GitLab

Refactor CountAttackLogs response structure in SimpleProxy to use a custom Response type, improving clarity and type safety in JSON unmarshalling.

Enhance WAF API by adding CountAttackLogs endpoint and updating WafController to support region-specific log counting. Refactor service methods to accommodate region code in attack log counting logic.

Update log consumer to use fixed resource kind "Deployment" in WAF detection event naming for improved clarity in log entries.

Enhance LogConsumerService to include region name in log processing, updating configuration structure and initialization to support new regionName parameter.

Update GetAttackLogRsp method to use contentType variable for response formatting, ensuring accurate content type in WAF logs.

Add default content type handling in GetAttackLogRsp method to ensure consistent response formatting for WAF logs.

Enhance WafLogController proxy handling by setting request URL scheme and preserving query parameters, improving request integrity for WAF log processing.

Refactor WafLogController to implement a new ReverseProxy structure, enhancing URL path rewriting and host assignment for improved proxy request handling.

Refactor WafLogController to utilize the new proxy request rewriting method, improving URL handling and ensuring correct host assignment for WAF log requests.

Update WafLogController to set request URL scheme in proxy handling, ensuring correct protocol usage for WAF log requests.

Update WAF API routing to add specific endpoints for attack log retrieval, enhancing clarity and functionality in log proxy handling.

Refactor import statements in cmd.go and app.go for improved organization; add logging in WafLogController for better traceability of proxy requests.

Update WAF API routing to remove wildcard from attack log endpoint, enhancing clarity and consistency in log proxy handling.

Update WafLogController to use 'region_code' query parameter instead of 'region' for improved clarity in WAF log proxy handling.

Refactor WAF API routing and configuration to streamline endpoint structure and enhance clarity. Update region configuration to include WAF API server details, improving integration with the WAF controller.

Refactor WAF routing to use SetWafApiServerRouter function, improving API server integration and configuration handling.

Enhance WAF detection event structure in LogConsumerService by adding action and request details in a nested format. This refactor improves clarity and context for generated events, facilitating better analysis of detected attacks.

This commit introduces a new build target for the waf-api-server in the Makefile. It includes commands to build the server with specific tags and create a Docker image, enhancing the build process for the WAF console project.

This update introduces a new function, serverityFromAttackAction, to determine the severity level based on the attack action (warn, block, pass). The severity for generated WAF detection signals and events is now dynamically set using this function, enhancing the accuracy of event categorization.

This change modifies the event type from "waf_detection" to "ruleScope" and updates the rule key name to reflect the attack type instead of the rule name. Additionally, the relation type has been changed from "timeline" to "Discovery" for improved clarity in event categorization.

This update introduces a new Signal struct to encapsulate details related to WAF detections, including severity, tags, and context. The genWafDetectionSignal function has been implemented to generate signals based on attacked logs, improving the overall detection process. Additionally, the handling of bulk indexing for signals has been integrated into the existing workflow, ensuring that signals are properly indexed alongside events.

Refactor WAF detection event structure in LogConsumerService to improve clarity and detail. The genWafDetectionEvent function now includes action and request details in a nested format, enhancing the context of the generated events.

This update introduces a severity level of 6 to the generated WAF detection events, enhancing the event context for better categorization and analysis of detected attacks.

Refactor WAF detection logic in LogConsumerService to restore functionality for generating WAF detections and events. This update re-enables the processing of attacked logs and improves error handling, ensuring that failures during detection generation are logged for better visibility.

Update WAF detection event timestamps in LogConsumerService to use attack time from attacked logs. This change ensures accurate event timing for better context in generated events.

This update enhances the genWafDetectionEvent function by including RuleKeys with version, name, and category details for improved event context. Additionally, an informational log statement has been added to track WAF events during processing.

Enhance WAF detection event handling in LogConsumerService by adding attack URL and action details to the event context. The genWafDetectionEvent function now processes attacked logs more comprehensively, improving the overall event generation logic and error handling.

Enhance WAF detection event generation in LogConsumerService by adding attacked log details. The genWafDetectionEvent function now accepts an additional parameter for attacked logs, allowing for more comprehensive event context, including attack IP, time, application, and payload information.

Refactor WAF service listener deletion logic to include namespace and region code in the query, enhancing specificity and accuracy in service management. Additionally, remove redundant action check in WAF detection generation to simplify error handling.

Comment out WAF detection and event generation logic in LogConsumerService to simplify handling and improve readability. This change prepares the code for future enhancements while maintaining the current functionality.

This update replaces direct assignment of WAF detection properties with a new method for generating WAF detections and events, enhancing code clarity and maintainability. Additionally, error handling has been improved to log failures during the generation process, ensuring better visibility into issues that may arise.