Commit ddb01db8 authored by qiuqunfeng's avatar qiuqunfeng
Browse files

Enhance WAF detection event generation in LogConsumerService by adding...

Enhance WAF detection event generation in LogConsumerService by adding attacked log details. The genWafDetectionEvent function now accepts an additional parameter for attacked logs, allowing for more comprehensive event context, including attack IP, time, application, and payload information.
parent 56ce2571
...@@ -147,7 +147,7 @@ func (s *LogConsumerService) genWafDetection(wafDetectionMessage model.WafDetect ...@@ -147,7 +147,7 @@ func (s *LogConsumerService) genWafDetection(wafDetectionMessage model.WafDetect
return wafDetection, nil return wafDetection, nil
} }
func (s *LogConsumerService) genWafDetectionEvent(wafDetectionMessage model.WafDetectionMessage) (model.Event, error) { func (s *LogConsumerService) genWafDetectionEvent(wafDetectionMessage model.WafDetectionMessage, attackedLog model.WafDetectionAttackedLog) (model.Event, error) {
event := model.Event{ event := model.Event{
ID: id.Str(), ID: id.Str(),
Type: "waf_detection", Type: "waf_detection",
...@@ -202,7 +202,16 @@ func (s *LogConsumerService) genWafDetectionEvent(wafDetectionMessage model.WafD ...@@ -202,7 +202,16 @@ func (s *LogConsumerService) genWafDetectionEvent(wafDetectionMessage model.WafD
UpdatedAt: wafDetectionMessage.CreatedAt, UpdatedAt: wafDetectionMessage.CreatedAt,
Timestamp: time.Now(), Timestamp: time.Now(),
Context: map[string]interface{}{ Context: map[string]interface{}{
"waf_detection_message": wafDetectionMessage, "attack_ip": attackedLog.AttackIP,
"attack_time": attackedLog.AttackTime,
"attack_app": attackedLog.AttackedApp,
"attack_load": attackedLog.AttackLoad,
"rule_name": attackedLog.RuleName,
"waf_body": map[string]interface{}{
"type": "code",
"request": attackedLog.ReqPkg,
"response": attackedLog.RspPkg,
},
}, },
} }
return event, nil return event, nil
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment