Class: Datadog::AppSec::SecurityEvent

Inherits:
Object
  • Object
show all
Defined in:
lib/datadog/appsec/security_event.rb

Overview

A class that represents a security event of any kind. It could be an event representing an attack or fingerprinting results as attributes or an API security check with extracted schema.

Constant Summary collapse

SCHEMA_KEY_PREFIX = 
'_dd.appsec.s.'
FINGERPRINT_KEY_PREFIX = 
'_dd.appsec.fp.'

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(waf_result, trace:, span:) ⇒ SecurityEvent

Returns a new instance of SecurityEvent.



14
15
16
17
18
 
# File 'lib/datadog/appsec/security_event.rb', line 14

def initialize(waf_result, trace:, span:)
  @waf_result = waf_result
  @trace = trace
  @span = span
end

Instance Attribute Details

#span ⇒ Object (readonly)

Returns the value of attribute span.



12
13
14
 
# File 'lib/datadog/appsec/security_event.rb', line 12

def span
  @span
end

#trace ⇒ Object (readonly)

Returns the value of attribute trace.



12
13
14
 
# File 'lib/datadog/appsec/security_event.rb', line 12

def trace
  @trace
end

#waf_result ⇒ Object (readonly)

Returns the value of attribute waf_result.



12
13
14
 
# File 'lib/datadog/appsec/security_event.rb', line 12

def waf_result
  @waf_result
end

Instance Method Details

#fingerprint? ⇒ Boolean

Returns:

  • (Boolean) 


30
31
32
33
34
 
# File 'lib/datadog/appsec/security_event.rb', line 30

def fingerprint?
  return @has_fingerprint if defined?(@has_fingerprint)

  @has_fingerprint = @waf_result.attributes.any? { |name, _| name.start_with?(FINGERPRINT_KEY_PREFIX) }
end

#keep? ⇒ Boolean

Returns:

  • (Boolean) 


20
21
22
 
# File 'lib/datadog/appsec/security_event.rb', line 20

def keep?
  @waf_result.keep?
end

#schema? ⇒ Boolean

Returns:

  • (Boolean) 


24
25
26
27
28
 
# File 'lib/datadog/appsec/security_event.rb', line 24

def schema?
  return @has_schema if defined?(@has_schema)

  @has_schema = @waf_result.attributes.any? { |name, _| name.start_with?(SCHEMA_KEY_PREFIX) }
end