tcell_agent 1.0.0 → 1.1.0

data/spec/lib/tcell_agent/cmdi_spec.rb

@@ -151,6 +151,27 @@ module TCellAgent
 
   describe IO do
     describe '.popen' do
+      before(:each) do
+        configuration = double(
+          'configuration',
+          {
+            'app_id' => 'app_id',
+            'api_key' => 'api_key',
+            'allow_payloads' => true,
+            'js_agent_api_base_url' => 'http://api.tcell.com/',
+            'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
+            'max_csp_header_bytes' => nil,
+            'event_time_limit_seconds' => 15,
+            'event_batch_size_limit' => 50,
+            'preload_policy_filename' => nil,
+            'cache_filename_with_app_id' => '/tcellagent_src/tcell/cache/tcell_agent.cache',
+            'agent_home_owner' => nil
+          }
+        )
+        expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+        @rust_policies = TCellAgent::Policies::RustPolicies.new
+      end
+
       context 'empty command' do
         it 'should raise an error' do
           expect do
@@ -194,14 +215,13 @@ module TCellAgent
 
         context 'with command injection disabled' do
           it 'should execute the command' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-            expect(rust_policies.cmdi_enabled).to eq(false)
+            expect(@rust_policies.cmdi_enabled).to eq(false)
 
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_call_original
-            expect(rust_policies).to_not receive(:block_command?)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_call_original
+            expect(@rust_policies).to_not receive(:block_command?)
 
             IO.popen('echo test')
           end
@@ -209,13 +229,11 @@ module TCellAgent
 
         context 'with command injection enabled' do
           it 'should execute the command' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_command?).with('echo test', nil).and_return(false)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(false)
 
             IO.popen('echo test')
           end
@@ -225,13 +243,11 @@ module TCellAgent
       context 'with a blocked command present' do
         context 'with command injection enabled' do
           it 'should raise a Errno::ENOENT' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
 
             expect do
               IO.popen('echo test')
@@ -376,6 +392,27 @@ module TCellAgent
   end
 
   describe Kernel do
+    before(:each) do
+      configuration = double(
+        'configuration',
+        {
+          'app_id' => 'app_id',
+          'api_key' => 'api_key',
+          'allow_payloads' => true,
+          'js_agent_api_base_url' => 'http://api.tcell.com/',
+          'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
+          'max_csp_header_bytes' => nil,
+          'event_time_limit_seconds' => 15,
+          'event_batch_size_limit' => 50,
+          'preload_policy_filename' => nil,
+          'cache_filename_with_app_id' => '/tcellagent_src/tcell/cache/tcell_agent.cache',
+          'agent_home_owner' => nil
+        }
+      )
+      expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+      @rust_policies = TCellAgent::Policies::RustPolicies.new
+    end
+
     describe '.backtick' do
       context 'empty command' do
         it 'should raise Errno::ENOENT' do
@@ -400,13 +437,11 @@ module TCellAgent
 
         context 'with command injection disabled' do
           it 'should execute the command' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(false)
-            expect(rust_policies).to_not receive(:block_command?)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(false)
+            expect(@rust_policies).to_not receive(:block_command?)
 
             `echo test`
           end
@@ -414,13 +449,11 @@ module TCellAgent
 
         context 'with command injection enabled' do
           it 'should execute the command' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_command?).with('echo test', nil).and_return(false)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(false)
 
             `echo test`
           end
@@ -430,13 +463,11 @@ module TCellAgent
       context 'with a blocked command present' do
         context 'with command injection enabled' do
           it 'should raise a Errno::ENOENT' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
 
             expect do
               `echo test`
@@ -470,13 +501,11 @@ module TCellAgent
 
         context 'with command injection disabled' do
           it 'should execute the command' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(false)
-            expect(rust_policies).to_not receive(:block_command?)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(false)
+            expect(@rust_policies).to_not receive(:block_command?)
 
