contrast-agent 3.8.4 → 6.9.0

data/lib/contrast/agent/reporting/reporting_events/application_activity.rb

@@ -0,0 +1,120 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/application_reporting_event'
+require 'contrast/agent/reporting/reporting_events/application_defend_activity'
+require 'contrast/agent/reporting/reporting_events/application_inventory_activity'
+require 'contrast/agent/reporting/attack_result/response_type'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationActivity class which will include all the needed information for the new reporting
+      # system to report
+      class ApplicationActivity < Contrast::Agent::Reporting::ApplicationReportingEvent
+        include Contrast::Agent::Reporting::ResponseType
+
+        # @return [Integer]
+        attr_accessor :query_count
+        # @return [Array]
+        attr_accessor :routes
+        # @return [Contrast::Agent::Response]
+        attr_accessor :response
+
+        def initialize
+          @routes = []
+          @query_count = 0
+          @event_method = :PUT
+          @event_type = :application_activity
+          @event_endpoint = Contrast::Agent::Reporting::Endpoints.application_activity
+          super
+        end
+
+        # @return [Contrast::Agent::Reporting::FindingRequest] Current context's request
+        def request
+          @_request ||= FindingRequest.convert(Contrast::Agent::REQUEST_TRACKER.current&.request)
+        end
+
+        # @return [Contrast::Agent::Reporting::ApplicationDefendActivity] main
+        # activity for all protect rules.
+        def defend
+          @_defend ||= Contrast::Agent::Reporting::ApplicationDefendActivity.new
+        end
+
+        # @return [Contrast::Agent::Reporting::ApplicationInventoryActivity] main
+        # activity for all inventory activity reporting.
+        def inventory
+          @_inventory ||= Contrast::Agent::Reporting::ApplicationInventoryActivity.new
+        end
+
+        # @return file_name [String] used for audit
+        def file_name
+          'activity-application'
+        end
+
+        def to_controlled_hash
+          hsh = { lastUpdate: since_last_update }
+          hsh[:defend] = @_defend&.to_controlled_hash if @_defend
+          hsh[:inventory] = @_inventory&.to_controlled_hash if @_inventory
+          hsh
+        end
+
+        # Look for attack results and access to samples by
+        # searching with rule_id and response_type
+        #
+        # @param rule_id [String] name of the protect rule
+        # @param response_type[Symbol<Contrast::Agent::Reporting::ResponseType]
+        #  filter by response type
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity>, nil]
+        # return any matches.
+        def attack_results_for rule_id, response_type = nil
+          results = []
+          defend.attackers.each do |attacker|
+            next unless attacker.protection_rules[rule_id]
+
+            result = case response_type
+                     when BLOCKED, BLOCKED_AT_PERIMETER
+                       attacker.protection_rules[rule_id].blocked
+                     when EXPLOITED
+                       attacker.protection_rules[rule_id].exploited
+                     when PROBED
+                       attacker.protection_rules[rule_id].ineffective
+                     when SUSPICIOUS
+                       attacker.protection_rules[rule_id].suspicious
+                     else
+                       attacker.protection_rules[rule_id]
+                     end
+            results << result if result
+          end
+          results
+        end
+
+        # By reference. List of all results only by values, no rule_ids.
+        #
+        # @return [Array<[Contrast::Agent::Reporting::ApplicationDefendAttackerActivity]>]
+        def attack_results
+          results = []
+          defend.attackers.each { |a| results << a.protection_rules.values }
+          results
+        end
+
+        # This is primary used for attaching new data and merging existing
+        # samples per rule entry in attackers, and to make sure the attack
+        # time_map is updated correctly.
+        #
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        def attach_defend attack_result
+          defend.attach_data(attack_result)
+        end
+
+        # This is primary used for attaching new inventory reporting
+        #
+        # @param architecture [Contrast::Agent::Reporting::ArchitectureComponent]
+        def attach_inventory architecture
+          inventory.attach_data(architecture)
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_defend_activity.rb

