:" + ruleType.variant,`
`361`		`- "waf_version:" + wafVersion`
	`363`	`+ "waf_version:" + wafVersion,`
	`364`	`+ "event_rules_version:" + rulesVersion`
`362`	`365`	`}`
`363`	`366`	`: new String[] {"rule_type:" + ruleType.type, "waf_version:" + wafVersion});`
`364`	`367`	`}`