tcell_agent 0.2.29 → 0.4.0

data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb

@@ -5,566 +5,391 @@ module TCellAgent
 
     describe AppSensorPolicy do
 
-      describe "#from_json" do
+      everything_enabled_policy_json = {
+        "policy_id" => "01a1",
+        "version" => 2,
+        "data" => {
+          "options" => {
+            "uri_options" => {
+              "collect_full_uri" => true
+            },
+            "payloads" => {
+              "send_payloads" => true,
+              "send_blacklist" => {
+                  "ssn" => ["*"],
+                  "password" => ["*"]
+              },
+              "send_whitelist" => {},
+              "log_payloads" => true,
+              "log_blacklist" => {},
+              "log_whitelist" => {
+                  "username" => ["*"]
+              }
+            }
+          },
+          "sensors" => {
+            "req_size" => {
+                "limit" => 1024,
+                "exclude_routes" => ["2300"]
+            },
+            "resp_size" => {
+                "limit" => 2048,
+                "exclude_routes" => ["2323"]
+            },
+            "resp_codes" => {
+                "series_400_enabled" => true,
+                "series_500_enabled" => true
+            },
+            "xss" => {
+                "libinjection" => true,
+                "patterns" => ["1","2","8"],
+                "exclusions" => {
+                    "bob" => ["*"]
+                }
+            },
+            "sqli" => {
+                "libinjection" => true,
+                "exclude_headers" => true,
+                "patterns" => ["1"]
+            },
+            "fpt" => {
+                "patterns" => ["1","2"],
+                "exclude_forms" => true,
+                "exclude_cookies" => true,
+                "exclusions" => {
+                    "somethingcommon" => ["form"]
+                }
+            },
+            "cmdi" => {
+                 "patterns" => ["1","2"]
+            },
+            "nullbyte" => {
+                 "patterns" => ["1","2"]
+            },
+            "retr" => {
+                 "patterns" => ["1","2"]
+            },
+            "ua" => {
+              "empty_enabled" => true,
+            },
+            "errors" => {
+              "csrf_exception_enabled" => true,
+              "sql_exception_enabled" => true
+            },
+            "database" => {
+              "large_result" => {
+                "limit" => 10
+              }
+            }
+          }
+        }
+      }
 
-        context "with v1 policy" do
+      describe "#from_json" do
+        context "with v2 policy" do
           context "that is missing a policy id" do
-            it "should raise an error" do
-              expect{
-                AppSensorPolicy.from_json({
-                  "data" => { "options" => {} }
-                })
-              }.to raise_error(RuntimeError)
+            it "should have appfirewall disabled" do
+              policy = AppSensorPolicy.from_json({
+                "version" => 2,
+                "data" => { }
+              })
+
+              expect(policy.appfirewall_enabled).to eq(false)
+              expect(policy.appfirewall_ptr).to be_nil
             end
           end
 
-          context "that has empty options" do
-            it "should have all sensors disabled" do
-              expect_any_instance_of(AppSensorRuleManager).to_not receive(:instance)
-
-              policy_json_empty = {
+          context "that is missing a version id" do
+            it "should have appfirewall disabled" do
+              policy = AppSensorPolicy.from_json({
                 "policy_id" => "01a1",
-                "data" => {
-                  "options"=> {}
-                }
-              }
-
-              empty_policy = AppSensorPolicy.from_json(policy_json_empty)
+                "data" => { }
+              })
 
-              expect(empty_policy.policy_id).to eq("01a1")
-              expect(empty_policy.enabled).to eq(false)
-              expect(empty_policy.injections_reporter.payloads_policy).to_not be_nil
-              expect(empty_policy.injections_reporter.payloads_policy.send_payloads).to eq(false)
-              expect(empty_policy.injections_reporter.payloads_policy.log_payloads).to eq(false)
-              expect(empty_policy.options["req_size"]).to be_nil
-              expect(empty_policy.options["resp_size"]).to be_nil
-              expect(empty_policy.options["resp_codes"]).to be_nil
-              expect(empty_policy.options["xss"]).to be_nil
-              expect(empty_policy.options["sqli"]).to be_nil
-              expect(empty_policy.options["cmdi"]).to be_nil
-              expect(empty_policy.options["fpt"]).to be_nil
-              expect(empty_policy.options["nullbyte"]).to be_nil
-              expect(empty_policy.options["retr"]).to be_nil
-              expect(empty_policy.options["ua"]).to be_nil
-              expect(empty_policy.options["errors"]).to be_nil
-              expect(empty_policy.options["database"]).to be_nil
+              expect(policy.appfirewall_enabled).to eq(false)
+              expect(policy.appfirewall_ptr).to be_nil
             end
           end
 