@@ -0,0 +1,85 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/application_defend_attacker_activity'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationDefendActivity class which includes information about the defense of the application
+      # which was discovered during exercise of the application during this activity period.
+      class ApplicationDefendActivity
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackerActivity>]
+        attr_reader :attackers
+
+        def initialize
+          @attackers = []
+          @event_type = :application_defend_activity
+        end
+
+        def to_controlled_hash
+          {
+              attackers: attackers.map(&:to_controlled_hash)
+          }
+        end
+
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        def attach_data attack_result
+          attacker_activity = Contrast::Agent::Reporting::ApplicationDefendAttackerActivity.new
+          attacker_activity.attach_data(attack_result)
+
+          if (existing_attacker_activity = find_existing_attacker_activity(attacker_activity))
+            attach_existing(existing_attacker_activity, attacker_activity, attack_result.rule_id)
+          else
+            attackers << attacker_activity
+          end
+        end
+
+        # Find an existing attacker if it matches on source details
+        # @param attacker_activity [Contrast::Agent::Reporting::ApplicationDefendAttackerActivity]
+        def find_existing_attacker_activity new_attacker_activity
+          attackers.find do |existing|
+            existing.source_forwarded_for == new_attacker_activity.source_forwarded_for &&
+                existing.source_ip == new_attacker_activity.source_ip
+          end
+        end
+
+        # @param existing_attacker_activity [Contrast::Agent::Reporting::ApplicationDefendAttackerActivity]
+        # @param attacker_activity [Contrast::Agent::Reporting::ApplicationDefendAttackerActivity]
+        # @param rule [String]
+        def attach_existing existing_attacker_activity, attacker_activity, rule
+          new_violation = attacker_activity.protection_rules[rule]
+          sample_activity = Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity
+          if (previously_violated = existing_attacker_activity.protection_rules[rule])
+            if (new_blocked = new_violation.blocked)
+              previously_violated.blocked ||= sample_activity.new
+              previously_violated.blocked.samples.concat(new_blocked.samples) if new_blocked.samples
+              previously_violated.blocked.merge_time_maps(new_blocked.time_map)
+            end
+
+            if (new_exploited = new_violation.exploited)
+              previously_violated.exploited ||= sample_activity.new
+              previously_violated.exploited.samples.concat(new_exploited.samples) if new_exploited.samples
+              previously_violated.exploited.merge_time_maps(new_exploited.time_map)
+            end
+
+            if (new_ineffective = new_violation.ineffective)
+              previously_violated.ineffective ||= sample_activity.new
+              previously_violated.ineffective.samples.concat(new_ineffective.samples) if new_ineffective.samples
+              previously_violated.ineffective.merge_time_maps(new_ineffective.time_map)
+            end
+
+            if (new_suspicious = new_violation.suspicious)
+              previously_violated.suspicious ||= sample_activity.new
+              previously_violated.suspicious.samples.concat(new_suspicious.samples) if new_suspicious.samples
+              previously_violated.suspicious.merge_time_maps(new_suspicious.time_map)
+            end
+          else
+            existing_attacker_activity.protection_rules[rule] = new_violation
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_activity.rb

@@ -0,0 +1,65 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/application_defend_attack_sample_activity'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationDefendAttackActivity class which will include the attacks sent by the source.
+      class ApplicationDefendAttackActivity
+        # @return [Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity]
+        attr_accessor :blocked
+        # @return [Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity]
+        attr_accessor :exploited
+        # @return [Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity]
+        attr_accessor :ineffective
+        # @return [Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity]
+        attr_accessor :suspicious
+        # Helper method to determine before hand the response type and iv needed for access
+        #
+        # @return [Contrast::Agent::Reporting::ResponseType]
+        attr_reader :response_type
+
+        def initialize
+          @start_time = start_time
+        end
+
+        def to_controlled_hash
+          {
+              startTime: @start_time,
+              blocked: @blocked&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH,
+              exploited: @exploited&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH,
+              ineffective: @ineffective&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH,
+              suspicious: @suspicious&.to_controlled_hash || Contrast::Utils::ObjectShare::EMPTY_HASH
+          }
+        end
+
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        # @return [Contrast::Agent::Reporting::Defend::AttackSampleActivity]
+        def attach_data attack_result
+          attack_sample_activity = Contrast::Agent::Reporting::ApplicationDefendAttackSampleActivity.new
+          attack_sample_activity.attach_data(attack_result)
+          @response_type = attack_result.response
+          case response_type
+          when ::Contrast::Agent::Reporting::ResponseType::BLOCKED,
+              ::Contrast::Agent::Reporting::ResponseType::BLOCKED_AT_PERIMETER
+
+            @blocked = attack_sample_activity
+          when ::Contrast::Agent::Reporting::ResponseType::MONITORED
+            @exploited = attack_sample_activity
+          when ::Contrast::Agent::Reporting::ResponseType::PROBED
+            @ineffective = attack_sample_activity
+          when ::Contrast::Agent::Reporting::ResponseType::SUSPICIOUS
+            @suspicious = attack_sample_activity
+          end
+        end
+
+        def start_time
+          Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample.rb

@@ -0,0 +1,102 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/protect/rule/cmd_injection'
+require 'contrast/agent/protect/rule/deserialization'
+require 'contrast/agent/protect/rule/http_method_tampering'
+require 'contrast/agent/protect/rule/no_sqli'
+require 'contrast/agent/reporting/attack_result/user_input'
+require 'contrast/agent/reporting/attack_result/response_type'
+require 'contrast/components/logger'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationDefendAttackSample class which includes a samples of an attack for the given rule of
+      # the given result observed in the activity period.
+      class ApplicationDefendAttackSample
+        include Contrast::Agent::Reporting::InputType
+
+        # @return [Contrast::Agent::Reporting::UserInput]
+        attr_accessor :user_input
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackSampleStack>]
+        attr_reader :stack
+        # Details are per rule specific and should be set when the sample is build
+        #
+        # @return [Contrast::Agent::Reporting::Details::ProtectRuleDetails, {}]
+        attr_accessor :details
+        # @return [Integer] time in ms
+        attr_accessor :time_stamp
+
+        class << self
+          # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+          # @param attack_sample [Contrast::Agent::Reporting::ApplicationDefendAttackSample]
+          def convert attack_result, attack_sample
+            activity = new
+            activity.attach_data(attack_result, attack_sample)
+            activity
+          end
+        end
+
+        def initialize
+          @time_stamp = Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0 # in ms
+          @blocked = false
+          @event_type = :application_defend_attack_sample
+          @user_input = Contrast::Agent::Reporting::UserInput.new
+          @request = Contrast::Agent::REQUEST_TRACKER.current&.activity&.request
+          @stack = Contrast::Utils::StackTraceUtils.build_protect_report_stack_array
+          @details = {}
+        end
+
+        def to_controlled_hash
+          {
+              blocked: @blocked,
+              input: build_input(@user_input),
+              details: @details&.to_controlled_hash,
+              request: @request&.to_controlled_hash,
+              stack: @stack&.map(&:to_controlled_hash),
+              timestamp: build_time_stamp
+          }
+        end
+
+        # @param response_type [Contrast::Agent::Reporting::ResponseType]
+        # @return [Boolean] check if response type is blocked
+        def blocked? response_type
+          @blocked = response_type == Contrast::Agent::Reporting::ResponseType::BLOCKED
+        end
+
+        # @param user_input [Contrast::Agent::Reporting::UserInput]
+        def build_input user_input
+          {
+              documentPath: user_input.path,
+              documentType: user_input.document_type.to_s,
+              filters: user_input.matcher_ids,
+              name: user_input.key,
+              time: time_stamp,
+              type: user_input.input_type.to_s,
+              value: user_input.value
+          }
+        end
+
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        # @param attack_sample [Contrast::Agent::Reporting::RaspRuleSample]
+        def attach_data attack_result, attack_sample
+          @blocked = attack_result.response == ::Contrast::Agent::Reporting::ResponseType::BLOCKED
+          @user_input = attack_sample.user_input
+          @details = attack_sample.details
+          @time_stamp = attack_sample.time_stamp
+          @request = FindingRequest.convert(Contrast::Agent::REQUEST_TRACKER.current&.request)
+          @stack = Contrast::Utils::StackTraceUtils.build_protect_report_stack_array
+        end
+
+        # @return [Hash]
+        def build_time_stamp
+          {
+              start: time_stamp,
+              elapsed: Contrast::Utils::Timer.now_ms - time_stamp
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample_activity.rb

@@ -0,0 +1,68 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/utils/timer'
+require 'contrast/agent/reporting/reporting_events/application_defend_attack_sample'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new AttackerSampleActivity class which will include Sample of the given attacks in the activity
+      # period.
+      class ApplicationDefendAttackSampleActivity
+        # @return [Array<Contrast::Agent::Reporting::ApplicationDefendAttackSample>]
+        attr_reader :samples
+        # @return [Hash<Integer,Integer>] map of time from start in seconds to number of attacks in that second
+        attr_reader :time_map
+
+        def initialize
+          @samples = []
+          @start_time = Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0 # in ms
+          @event_type = :application_defend_attack_sample_activity
+          @time_map = Hash.new { |h, k| h[k] = 0 }
+        end
+
+        def to_controlled_hash
+          {
+              attackTimeMap: time_map,
+              samples: samples.map(&:to_controlled_hash),
+              startTime: @start_time, # Start time in ms.
+              total: 1 # there will only ever be 1 attack sample, until batching is done
+          }
+        end
+
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        def attach_data attack_result
+          attack_result.samples.each do |attack_sample|
+            base_time = Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0
+            sample_time = attack_sample.time_stamp.to_i
+            samples << Contrast::Agent::Reporting::ApplicationDefendAttackSample.convert(attack_result, attack_sample)
+            @start_time = if sample_time.zero?
+                            @start_time
+                          else
+                            sample_time
+                          end
+            attack_second = (@start_time - base_time) / 1000 # in seconds
+            time_map[attack_second] += 1
+          end
+        end
+
+        # This method will merge time_maps of attack samples with same
+        # type.
+        #
+        # @param map [Hash<Integer,Integer>] TimeMap to append to previously_violated rule
+        # samples.
+        # @return time_map [Hash<Integer,Integer>] merged time map with updated occurrences.
+        def merge_time_maps map
+          # If the second is the same (key) if we just merge there won't be a new entry,
+          # so just increase the attack count.
+          map.each_key do |key|
+            @time_map[key] = @time_map.fetch(key, 0) + map[key]
+          end
+          @time_map
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_defend_attack_sample_stack.rb

@@ -0,0 +1,22 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationDefendAttackSample class which includes a samples of an attack for the given rule of
+      # the given result observed in the activity period.
+      class ApplicationDefendAttackSampleStack
+        # @return [String]
+        attr_accessor :file_name
+        # @return [String]
+        attr_accessor :method_name
+
+        # @return [Hash]
+        def to_controlled_hash
+          { fileName: @file_name, methodName: @method_name }.compact
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_defend_attacker_activity.rb

@@ -0,0 +1,62 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/utils/object_share'
+require 'contrast/agent/reporting/reporting_events/application_defend_attack_activity'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new AttackerActivity class which will includes the attacker information discovered during this
+      # activity period.
+      class ApplicationDefendAttackerActivity
+        # @return [Hash<String,Contrast::Agent::Reporting::ApplicationDefendAttackActivity>] map of rule-id to violated
+        #   samples for that rule
+        attr_accessor :protection_rules
+        # @return [String, nil] the IP address of the request from which the attack originated; used to identify unique
+        #   attackers
+        attr_reader :source_ip
+        # @return [String, nil] the X-Forwarded-For Header of the request from which the attack originated; used to
+        #   identify unique attackers
+        attr_reader :source_forwarded_for
+
+        def initialize
+          @protection_rules = {}
+          req = Contrast::Agent::REQUEST_TRACKER.current&.request
+          if req
+            @source_ip = req.ip || Contrast::Utils::ObjectShare::EMPTY_STRING
+            @source_forwarded_for = req.headers['X-Forwarded-For']
+          end
+          @event_type = :application_defend_attacker_activity
+        end
+
+        def to_controlled_hash
+          {
+              protectionRules: process_protection_rules,
+              source: {
+                  ip: source_ip,
+                  xForwardedFor: source_forwarded_for
+              }
+          }
+        end
+
+        # @param attack_result [Contrast::Agent::Reporting::AttackResult]
+        def attach_data attack_result
+          @protection_rules[attack_result.rule_id] = Contrast::Agent::Reporting::ApplicationDefendAttackActivity.new.
+              tap do |activity|
+            activity.attach_data(attack_result)
+          end
+        end
+
+        def process_protection_rules
+          hsh = {}
+          @protection_rules.each_pair do |rule_id, attack_activity|
+            hsh[rule_id] = attack_activity.to_controlled_hash
+          end
+          hsh
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_inventory.rb

@@ -0,0 +1,42 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/reporting_event'
+require 'contrast/agent/reporting/reporting_events/discovered_route'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationInventory class which will include all the needed information
+      # for the new reporting system to report. Reporting those components or details discovered at
+      # startup, or as soon as possible, but not necessarily seen used by the application. Each of
+      # these messages should only be sent once per application.
+      class ApplicationInventory < Contrast::Agent::Reporting::ApplicationReportingEvent
+        # @param [Array<Contrast::Agent::Reporting::DiscoveredRoute>] the routes registered to this application, as
+        #   discovered during first request processing.
+        attr_reader :routes
+
+        def initialize
+          @event_type = :application_inventory
+          @event_method = :POST
+          @event_endpoint = Contrast::Agent::Reporting::Endpoints.application_inventory
+          # The API spec limits us to 500 routes, so we'll enforce that here to not hold on to superfulous data.
+          @routes = Contrast::Agent.framework_manager.find_route_discovery_data.take(500)
+          super
+        end
+
+        def file_name
+          'applications-inventory'
+        end
+
+        def to_controlled_hash
+          {
+              session_id: ::Contrast::ASSESS.session_id,
+              routes: routes.map(&:to_controlled_hash)
+          }
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_inventory_activity.rb

@@ -0,0 +1,57 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/agent/reporting/reporting_events/application_reporting_event'
+require 'contrast/agent/reporting/reporting_events/architecture_component'
+require 'contrast/utils/object_share'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationInventoryActivity class which will include all the information
+      # about the inventory of the application which was discovered during exercise of the application
+      # during this activity period.
+      class ApplicationInventoryActivity < Contrast::Agent::Reporting::ApplicationReportingEvent
+        # return [Array<Contrast::Agent::Reporting::ArchitectureComponent>]
+        attr_reader :components
+        # @ return [Array<String>, nil] - User-Agent Header value
+        attr_reader :browsers
+
+        def initialize
+          @event_type = :application_inventory_activity
+          @browsers = []
+          @components = []
+          super
+        end
+
+        def to_controlled_hash
+          {
+              activityDuration: duration,
+              browsers: browsers,
+              components: components.map(&:to_controlled_hash)
+          }
+        end
+
+        # @param architectures [Array<Contrast::Agent::Reporting::ArchitectureComponent>,
+        # Contrast::Agent::Reporting::ArchitectureComponent]
+        def attach_data architectures
+          Array(architectures).each do |architecture|
+            @components << architecture
+          end
+          request_headers = Contrast::Agent::REQUEST_TRACKER.current&.request&.headers
+          @browsers << request_headers['USER_AGENT'] if request_headers
+        end
+
+        def duration
+          Contrast::Utils::Timer.now_ms - (Contrast::Agent::REQUEST_TRACKER.current&.timer&.start_ms || 0)
+        end
+
+        # Helper method to determine if InventoryActivity has no data
+        def empty?
+          @browsers.empty? && @components.empty?
+        end
+      end
+    end
+  end
+end

data/lib/contrast/agent/reporting/reporting_events/application_reporting_event.rb

@@ -0,0 +1,27 @@
+# Copyright (c) 2022 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/reporting/reporting_events/reporting_event'
+require 'contrast/utils/timer'
+
+module Contrast
+  module Agent
+    module Reporting
+      # This is the new ApplicationReportingEvent class which will include all the needed and mutual information for
+      # those events which correspond to Applications, such as Application Activity or Application Update
+      #
+      # @abstract
+      class ApplicationReportingEvent < Contrast::Agent::Reporting::ReportingEvent
+        protected
+
+        # The timestamp field is a bit of a misnomer. It's really the time, in ms, since the settings for this
+        # application have been updated. If I've never updated, then it's been 0ms since then.
+        #
+        # @return [Integer]
+        def since_last_update
+          (update_time = Contrast::SETTINGS.last_app_update_ms) ? Contrast::Utils::Timer.now_ms - update_time : 0
+        end
+      end
+    end
+  end
+end