             `echo test`
           end
@@ -484,13 +513,11 @@ module TCellAgent
 
         context 'with command injection enabled' do
           it 'should execute the command' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_command?).with('echo test', nil).and_return(false)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(false)
 
             `echo test`
           end
@@ -500,13 +527,11 @@ module TCellAgent
       context 'with a blocked command present' do
         context 'with command injection enabled' do
           it 'should raise a Errno::ENOENT' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
 
             expect do
               `echo test`
@@ -561,13 +586,11 @@ module TCellAgent
 
         context 'with command injection disabled' do
           it 'should execute the command' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(false)
-            expect(rust_policies).to_not receive(:block_command?)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(false)
+            expect(@rust_policies).to_not receive(:block_command?)
 
             system('echo test > /dev/null 2>&1')
           end
@@ -575,13 +598,11 @@ module TCellAgent
 
         context 'with command injection enabled' do
           it 'should execute the command' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_command?).with('echo test > /dev/null 2>&1', nil).and_return(false)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_command?).with('echo test > /dev/null 2>&1', nil).and_return(false)
 
             system('echo test > /dev/null 2>&1')
           end
@@ -591,13 +612,11 @@ module TCellAgent
       context 'with a blocked command present' do
         context 'with command injection enabled' do
           it 'should raise a Errno::ENOENT' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
 
             expect do
               system('echo test')
@@ -655,13 +674,11 @@ module TCellAgent
 
         context 'with command injection disabled' do
           it 'should execute the command' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(false)
-            expect(rust_policies).to_not receive(:block_command?)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(false)
+            expect(@rust_policies).to_not receive(:block_command?)
 
             spawn('echo test > /dev/null 2>&1')
           end
@@ -669,13 +686,11 @@ module TCellAgent
 
         context 'with command injection enabled' do
           it 'should execute the command' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_command?).with('echo test > /dev/null 2>&1', nil).and_return(false)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_command?).with('echo test > /dev/null 2>&1', nil).and_return(false)
 
             spawn('echo test > /dev/null 2>&1')
           end
@@ -685,13 +700,11 @@ module TCellAgent
       context 'with a blocked command present' do
         context 'with command injection enabled' do
           it 'should raise a Errno::ENOENT' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
 
             expect do
               spawn('echo test')
@@ -706,13 +719,11 @@ module TCellAgent
       context 'with a blocked command present' do
         context 'with command injection enabled' do
           it 'should raise a Errno::ENOENT' do
-            rust_policies = TCellAgent::Policies::RustPolicies.new
-
             expect(TCellAgent).to receive(:policy).with(
               TCellAgent::PolicyTypes::Rust
-            ).and_return(rust_policies)
-            expect(rust_policies).to receive(:cmdi_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
+            ).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:cmdi_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_command?).with('echo test', nil).and_return(true)
 
             expect do
               exec('echo test')

data/spec/lib/tcell_agent/instrumentation_spec.rb

@@ -8,6 +8,26 @@ end
 module TCellAgent
   module Instrumentation
     describe Instrumentation do
+      before(:each) do
+        configuration = double(
+          'configuration',
+          {
+            'app_id' => 'app_id',
+            'api_key' => 'api_key',
+            'allow_payloads' => true,
+            'js_agent_api_base_url' => 'http://api.tcell.com/',
+            'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
+            'max_csp_header_bytes' => nil,
+            'event_time_limit_seconds' => 15,
+            'event_batch_size_limit' => 50,
+            'preload_policy_filename' => nil,
+            'cache_filename_with_app_id' => '/tcellagent_src/tcell/cache/tcell_agent.cache',
+            'agent_home_owner' => nil
+          }
+        )
+        expect(TCellAgent).to receive(:configuration).and_return(configuration).at_most(10)
+      end
+
       context 'Body - SessionId Filters' do
         it 'Tests Redaction and Events in Body' do
           action = TCellAgent::Policies::DataLossPolicy::FilterActions.new

data/spec/lib/tcell_agent/patches_spec.rb

@@ -3,13 +3,35 @@ require 'spec_helper'
 module TCellAgent
   module Instrumentation
     describe '.block?' do
+      before(:each) do
+        configuration = double(
+          'configuration',
+          {
+            'app_id' => 'app_id',
+            'api_key' => 'api_key',
+            'allow_payloads' => true,
+            'js_agent_api_base_url' => 'http://api.tcell.com/',
+            'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
+            'max_csp_header_bytes' => nil
+          }
+        )
+        expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+        @rust_policies = TCellAgent::Policies::RustPolicies.new
+      end
+
       context 'with an unexpected error' do
         it 'should return false' do
+          logger = double('logger')
           request = double('request')
           expect(TCellAgent).to receive(:policy).with(
             TCellAgent::PolicyTypes::Rust
           ).and_raise(StandardError.new('UNEXPECTED'))
           expect(TCellAgent::Patches::MetaData).to_not receive(:build)
+          expect(TCellAgent).to receive(:logger).and_return(logger).twice
+          expect(logger).to receive(:debug).with(
+            'Exception in safe_block Checking patches blocking: StandardError happened, message is UNEXPECTED'
+          )
+          expect(logger).to receive(:debug) # exception stack trace
 
           expect(Patches.block?(request)).to eq(false)
         end
@@ -28,10 +50,9 @@ module TCellAgent
       context 'with a disabled patches policy' do
         it 'should return false' do
           request = double('request')
-          rust_policies = TCellAgent::Policies::RustPolicies.new
-          expect(rust_policies.patches_enabled).to eq(false)
+          expect(@rust_policies.patches_enabled).to eq(false)
 