-          context "that has no options" do
+          context "that has no sensors" do
             it "should have all sensors disabled" do
-              expect(AppSensorRuleManager).to_not receive(:instance)
-
               policy_json_empty = {
                 "policy_id" => "01a1",
+                "version" => 2,
                 "data" => {
                 }
               }
 
               empty_policy = AppSensorPolicy.from_json(policy_json_empty)
 
-              expect(empty_policy.policy_id).to eq("01a1")
-              expect(empty_policy.enabled).to eq(false)
-              expect(empty_policy.injections_reporter.payloads_policy).to_not be_nil
-              expect(empty_policy.injections_reporter.payloads_policy.send_payloads).to eq(false)
-              expect(empty_policy.injections_reporter.payloads_policy.log_payloads).to eq(false)
-              expect(empty_policy.options["req_size"]).to be_nil
-              expect(empty_policy.options["resp_size"]).to be_nil
-              expect(empty_policy.options["resp_codes"]).to be_nil
-              expect(empty_policy.options["xss"]).to be_nil
-              expect(empty_policy.options["sqli"]).to be_nil
-              expect(empty_policy.options["cmdi"]).to be_nil
-              expect(empty_policy.options["fpt"]).to be_nil
-              expect(empty_policy.options["nullbyte"]).to be_nil
-              expect(empty_policy.options["retr"]).to be_nil
-              expect(empty_policy.options["ua"]).to be_nil
-              expect(empty_policy.options["errors"]).to be_nil
-              expect(empty_policy.options["database"]).to be_nil
+              expect(empty_policy.appfirewall_enabled).to eq(false)
+              expect(empty_policy.appfirewall_ptr).to_not be_nil
             end
           end
 
-          context "that only has null enabled" do
-            it "should only have null enabled" do
-              expect(AppSensorRuleManager).to receive(:instance)
-
-              policy_json = {
+          context "that has empty sensors" do
+            it "should have all sensors disabled" do
+              policy_json_empty = {
                 "policy_id" => "01a1",
+                "version" => 2,
                 "data" => {
-                  "options"=> {"null"=>true}
+                  "sensors" => {}
                 }
               }
 
-              policy = AppSensorPolicy.from_json(policy_json)
+              empty_policy = AppSensorPolicy.from_json(policy_json_empty)
 
-              expect(policy.policy_id).to eq("01a1")
-              expect(policy.enabled).to eq(true)
-              expect(policy.injections_reporter.payloads_policy).to_not be_nil
-              expect(policy.injections_reporter.payloads_policy.send_payloads).to eq(true)
-              expect(policy.injections_reporter.payloads_policy.log_payloads).to eq(true)
-              expect(policy.options["req_size"]).to_not be_nil
-              expect(policy.options["resp_size"]).to_not be_nil
-              expect(policy.options["resp_codes"]).to_not be_nil
-              expect(policy.options["ua"]).to_not be_nil
-              expect(policy.options["errors"]).to_not be_nil
-              expect(policy.options["database"]).to_not be_nil
-
-              injections_matcher = policy.injections_reporter.injections_matcher
-              expect(injections_matcher).to_not be_nil
-              expect(injections_matcher.sensors.size).to eq(1)
-              expect(injections_matcher.sensors[0].detection_point).to eq("null")
-              expect(injections_matcher.sensors[0].enabled).to eq(true)
-              expect(injections_matcher.sensors[0].v1_compatability_enabled).to eq(true)
+              expect(empty_policy.appfirewall_enabled).to eq(true)
+              expect(empty_policy.appfirewall_ptr).to_not be_nil
             end
           end
 
           context "that only has xss enabled" do
-            it "should only have xss enabled" do
-              expect(AppSensorRuleManager).to receive(:instance)
-
+            it "should be enabled" do
               policy_json = {
                 "policy_id" => "01a1",
+                "version" => 2,
                 "data" => {
-                  "options"=> {"xss"=>true}
+                  "sensors" => {
+                    "xss" => {
+                      "libinjection" => true,
+                      "patterns" => ["1","2","8"],
+                      "exclusions" => {
+                          "bob" => ["*"]
+                      }
+                    }
+                  }
                 }
               }
 
