Fix audit RelevantOnly logs with DetectionOnly rule engine#1339
Fix audit RelevantOnly logs with DetectionOnly rule engine#1339rse173 wants to merge 3 commits intocorazawaf:mainfrom
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1339 +/- ##
=======================================
Coverage 81.99% 82.00%
=======================================
Files 170 170
Lines 9803 9808 +5
=======================================
+ Hits 8038 8043 +5
Misses 1518 1518
Partials 247 247
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
|
LGTM, any input @M4tteoP ? |
| logger.Debug().Str("action", a.Name).Int("phase", int(phase)).Msg("Evaluating flow action for rule") | ||
| a.Function.Evaluate(r, tx) | ||
| } else if a.Function.Type() == plugintypes.ActionTypeDisruptive && tx.RuleEngine == types.RuleEngineOn { | ||
| } else if a.Function.Type() == plugintypes.ActionTypeDisruptive && tx.RuleEngine != types.RuleEngineOff { |
There was a problem hiding this comment.
Thanks for the PR!
I think this is interesting, but something we should be quite careful with. It tweaks the core definition of DetectionOnly, which currently means that rules are processed but disruptive actions are never executed.
If I'm getting this right, with this PR, the logic becomes: disruptive actions are executed, but no interruption is triggered.
I see value in this change, it closes the gap between how the system behaves in DetectionOnly/On mode ( See #1051), but we should consider all the implications, as this changes the engine's behavior in DetectionOnly mode.
I'll take a more in-depth look
|
any movement on this @M4tteoP ? |
3 participants
Hello, this is a patch to fix #1333 simply without touching at the interruption. The only downside is that we add a variable to the Transaction struct (If you have a better idea let me know).
For now it is enough for my purpose, we have
RelevantOnlyaudit logs when we are inRuleEngineDetectionOnlymode.The variable
detectedInterruptionis set to thetx.interruptionwhen an interruption would have been triggered if we were inRuleEngineOn.