contrast-agent 3.9.1 → 6.15.3

data/lib/contrast/framework/sinatra/patch/encrypted_session_cookie.rb

@@ -0,0 +1,39 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+require 'contrast/components/scope'
+require 'contrast/framework/rack/patch/session_cookie'
+
+module Contrast
+  module Framework
+    module Sinatra
+      module Patch
+        # Our patch into the Rack::Protection::EncryptedCookie Class, that replaces Rack::Session::Cookie
+        # in Sinatra 3.0, allowing for the runtime detection of insecure configurations on individual cookies
+        # within the application
+        class EncryptedSessionCookie < Contrast::Framework::Rack::Patch::SessionCookie
+          extend Contrast::Components::Logger::InstanceMethods
+          extend Contrast::Components::Scope::InstanceMethods
+
+          class << self
+            include Contrast::Utils::InvalidConfigurationUtil
+
+            def instrument
+              @_instrument ||= begin
+                ::Rack::Protection::EncryptedCookie.class_eval do
+                  alias_method(:cs__patched_initialize, :initialize)
+                  def initialize app, options = {} # rubocop:disable Style/OptionHash, Lint/MissingSuper
+                    Contrast::Framework::Sinatra::Patch::EncryptedSessionCookie.analyze(options)
+                    cs__patched_initialize(app, options)
+                  end
+                end
+                true
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/framework/sinatra/support.rb

@@ -0,0 +1,162 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/framework/base_support'
+require 'contrast/agent/reporting/report'
+
+module Contrast
+  module Framework
+    module Sinatra
+      # Used when Sinatra is present to define framework specific behavior
+      class Support
+        extend Contrast::Framework::BaseSupport
+        class << self
+          def detection_class
+            'Sinatra'
+          end
+
+          def version
+            ::Sinatra::VERSION
+          end
+
+          def application_name
+            app_class&.cs__name
+          end
+
+          def application_root
+            app_instance&.root
+          end
+
+          def server_type
+            'sinatra'
+          end
+
+          # Given an object, determine if it is a Sinatra controller with routes.
+          #
+          # @param app [Object] suspected Sinatra app.
+          # @return [Boolean]
+          def sinatra_controller? app
+            # Sinatra is loaded?
+            return false unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+            # App is a subclass of or actually is ::Sinatra::Base.
+            return false unless (app.cs__respond_to?(:<) && app < ::Sinatra::Base) || app == ::Sinatra::Base
+
+            # App has routes.
+            !app.routes.empty?
+          end
+
+          # Find all classes that subclass ::Sinatra::Base. Gather their routes.
+          #
+          # @return [Array<Contrast::Agent::Reporting::DiscoveredRoute>]
+          def collect_routes
+            return Contrast::Utils::ObjectShare::EMPTY_ARRAY unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            routes = []
+            sinatra_controllers.each do |controller|
+              controller.routes.each_pair do |method, route_triplets|
+                # Sinatra stores its routes as a triplet: [Mustermann::Sinatra, [], Proc]
+                route_triplets.map(&:first).each do |route_pattern|
+                  routes << Contrast::Agent::Reporting::DiscoveredRoute.from_sinatra_route(controller, method,
+                                                                                           route_pattern)
+                end
+              end
+            end
+            routes
+          end
+
+          # Given the current request - return a RouteCoverage object
+
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @param _controller [::Sinatra::Base] optionally use this controller instead of global ::Sinatra::Base.
+          # @return [Contrast::Agent::Reporting::RouteCoverage, nil] a Dtm describing the route
+          # matched to the request if a match was found.
+          def current_route_coverage request, _controller = ::Sinatra::Base, full_route = nil
+            method = request.env[::Rack::REQUEST_METHOD] # GET, PUT, POST, etc...
+            route = _cleaned_route(request)
+            # Find route match--checking superclasses if necessary.
+            sinatra_controllers.each do |potential_controller|
+              next unless sinatra_controller?(potential_controller)
+
+              next if potential_controller.nil? || potential_controller.cs__class == NilClass
+
+              route_patterns = potential_controller.routes.fetch(method) { [] }.
+                  map(&:first)
+              route_pattern = route_patterns.find do |matcher|
+                matcher.params(route) # ::Mustermann::Sinatra match.
+              end
+              next unless route_pattern
+
+              full_route ||= request.env[::Rack::PATH_INFO]
+              new_route_coverage = Contrast::Agent::Reporting::RouteCoverage.new
+              new_route_coverage.attach_rack_based_data(potential_controller, method, route_pattern, full_route)
+              return new_route_coverage
+            end
+            nil
+          end
+
+          # Search object space for sinatra controllers--any class that subclasses ::Sinatra::Base.
+          #
+          # @return [Array<Class<::Sinatra::Base>>] sinatra controlelrs
+          def sinatra_controllers
+            @_sinatra_controllers ||=
+              [::Sinatra::Base] + ObjectSpace.each_object(Class).select { |clazz| sinatra_controller?(clazz) }
+          end
+
+          def retrieve_request env
+            ::Sinatra::Request.new(env)
+          end
+
+          # (See BaseSupport#after_load_patches)
+          def after_load_patches
+            return unless defined?(::Sinatra)
+            return unless Gem::Version.new(version) >= Gem::Version.new('3.0.0')
+
+            Set.new([
+                      Contrast::Agent::Patching::Policy::AfterLoadPatch.new(
+                          'Rack::Protection::EncryptedCookie',
+                          'contrast/framework/sinatra/patch/encrypted_session_cookie',
+                          instrumenting_module: 'Contrast::Framework::Sinatra::Patch::EncryptedSessionCookie')
+                    ])
+          end
+
+          private
+
+          # Get route and do some cleanup matching that of Sinatra::Base#process_route.
+          #
+          # @param request [Contrast::Agent::Request] a contrast tracked request.
+          # @return [String] the extracted and cleaned relative route.
+          def _cleaned_route request
+            settings = ::Sinatra::Base.settings
+            route = request.env[::Rack::PATH_INFO]
+            return '/' if route.empty? && !settings.empty_path_info?
+
+            !settings.strict_paths? && route.end_with?('/') ? route[0..-2] : route
+          end
+
+          # Almost an alias to app_instance.
+          #
+          # @return [::Sinatra::Base] the current controller class as routed by Rack.
+          def app_class
+            return unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            app_instance.cs__class
+          end
+
+          # Search the object space for the controller handling this request which will be
+          # the class inheriting from ::Sinatra::Base with @app=nil since it is the final servicer
+          # in the request/middleware chain.
+          #
+          # @return [::Sinatra::Base] the current controller as routed by Rack.
+          def app_instance
+            return unless defined?(::Sinatra) && defined?(::Sinatra::Base)
+
+            @_app_instance ||= begin
+              sinatra_layers = ObjectSpace.each_object(::Sinatra::Base).to_a
+              sinatra_layers.find { |layer| layer.app.nil? }
+            end
+          end
+        end
+      end
+    end
+  end
+end

data/lib/contrast/funchook/funchook.rb

@@ -0,0 +1,44 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/components/logger'
+
+# This module is used to find funchook library and determine availability
+module Funchook
+  extend Contrast::Components::Logger::InstanceMethods
+
+  attr_accessor :path
+
+  # Possible platform library files
+  ACCEPTABLE_FILES = %w[libfunchook.dylib libfunchook.so].cs__freeze
+
+  # Top level agent directories that should have the funchook libraries
+  SEARCH_DIRS = [File.join('ext'), File.join('shared_libraries'), File.join('funchook', 'src')].cs__freeze
+
+  AGENT_ROOT = File.join(__dir__, '..', '..', '..')
+
+  class << self
+    def resolve_path!
+      actual_path_segments = SEARCH_DIRS.product(ACCEPTABLE_FILES).find do |potential_funchook_path|
+        load_path = absolute_path(potential_funchook_path)
+        File.exist?(load_path)
+      end
+
+      if actual_path_segments.nil?
+        logger.warn('Unable to find funchook')
+      else
+        @path = absolute_path(actual_path_segments)
+      end
+      @path
+    end
+
+    def absolute_path path_array
+      File.absolute_path(File.join(AGENT_ROOT, *path_array))
+    end
+
+    def available?
+      @_available = !!resolve_path! if @_available.nil?
+      @_available
+    end
+  end
+end

data/lib/contrast/logger/aliased_logging.rb

@@ -0,0 +1,158 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'contrast/agent/telemetry/exception'
+
+module Contrast
+  module Logger
+    # Our decorator for the Ougai logger allowing for the catching, creating and saving Telemetry exceptions
+    module AliasedLogging
+      ALIASED_WARN = 'warn'.cs__freeze
+      ALIASED_ERROR = 'error'.cs__freeze
+      ALIASED_FATAL = 'fatal'.cs__freeze
+
+      # @param message [String] The message to log. Use default_message if not specified.
+      # @param exception [Exception] The exception or the error
+      # @param data [Object] Any structured data
+      def warn message = nil, exception = nil, data = nil, &block
+        # build Telemetry Exclusion
+        build_exception(ALIASED_WARN, message, exception, data)
+        super(message, exception, data, &block)
+      end
+
+      # @param message [String] The message to log. Use default_message if not specified.
+      # @param exception [Exception] The exception or the error
+      # @param data [Object] Any structured data
+      def error message = nil, exception = nil, data = nil, &block
+        # build Telemetry Exclusion
+        build_exception(ALIASED_ERROR, message, exception, data)
+        super(message, exception, data, &block)
+      end
+
+      # @param message [String] The message to log. Use default_message if not specified.
+      # @param exception [Exception] The exception or the error
+      # @param data [Object] Any structured data
+      def fatal message = nil, exception = nil, data = nil, &block
+        # build Telemetry Exclusion
+        build_exception(ALIASED_FATAL, message, exception, data)
+        super(message, exception, data, &block)
+      end
+
+      private
+
+      # There's a weird circular import in our code that we don't have time to untangle. This is 100% bad code and
+      # I'm sorry to the future team, but this is all we got.
+      #
+      # If the configuration we need is not available, we'll skip out for now - it means the agent isn't ready. We
+      # won't get telemetry exceptions at this point, but that means the agent hasn't initialized and there's a
+      # chance we're not supposed to. Essentially, we fail closed.
+      #
+      # Once we have the agent initialized, we'll use the value to check. Since it cannot change once set, we'll use
+      # the saved value.
+      #
+      # - HM
+      #
+      # @return [Boolean]
+      def buildable?
+        if @_buildable.nil?
+          return false unless defined?(Contrast) &&
+              defined?(Contrast::Agent) &&
+              defined?(Contrast::Agent::Telemetry)
+
+          @_buildable = Contrast::Agent::Telemetry.exceptions_enabled?
+        end
+        @_buildable
+      end
+
+      # @param type [ALIASED_FATAL, ALIASED_ERROR, ALIASED_WARN] the type of error, used to indicate the function used
+      #   for logging
+      # @param message [String] the exception message
+      # @param exception [Exception] The exception or error
+      # @param data [Object] Any structured data
+      def build_exception type, message = nil, exception = nil, data = nil
+        return unless buildable?
+
+        stack_trace = wrapped_caller_locations
+        caller_idx = stack_trace&.find_index { |stack| stack.to_s.include?(type) } || 0
+        # The caller_stack is the method in which the error occurred, so has to be above this method
+        caller_idx += 1
+        caller_frame = stack_trace[caller_idx]
+        stack_frame_type = caller_frame.path.delete_prefix(Dir.pwd)
+        stack_frame_function = caller_frame.label
+        key = "#{ stack_frame_type }|#{ stack_frame_function }|#{ message }"
+        if Contrast::TELEMETRY_EXCEPTIONS[key]
+          Contrast::TELEMETRY_EXCEPTIONS.increment(key)
+          return
+        end
+
+        return if Contrast::TELEMETRY_EXCEPTIONS.exception_limit?
+
+        message_exception_type = exception ? exception.cs__class.to_s : stack_frame_type.split('/').last
+        event_message = create_message(stack_frame_function,
+                                       stack_frame_type, message_exception_type,
+                                       data, exception,
+                                       message)
+        build_stack(event_message, stack_trace, caller_idx)
+        TELEMETRY_EXCEPTIONS[key] = event_message
+      rescue StandardError => e
+        debug('[Telemetry] Unable to report exception', e)
+      end
+
+      # @return [Contrast::Agent::Telemetry::Exception::Event]
+      def create_message stack_frame_function, stack_frame_type, message_exception_type, data, exception, message
+        message_for_exception = if exception
+                                  exception.cs__respond_to?(:message) ? exception.message : exception
+                                else
+                                  message
+                                end
+        module_name = message_exception_type ? message_exception_type.split('::')[0] : nil
+        stack_frame = Contrast::Agent::Telemetry::Exception::StackFrame.build(stack_frame_function,
+                                                                              stack_frame_type,
+                                                                              module_name)
+        message_exception = Contrast::Agent::Telemetry::Exception::MessageException.build(
+            message_exception_type,
+            message_for_exception,
+            module_name,
+            stack_frame)
+        tags = if data
+                 data
+               else
+                 exception.cs__is_a?(Hash) ? exception : {}
+               end
+        message = Contrast::Agent::Telemetry::Exception::Message.build(tags, [message_exception])
+        Contrast::Agent::Telemetry::Exception::Event.new(message)
+      rescue ArgumentError => e
+        debug('[Telemetry] TelemetryException failed from aliased logging with: ', e)
+      end
+
+      # Convert the given caller_stack from the event into the exception StackFrame format for reporting, appending it
+      # to the Exception wrapped in the Event.
+      #
+      # @param event_message [Contrast::Agent::Telemetry::Exception::Event]
+      # @param caller_stack [(Array<Thread::Backtrace::Location>, nil]
+      # @param caller_idx [Integer] the starting location for the exception, which allows filtering out the logger code
+      #   from the stack
+      def build_stack event_message, caller_stack, caller_idx = 0
+        return unless caller_stack
+
+        event_exception = event_message.exceptions[0]
+        event_exception_message = event_exception.exceptions[0]
+
+        caller_stack.each_with_index do |caller, idx|
+          next unless idx > caller_idx
+
+          stack_frame = Contrast::Agent::Telemetry::Exception::StackFrame.build(caller.label,
+                                                                                caller.path.delete_prefix(Dir.pwd))
+          event_exception_message.push(stack_frame)
+        end
+      end
+
+      # This is purely a wrapper around caller_locations used for testing
+      #
+      # @return [Array<Thread::Backtrace::Location>, nil]
+      def wrapped_caller_locations
+        caller_locations
+      end
+    end
+  end
+end

data/lib/contrast/logger/application.rb

@@ -0,0 +1,84 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+module Contrast
+  module Logger
+    # Our decorator for the Ougai logger allowing for the logging of the
+    # application environment, used to provide context during troubleshooting.
+    module Application
+      ENV_KEYS = %w[HOME PWD RACK_ENV RAILS_ENV RUBY_VERSION GEM_HOME GEM_PATH].cs__freeze
+      # Utility method to log some current ruby and rails information from environment
+      def application_environment
+        return unless info?
+
+        info('Process environment information', p_id: Process.pid, pp_id: Process.ppid,
+                                                agent_version: Contrast::Agent::VERSION,
+                                                ruby_version: RUBY_VERSION)
+        ENV.each do |env_key, env_value|
+          env_key = env_key.to_s
+          next unless ENV_KEYS.include?(env_key) ||
+              (env_key.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER) &&
+                  !env_key.start_with?("#{ Contrast::Components::Config::CONTRAST_ENV_MARKER }API"))
+
+          info('Environment settings', key: env_key, value: env_value)
+        end
+      end
+
+      def application_configuration
+        return unless info?
+
+        loggable = ::Contrast::CONFIG.loggable
+        info('Current configuration', configuration: loggable)
+        env_keys = ENV.keys.select do |env_key|
+          env_key&.to_s&.start_with?(Contrast::Components::Config::CONTRAST_ENV_MARKER)
+        end
+        env_items = env_keys.map { |env_key| Contrast::Utils::EnvConfigurationItem.new(env_key, nil) }
+        env_translations = env_items.each_with_object({}) do |conversion, hash|
+          hash[conversion.key] = conversion.dot_path_array.join('.')
+        end
+        info('Set by environment', overrides: env_translations)
+      end
+
+      def application_libraries
+        if debug?
+          log_all_libraries
+        elsif info?
+          log_specific_libraries
+        end
+      end
+
+      FRAMEWORKS = %w[rails sinatra grape].cs__freeze
+      WEB_SERVERS = %w[
+        agoo falcon hoof iodine mongrel mongrel2 passenger puma rack skinny thin trinidad unicorn
+        webrick yarn
+      ].cs__freeze
+      LIBRARIES = %w[excon json mongo moped mysql nokogiri oga ox pg psych sqlite3 typhoeus yaml].cs__freeze
+      def log_specific_libraries
+        FRAMEWORKS.each(&cs__method(:log_gem_data))
+        WEB_SERVERS.each(&cs__method(:log_gem_data))
+        LIBRARIES.each(&cs__method(:log_gem_data))
+      end
+
+      private
+
+      def log_all_libraries
+        return unless debug?
+
+        Gem.loaded_specs.each_pair do |_name, gem_spec|
+          debug('Gem loaded',
+                # rubocop:disable Security/Module/Name -- gems builtin.
+                gem_name: gem_spec.name,
+                gem_version: gem_spec.version.to_s)
+        end
+      end
+
+      def log_gem_data gem_name
+        gem_spec = Gem.loaded_specs[gem_name]
+        return unless gem_spec
+
+        info('Gem loaded', gem_name: gem_spec.name, gem_version: gem_spec.version.to_s)
+        # rubocop:enable Security/Module/Name
+      end
+    end
+  end
+end