-              empty_policy = AppSensorPolicy.from_json(policy_json)
-
-              expect(empty_policy.policy_id).to eq("01a1")
-              expect(empty_policy.enabled).to eq(true)
-              expect(empty_policy.injections_reporter.payloads_policy.send_payloads).to eq(true)
-              expect(empty_policy.injections_reporter.payloads_policy.log_payloads).to eq(true)
-              expect(empty_policy.options["req_size"]).to_not be_nil
-              expect(empty_policy.options["resp_size"]).to_not be_nil
-              expect(empty_policy.options["resp_codes"]).to_not be_nil
-              expect(empty_policy.options["ua"]).to_not be_nil
-              expect(empty_policy.options["errors"]).to_not be_nil
-              expect(empty_policy.options["database"]).to_not be_nil
-
-              expect(empty_policy.options["req_size"].enabled).to eq(false)
-              expect(empty_policy.options["resp_size"].enabled).to eq(false)
-              expect(empty_policy.options["resp_codes"].enabled).to eq(false)
-              expect(empty_policy.options["ua"].enabled).to eq(false)
-              expect(empty_policy.options["ua"].empty_enabled).to eq(false)
-              expect(empty_policy.options["errors"].enabled).to eq(false)
-              expect(empty_policy.options["errors"].csrf_exception_enabled).to eq(false)
-              expect(empty_policy.options["errors"].sql_exception_enabled).to eq(false)
-              expect(empty_policy.options["database"].enabled).to eq(false)
-
-              injections_matcher = empty_policy.injections_reporter.injections_matcher
-              expect(injections_matcher).to_not be_nil
-              expect(injections_matcher.sensors.size).to eq(1)
-              expect(injections_matcher.sensors[0].detection_point).to eq("xss")
-              expect(injections_matcher.sensors[0].enabled).to eq(true)
-              expect(injections_matcher.sensors[0].v1_compatability_enabled).to eq(true)
+              policy = AppSensorPolicy.from_json(policy_json)
+
+              expect(policy.appfirewall_enabled).to eq(true)
+              expect(policy.appfirewall_ptr).to_not be_nil
             end
           end
 
           context "that has everything enabled" do
-            it "should have all sensors enabled" do
-              expect(AppSensorRuleManager).to receive(:instance).exactly(6).times
+            it "should be enabled" do
+              policy = AppSensorPolicy.from_json(everything_enabled_policy_json)
 
-              policy_json = {
-                "policy_id" => "01a1",
-                "data" => {
-                  "options"=> {
-                    "req_res_size"=>true,
-                    "resp_codes"=>true,
-                    "xss"=>true,
-                    "sqli"=>true,
-                    "cmdi"=>true,
-                    "fpt"=>true,
-                    "null"=>true,
-                    "retr"=>true
-                  }
-                }
-              }
-
-              policy = AppSensorPolicy.from_json(policy_json)
-
-              expect(policy.policy_id).to eq("01a1")
-              expect(policy.enabled).to eq(true)
-              expect(policy.injections_reporter.payloads_policy.send_payloads).to eq(true)
-              expect(policy.injections_reporter.payloads_policy.log_payloads).to eq(true)
-              expect(policy.options["req_size"]).to_not be_nil
-              expect(policy.options["resp_size"]).to_not be_nil
-              expect(policy.options["resp_codes"]).to_not be_nil
-
-              expect(policy.options["ua"]).to_not be_nil
-              expect(policy.options["errors"]).to_not be_nil
-              expect(policy.options["database"]).to_not be_nil
-
-              expect(policy.options["req_size"].enabled).to eq(true)
-              expect(policy.options["resp_size"].enabled).to eq(true)
-              expect(policy.options["resp_codes"].enabled).to eq(true)
-              expect(policy.options["ua"].enabled).to eq(false)
-              expect(policy.options["ua"].empty_enabled).to eq(false)
-              expect(policy.options["errors"].enabled).to eq(false)
-              expect(policy.options["errors"].csrf_exception_enabled).to eq(false)
-              expect(policy.options["errors"].sql_exception_enabled).to eq(false)
-              expect(policy.options["database"].enabled).to eq(false)
-
-              injections_matcher = policy.injections_reporter.injections_matcher
-              expect(injections_matcher).to_not be_nil
-              expect(injections_matcher.sensors.size).to eq(6)
-
-              sorted_sensors = injections_matcher.sensors.sort do
-                |a,b| a.detection_point <=> b.detection_point
-              end
-              expect(sorted_sensors[0].detection_point).to eq("cmdi")
-              expect(sorted_sensors[0].enabled).to eq(true)
-              expect(sorted_sensors[0].v1_compatability_enabled).to eq(true)
-              expect(sorted_sensors[1].detection_point).to eq("fpt")
-              expect(sorted_sensors[1].enabled).to eq(true)
-              expect(sorted_sensors[1].v1_compatability_enabled).to eq(true)
-              expect(sorted_sensors[2].detection_point).to eq("null")
-              expect(sorted_sensors[2].enabled).to eq(true)
-              expect(sorted_sensors[2].v1_compatability_enabled).to eq(true)
-              expect(sorted_sensors[3].detection_point).to eq("retr")
-              expect(sorted_sensors[3].enabled).to eq(true)
-              expect(sorted_sensors[3].v1_compatability_enabled).to eq(true)
-              expect(sorted_sensors[4].detection_point).to eq("sqli")
-              expect(sorted_sensors[4].enabled).to eq(true)
-              expect(sorted_sensors[4].v1_compatability_enabled).to eq(true)
-              expect(sorted_sensors[5].detection_point).to eq("xss")
-              expect(sorted_sensors[5].enabled).to eq(true)
-              expect(sorted_sensors[5].v1_compatability_enabled).to eq(true)
+              expect(policy.appfirewall_enabled).to eq(true)
+              expect(policy.appfirewall_ptr).to_not be_nil
             end
           end
         end
+      end
 
-        context "with v2 policy" do
-          context "that is missing a policy id" do
-            it "should raise an error" do
-              expect{
-                AppSensorPolicy.from_json({
-                  "version" => 2,
-                  "data" => { }
-                })
-              }.to raise_error(RuntimeError)
-            end
+      describe "#process_meta_event" do
+        context "with everything enabled policy" do
+          before(:each) do
+            @policy = AppSensorPolicy.from_json(everything_enabled_policy_json)
+            @appsensor_meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new(
+              "get",
+              "remote_address",
+              "route_id",
+              "session_id",
+              "user_id",
+              "transaction_id")
+            @appsensor_meta.user_agent = "Mozilla"
+            @appsensor_meta.response_code = 200
           end
 
-          context "that has no sensors" do
-            it "should have all sensors disabled" do
-              expect(AppSensorRuleManager).to_not receive(:instance)
+          context "csrf exception" do
+            context "nil csrf exception" do
+              it "should not send an event" do
+                expect(TCellAgent).to_not receive(:send_event)
 
-              policy_json_empty = {
-                "policy_id" => "01a1",
-                "version" => 2,
-                "data" => {
-                }
-              }
-
-              empty_policy = AppSensorPolicy.from_json(policy_json_empty)
-
-              expect(empty_policy.policy_id).to eq("01a1")
-              expect(empty_policy.enabled).to eq(false)
-              expect(empty_policy.injections_reporter.payloads_policy).to_not be_nil
-              expect(empty_policy.injections_reporter.payloads_policy.send_payloads).to eq(false)
-              expect(empty_policy.injections_reporter.payloads_policy.log_payloads).to eq(false)
-              expect(empty_policy.options["req_size"]).to be_nil
-              expect(empty_policy.options["resp_size"]).to be_nil
-              expect(empty_policy.options["resp_codes"]).to be_nil
-              expect(empty_policy.options["ua"]).to be_nil
-              expect(empty_policy.options["errors"]).to be_nil
-              expect(empty_policy.options["database"]).to be_nil
-
-              injections_matcher = empty_policy.injections_reporter.injections_matcher
-              expect(injections_matcher).to_not be_nil
-              expect(injections_matcher.sensors.size).to eq(0)
+                @appsensor_meta.csrf_exception_name = nil
+                @policy.process_meta_event(
+                  @appsensor_meta
+                )
+              end
             end
-          end
 
-          context "that has empty sensors" do
-            it "should have all sensors disabled" do
-              expect(AppSensorRuleManager).to_not receive(:instance)
+            context "empty csrf exception" do
+              it "should not send an event" do
+                expect(TCellAgent).to_not receive(:send_event)
 