data/lib/contrast/logger/cef_log.rb

@@ -0,0 +1,169 @@
+# Copyright (c) 2023 Contrast Security, Inc. See https://www.contrastsecurity.com/enduser-terms-0317a for more details.
+# frozen_string_literal: true
+
+require 'logger'
+require 'singleton'
+
+require 'contrast/extension/module'
+require 'contrast/logger/application'
+require 'contrast/logger/format'
+require 'contrast/logger/request'
+require 'contrast/logger/time'
+require 'contrast/logger/log'
+require 'contrast/components/config'
+require 'contrast/utils/log_utils'
+
+module Contrast
+  # Used as a wrapper around our logging. The module option specifically adds in a new method for error that raises the
+  # logged exception, used in testing so that we can see if anything unexpected happens without it being swallowed
+  # while still providing safe options for customers.
+  module Logger
+    # For development set following env var to raise logged exceptions instead of just logging.
+    if ENV['CONTRAST__AGENT__RUBY_MORE_COWBELL']
+      ::Logger.class_eval do
+        alias_method :cs__error, :error
+        alias_method :cs__warn, :warn
+
+        def error *args, **kwargs
+          if kwargs.empty?
+            cs__error(*args)
+          else
+            cs__error(*args, **kwargs)
+          end
+          args.each { |arg| raise(arg) if arg && arg.cs__class < Exception }
+        end
+      end
+    end
+
+    # This is the CEF Logger implementation. It uses the default ::Logger.
+    class CEFLog
+      include Singleton
+      include ::Contrast::Utils::LogUtils
+      include ::Contrast::Utils::CEFLogUtils
+
+      attr_reader :previous_path, :previous_level
+
+      def initialize
+        build_logger
+      end
+
+      # Given new settings from TeamServer, update our logging to use the new file and level, assuming they weren't
+      # set by local configuration.
+      #
+      # @param log_level [String] the level at which to log, as provided by TeamServer settings
+      # @param log_file [String] the file to which to log, as provided by TeamServer settings
+      def build_logger log_level = nil, log_file = nil
+        current_path_const = find_valid_path(log_file)
+        current_level_const = find_valid_level(log_level)
+        level_change = current_level_const != previous_level
+        path_change = current_path_const != previous_path
+
+        # don't needlessly recreate logger
+        return if @cef_logger && !(level_change || path_change)
+
+        @previous_level = current_level_const
+        @previous_path = current_path_const
+
+        @_cef_logger = build(path: current_path_const, level_const: current_level_const)
+        # If we're logging to a new path, then let's start it w/ our helpful
+        # data gathering messages
+        # log_update if path_change
+      rescue StandardError => e
+        # rubocop:disable Rails/Output
+        if @_cef_logger
+          @_cef_logger.error('Unable to process update to LoggerManager.', e)
+        else
+          puts('Unable to process update to LoggerManager.')
+          raise(e) if ENV['CONTRAST__AGENT__RUBY_MORE_COWBELL']
+
+          puts(e.message)
+          puts(e.backtrace.join("\n"))
+        end
+        # rubocop:enable Rails/Output
+      end
+
+      def cef_logger
+        @_cef_logger
+      end
+
+      def find_valid_path log_file
+        config = ::Contrast::CONFIG.agent.security_logger
+        config_path = config&.path&.length.to_i.positive? ? config.path : nil
+        valid_path(config_path || log_file, default_name: DEFAULT_CEF_NAME)
+      end
+
+      # @return [::Ougai::Logging::Severity] the level at which to log
+      def find_valid_level log_level
+        config = ::Contrast::CONFIG.agent.security_logger
+        config_level = config&.level&.length&.positive? ? config.level : nil
+
+        valid_level(config_level || log_level)
+      end
+
+      def log msg, level = @_cef_logger.level
+        case level
+        when ::Logger::Severity::INFO
+          @_cef_logger.info(msg)
+        when ::Logger::Severity::ERROR
+          @_cef_logger.error(msg)
+        when ::Logger::Severity::WARN
+          @_cef_logger.warn(msg)
+        when ::Logger::Severity::FATAL
+          @_cef_logger.fatal(msg)
+        else
+          @_cef_logger.debug(msg)
+        end
+      end
+
+      def virtual_patch_message patch, outcome
+        message = "Virtual Patch #{ patch.fetch(:name, '') } - #{ patch[:uuid] } was triggered by this request."
+        log([message, patch, outcome], ::Logger::Severity::DEBUG)
+      end
+
+      def bot_blocking_message matching_bot, outcome
+        message = "User agent #{ matching_bot[:user_agent] } matched the disallowed value #{ matching_bot[:bot] }"
+        log([message, matching_bot, outcome], ::Logger::Severity::DEBUG)
+      end
+
+      def ip_denylisted_message remote_ip, block_entry, outcome
+        message = "IP Address #{ remote_ip } matched the disallowed value" \
+                  "#{ block_entry[:ip] } in the IP Blacklist #{ block_entry[:uuid] }"
+        log([message, block_entry, outcome], ::Logger::Severity::DEBUG)
+      end
+
+      def successful_attack rule_id, outcome, input_type = nil, input_value = nil
+        if input_type.present? && input_value.present?
+          successful_attack_with_input = "#{ input_type } had a value that successfully exploited" \
+                                         "#{ rule_id } - #{ input_value }"
+          log([successful_attack_with_input, rule_id, outcome], ::Logger::Severity::WARN)
+        else
+          successful_attack_wo_input = "An effective attack was detected against #{ rule_id }"
+          log([successful_attack_wo_input, rule_id, outcome], ::Logger::Severity::WARN)
+        end
+      end
+
+      def ineffective_attack rule_id, outcome, input_type = nil, input_value = nil
+        if input_type.present? && input_value.present?
+          ineffective_attack_with_input = "#{ input_type } had a value that matched a signature for, " \
+                                          "but did not successfully exploit #{ rule_id } - #{ input_value }"
+          log([ineffective_attack_with_input, rule_id, outcome], ::Logger::Severity::WARN)
+        else
+          ineffective_attack_wo_input = "An unsuccessful attack was detected against #{ rule_id }"
+          log([ineffective_attack_wo_input, rule_id, outcome], ::Logger::Severity::WARN)
+        end
+      end
+
+      # newer - currently not in the agent, currently is a probe for us
+      def suspicious_attack rule_id, outcome, input_type = nil, input_value = nil
+        if input_type.present? && input_value.present?
+          suspicious_attack_with = "#{ input_type } included a potential attack value that was detected" \
+                                   "as suspicious using #{ rule_id } - #{ input_value }"
+          log([suspicious_attack_with, rule_id, outcome], ::Logger::WARN)
+        elsif input_value.present?
+          suspicious_attack_without = "Suspicious activity indicates a potential attack using #{ rule_id }"
+          log([suspicious_attack_without, rule_id, outcome], ::Logger::WARN)
+        end
+      end
+    end
+  end
+end