-              policy_json_empty = {
-                "policy_id" => "01a1",
-                "version" => 2,
-                "data" => {
-                  "sensors" => {}
-                }
-              }
+                @appsensor_meta.csrf_exception_name = ""
+                @policy.process_meta_event(
+                  @appsensor_meta
+                )
+              end
+            end
 
-              empty_policy = AppSensorPolicy.from_json(policy_json_empty)
+            context "one csrf exception" do
+              it "should send a csrf exception event" do
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "as",
+                  "dp" => "excsrf",
+                  "param" => "ActionController::InvalidAuthenticityToken",
+                  "m" => "get",
+                  "rid" => "route_id",
+                  "uid" => "user_id",
+                  "sid" => "session_id",
+                  "remote_addr" => "remote_address"
+                })
 
-              expect(empty_policy.policy_id).to eq("01a1")
-              expect(empty_policy.enabled).to eq(false)
-              expect(empty_policy.injections_reporter.payloads_policy).to_not be_nil
-              expect(empty_policy.injections_reporter.payloads_policy.send_payloads).to eq(false)
-              expect(empty_policy.injections_reporter.payloads_policy.log_payloads).to eq(false)
-              expect(empty_policy.options["req_size"]).to be_nil
-              expect(empty_policy.options["resp_size"]).to be_nil
-              expect(empty_policy.options["resp_codes"]).to be_nil
-              expect(empty_policy.options["ua"]).to be_nil
-              expect(empty_policy.options["errors"]).to be_nil
-              expect(empty_policy.options["database"]).to be_nil
-
-              injections_matcher = empty_policy.injections_reporter.injections_matcher
-              expect(injections_matcher).to_not be_nil
-              expect(injections_matcher.sensors.size).to eq(0)
+                @appsensor_meta.csrf_exception_name = "ActionController::InvalidAuthenticityToken"
+                @policy.process_meta_event(
+                  @appsensor_meta
+                )
+              end
             end
           end
 
-          context "that only has null enabled" do
-            it "should only have null enabled" do
-              expect(AppSensorRuleManager).to receive(:instance)
+          context "sql exception" do
+            context "empty sql exceptions" do
+              it "should not send an event" do
+                expect(TCellAgent).to_not receive(:send_event)
 
-              policy_json = {
-                "policy_id" => "01a1",
-                "version" => 2,
-                "data" => {
-                  "sensors" => {
-                    "nullbyte" => {
-                       "patterns" => ["1","2"]
-                    }
-                  }
-                }
-              }
+                @appsensor_meta.sql_exceptions = []
+                @policy.process_meta_event(
+                  @appsensor_meta
+                )
+              end
+            end
 
-              policy = AppSensorPolicy.from_json(policy_json)
+            context "one sql exception" do
+              it "should send one event" do
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "as",
+                  "dp" => "exsql",
+                  "param" => "ActiveRecord::StatementInvalid",
+                  "m" => "get",
+                  "rid" => "route_id",
+                  "uid" => "user_id",
+                  "sid" => "session_id",
+                  "remote_addr" => "remote_address",
+                  "payload" => "exception message goes here"
+                })
 
-              expect(policy.policy_id).to eq("01a1")
-              expect(policy.injections_reporter.payloads_policy).to_not be_nil
-              expect(policy.injections_reporter.payloads_policy.send_payloads).to eq(false)
-              expect(policy.injections_reporter.payloads_policy.log_payloads).to eq(false)
-              expect(policy.options["req_size"]).to_not be_nil
-              expect(policy.options["resp_size"]).to_not be_nil
-              expect(policy.options["resp_codes"]).to_not be_nil
-
-              expect(policy.options["ua"]).to_not be_nil
-              expect(policy.options["errors"]).to_not be_nil
-              expect(policy.options["database"]).to_not be_nil
-
-              expect(policy.options["req_size"].enabled).to eq(false)
-              expect(policy.options["resp_size"].enabled).to eq(false)
-              expect(policy.options["resp_codes"].enabled).to eq(false)
-              expect(policy.options["ua"].enabled).to eq(false)
-              expect(policy.options["ua"].empty_enabled).to eq(false)
-              expect(policy.options["errors"].enabled).to eq(false)
-              expect(policy.options["errors"].csrf_exception_enabled).to eq(false)
-              expect(policy.options["errors"].sql_exception_enabled).to eq(false)
-              expect(policy.options["database"].enabled).to eq(false)
-
-              injections_matcher = policy.injections_reporter.injections_matcher
-              expect(injections_matcher).to_not be_nil
-              expect(injections_matcher.sensors.size).to eq(1)
-              expect(injections_matcher.sensors[0].detection_point).to eq("null")
-              expect(injections_matcher.sensors[0].enabled).to eq(true)
-              expect(injections_matcher.sensors[0].v1_compatability_enabled).to eq(false)
+                @appsensor_meta.sql_exceptions = [{
+                  "exception_name" => "ActiveRecord::StatementInvalid",
+                  "exception_payload" => "exception message goes here"
+                }]
+                @policy.process_meta_event(
+                  @appsensor_meta
+                )
+              end
             end
-          end
 
-          context "that only has xss enabled" do
-            it "should only have xss enabled" do
-              expect(AppSensorRuleManager).to receive(:instance)
+            context "multiple sql exception" do
+              it "should send multiple event" do
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "as",
+                  "dp" => "exsql",
+                  "param" => "ActiveRecord::StatementInvalid",
+                  "m" => "get",
+                  "rid" => "route_id",
+                  "uid" => "user_id",
+                  "sid" => "session_id",
+                  "remote_addr" => "remote_address",
+                  "payload" => "exception message goes here"
+                })
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "as",
+                  "dp" => "exsql",
+                  "param" => "ActiveRecord::StatementInvalid",
+                  "m" => "get",
+                  "rid" => "route_id",
+                  "uid" => "user_id",
+                  "sid" => "session_id",
+                  "remote_addr" => "remote_address",
+                  "payload" => "second exception message goes here"
+                })
 
-              policy_json = {
-                "policy_id" => "01a1",
-                "version" => 2,
-                "data" => {
-                  "sensors" => {
-                    "xss" => {
-                      "libinjection" => true,
-                      "patterns" => ["1","2","8"],
-                      "exclusions" => {
-                          "bob" => ["*"]
-                      }
-                    }
+                @appsensor_meta.sql_exceptions = [
+                  {
+                    "exception_name" => "ActiveRecord::StatementInvalid",
+                    "exception_payload" => "exception message goes here"
+                  },
+                  {
+                    "exception_name" => "ActiveRecord::StatementInvalid",
+                    "exception_payload" => "second exception message goes here"
                   }
-                }
-              }
+                ]
+                @policy.process_meta_event(
+                  @appsensor_meta
+                )
+              end
+            end
+          end
 
-              policy = AppSensorPolicy.from_json(policy_json)
+          context "db max result" do
+            context "nil db max result" do
+              it "should not send an event" do
+                expect(TCellAgent).to_not receive(:send_event)
 
-              expect(policy.policy_id).to eq("01a1")
-              expect(policy.injections_reporter.payloads_policy).to_not be_nil
-              expect(policy.injections_reporter.payloads_policy.send_payloads).to eq(false)
-              expect(policy.injections_reporter.payloads_policy.log_payloads).to eq(false)
-              expect(policy.options["req_size"]).to_not be_nil
-              expect(policy.options["resp_size"]).to_not be_nil
-              expect(policy.options["resp_codes"]).to_not be_nil
-              expect(policy.options["ua"]).to_not be_nil
-              expect(policy.options["errors"]).to_not be_nil
-              expect(policy.options["database"]).to_not be_nil
-
-              expect(policy.options["req_size"].enabled).to eq(false)
-              expect(policy.options["resp_size"].enabled).to eq(false)
-              expect(policy.options["resp_codes"].enabled).to eq(false)
-              expect(policy.options["ua"].enabled).to eq(false)
-              expect(policy.options["ua"].empty_enabled).to eq(false)
-              expect(policy.options["errors"].enabled).to eq(false)
-              expect(policy.options["errors"].csrf_exception_enabled).to eq(false)
-              expect(policy.options["errors"].sql_exception_enabled).to eq(false)
-              expect(policy.options["database"].enabled).to eq(false)
-
-              injections_matcher = policy.injections_reporter.injections_matcher
-              expect(injections_matcher).to_not be_nil
-              expect(injections_matcher.sensors.size).to eq(1)
-              expect(injections_matcher.sensors[0].detection_point).to eq("xss")
-              expect(injections_matcher.sensors[0].enabled).to eq(true)
-              expect(injections_matcher.sensors[0].v1_compatability_enabled).to eq(false)
+                @appsensor_meta.database_result_sizes = nil
+                @policy.process_meta_event(
+                  @appsensor_meta
+                )
+              end
             end
-          end
 
-          context "that has everything enabled" do
-            it "should have all sensors enabled" do
-              expect(AppSensorRuleManager).to receive(:instance).exactly(6).times
+            context "empty db max result" do
+              it "should not send an event" do
+                expect(TCellAgent).to_not receive(:send_event)
 
-              policy_json = {
-                "policy_id" => "01a1",
-                "version" => 2,
-                "data" => {
-                  "options" => {
-                    "uri_options" => {
-                      "collect_full_uri" => true
-                    },
-                    "payloads" => {
-                      "send_payloads" => true,
-                      "send_blacklist" => {
-                          "JSESSIONID" => ["cookie"],
-                          "ssn" => ["*"],
-                          "password" => ["*"]
-                      },
-                      "send_whitelist" => {},
-                      "log_payloads" => true,
-                      "log_blacklist" => {},
-                      "log_whitelist" => {
-                          "username" => ["*"]
-                      }
-                    }
-                  },
-                  "sensors" => {
-                    "req_size" => {
-                        "limit" => 1024,
-                        "exclude_routes" => ["2300"]
-                    },
-                    "resp_size" => {
-                        "limit" => 2048,
-                        "exclude_routes" => ["2323"]
-                    },
-                    "resp_codes" => {
-                        "series_400_enabled" => true,
-                        "series_500_enabled" => true
-                    },
-                    "xss" => {
-                        "libinjection" => true,
-                        "patterns" => ["1","2","8"],
-                        "exclusions" => {
-                            "bob" => ["*"]
-                        }
-                    },
-                    "sqli" => {
-                        "libinjection" => true,
-                        "exclude_headers" => true,
-                        "patterns" => ["1"]
-                    },
-                    "fpt" => {
-                        "patterns" => ["1","2"],
-                        "exclude_forms" => true,
-                        "exclude_cookies" => true,
-                        "exclusions" => {
-                            "somethingcommon" => ["form"]
-                        }
-                    },
-                    "cmdi" => {
-                         "patterns" => ["1","2"]
-                    },
-                    "nullbyte" => {
-                         "patterns" => ["1","2"]
-                    },
-                    "retr" => {
-                         "patterns" => ["1","2"]
-                    },
-                    "ua" => {
-                      "empty_enabled" => true,
-                    },
-                    "errors" => {
-                      "csrf_exception_enabled" => true,
-                      "sql_exception_enabled" => true
-                    },
-                    "database" => {
-                      "large_result" => {
-                        "limit" => 10
-                      }
-                    }
-                  }
-                }
-              }
+                @appsensor_meta.database_result_sizes = []
+                @policy.process_meta_event(
+                  @appsensor_meta
+                )
+              end
+            end
 
-              policy = AppSensorPolicy.from_json(policy_json)
+            context "one db max result" do
+              it "should send one event" do
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "as",
+                  "dp" => "dbmaxrows",
+                  "m" => "get",
+                  "meta" => {"rows"=>1001},
+                  "rid" => "route_id",
+                  "uid" => "user_id",
+                  "sid" => "session_id",
+                  "remote_addr" => "remote_address"
+                })
 
-              expect(policy.policy_id).to eq("01a1")
-              expect(policy.injections_reporter.payloads_policy).to_not be_nil
-              expect(policy.options["req_size"]).to_not be_nil
-              expect(policy.options["resp_size"]).to_not be_nil
-              expect(policy.options["resp_codes"]).to_not be_nil
-
-              expect(policy.options["ua"]).to_not be_nil
-              expect(policy.options["errors"]).to_not be_nil
-              expect(policy.options["database"]).to_not be_nil
-
-              expect(policy.options["req_size"].enabled).to eq(true)
-              expect(policy.options["req_size"].collect_full_uri).to eq(true)
-              expect(policy.options["resp_size"].enabled).to eq(true)
-              expect(policy.options["resp_size"].collect_full_uri).to eq(true)
-              expect(policy.options["resp_codes"].enabled).to eq(true)
-              expect(policy.options["resp_codes"].collect_full_uri).to eq(true)
-              expect(policy.options["ua"].enabled).to eq(true)
-              expect(policy.options["ua"].empty_enabled).to eq(true)
-              expect(policy.options["ua"].collect_full_uri).to eq(true)
-              expect(policy.options["errors"].enabled).to eq(true)
-              expect(policy.options["errors"].csrf_exception_enabled).to eq(true)
-              expect(policy.options["errors"].sql_exception_enabled).to eq(true)
-              expect(policy.options["errors"].collect_full_uri).to eq(true)
-              expect(policy.options["database"].enabled).to eq(true)
-              expect(policy.options["database"].max_rows).to eq(10)
-              expect(policy.options["database"].collect_full_uri).to eq(true)
-
-              expect(policy.injections_reporter.collect_full_uri).to eq(true)
-              expect(policy.injections_reporter.payloads_policy.send_payloads).to eq(true)
-              expect(policy.injections_reporter.payloads_policy.send_blacklist).to eq({
-                "jsessionid" => Set.new(["cookie"]),
-                "ssn" => Set.new(["*"]),
-                "password" => Set.new(["*"])
-              })
-              expect(policy.injections_reporter.payloads_policy.use_send_whitelist).to eq(true)
-              expect(policy.injections_reporter.payloads_policy.send_whitelist).to eq({})
-              expect(policy.injections_reporter.payloads_policy.log_payloads).to eq(true)
-              expect(policy.injections_reporter.payloads_policy.log_blacklist).to eq({})
-              expect(policy.injections_reporter.payloads_policy.use_log_whitelist).to eq(true)
-              expect(policy.injections_reporter.payloads_policy.log_whitelist).to eq({
-                "username" => Set.new(["*"]),
-              })
-              expect(policy.injections_reporter.payloads_policy.collect_full_uri).to eq(true)
+                @appsensor_meta.database_result_sizes = [1001]
+                @policy.process_meta_event(
+                  @appsensor_meta
+                )
+              end
+            end
 
-              injections_matcher = policy.injections_reporter.injections_matcher
-              sorted_sensors = injections_matcher.sensors.sort do
-                |a,b| a.detection_point <=> b.detection_point
+            context "multiple db max results" do
+              it "should send multiple event" do
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "as",
+                  "dp" => "dbmaxrows",
+                  "m" => "get",
+                  "meta" => {"rows"=>1001},
+                  "rid" => "route_id",
+                  "uid" => "user_id",
+                  "sid" => "session_id",
+                  "remote_addr" => "remote_address"
+                })
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "as",
+                  "dp" => "dbmaxrows",
+                  "m" => "get",
+                  "meta" => {"rows"=>1002},
+                  "rid" => "route_id",
+                  "uid" => "user_id",
+                  "sid" => "session_id",
+                  "remote_addr" => "remote_address"
+                })
+
+                @appsensor_meta.database_result_sizes = [1001, 1002]
+                @policy.process_meta_event(
+                  @appsensor_meta
+                )
               end
-              expect(sorted_sensors[0].detection_point).to eq("cmdi")
-              expect(sorted_sensors[0].enabled).to eq(true)
-              expect(sorted_sensors[0].v1_compatability_enabled).to eq(false)
-              expect(sorted_sensors[1].detection_point).to eq("fpt")
-              expect(sorted_sensors[1].enabled).to eq(true)
-              expect(sorted_sensors[1].v1_compatability_enabled).to eq(false)
-              expect(sorted_sensors[2].detection_point).to eq("null")
-              expect(sorted_sensors[2].enabled).to eq(true)
-              expect(sorted_sensors[2].v1_compatability_enabled).to eq(false)
-              expect(sorted_sensors[3].detection_point).to eq("retr")
-              expect(sorted_sensors[3].enabled).to eq(true)
-              expect(sorted_sensors[3].v1_compatability_enabled).to eq(false)
-              expect(sorted_sensors[4].detection_point).to eq("sqli")
-              expect(sorted_sensors[4].enabled).to eq(true)
-              expect(sorted_sensors[4].v1_compatability_enabled).to eq(false)
-              expect(sorted_sensors[5].detection_point).to eq("xss")
-              expect(sorted_sensors[5].enabled).to eq(true)
-              expect(sorted_sensors[5].v1_compatability_enabled).to eq(false)
             end
           end
-
         end
       end
     end