-          expect(TCellAgent).to receive(:policy).and_return(rust_policies)
+          expect(TCellAgent).to receive(:policy).and_return(@rust_policies)
           expect(TCellAgent::Patches::MetaData).to_not receive(:build)
 
           expect(Patches.block?(request)).to eq(false)
@@ -42,12 +63,11 @@ module TCellAgent
         it 'should return false' do
           request = double('request')
           meta_data = double('meta_data')
-          rust_policies = TCellAgent::Policies::RustPolicies.new
           tcell_context = TCellAgent::Instrumentation::TCellData.new
 
-          expect(TCellAgent).to receive(:policy).and_return(rust_policies)
-          expect(rust_policies).to receive(:patches_enabled).and_return(true)
-          expect(rust_policies).to receive(:block_request?).and_return(false)
+          expect(TCellAgent).to receive(:policy).and_return(@rust_policies)
+          expect(@rust_policies).to receive(:patches_enabled).and_return(true)
+          expect(@rust_policies).to receive(:block_request?).and_return(false)
           expect(request).to receive(:env).and_return(
             {
               TCellAgent::Instrumentation::TCELL_ID => tcell_context
@@ -67,12 +87,11 @@ module TCellAgent
           request = double('request')
           meta_data = double('meta_data')
           tcell_context = TCellAgent::Instrumentation::TCellData.new
-          rust_policies = TCellAgent::Policies::RustPolicies.new
           expect(tcell_context.patches_blocking_triggered).to eq(false)
 
-          expect(TCellAgent).to receive(:policy).and_return(rust_policies)
-          expect(rust_policies).to receive(:patches_enabled).and_return(true)
-          expect(rust_policies).to receive(:block_request?).and_return(true)
+          expect(TCellAgent).to receive(:policy).and_return(@rust_policies)
+          expect(@rust_policies).to receive(:patches_enabled).and_return(true)
+          expect(@rust_policies).to receive(:block_request?).and_return(true)
           expect(TCellAgent::Patches::MetaData).to receive(:build).and_return(
             meta_data
           )
@@ -97,13 +116,12 @@ module TCellAgent
             )
             meta_data.get_dict = { 'paramater' => '<script>' }
             tcell_context = TCellAgent::Instrumentation::TCellData.new
-            rust_policies = TCellAgent::Policies::RustPolicies.new
 
             expect(tcell_context.patches_blocking_triggered).to eq(false)
 
-            expect(TCellAgent).to receive(:policy).and_return(rust_policies)
-            expect(rust_policies).to receive(:patches_enabled).and_return(true)
-            expect(rust_policies).to receive(:block_request?).and_return(true)
+            expect(TCellAgent).to receive(:policy).and_return(@rust_policies)
+            expect(@rust_policies).to receive(:patches_enabled).and_return(true)
+            expect(@rust_policies).to receive(:block_request?).and_return(true)
             expect(TCellAgent::Patches::MetaData).to receive(:build).and_return(
               meta_data
             )

data/spec/lib/tcell_agent/policies/appsensor_policy_spec.rb

@@ -109,6 +109,18 @@ module TCellAgent
 
       describe '#update_policies' do
         before(:each) do
+          configuration = double(
+            'configuration',
+            {
+              'app_id' => 'app_id',
+              'api_key' => 'api_key',
+              'allow_payloads' => true,
+              'js_agent_api_base_url' => 'http://api.tcell.com/',
+              'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
+              'max_csp_header_bytes' => nil
+            }
+          )
+          expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
           @rust_policies = RustPolicies.new
         end
 
@@ -122,12 +134,14 @@ module TCellAgent
                 'Error updating policies: Failed to decode appsensor policy: missing field `policy_id`'
               )
 
-              @rust_policies.update_policies({
-                                               'appsensor' => {
-                                                 'version' => 2,
-                                                 'data' => {}
-                                               }
-                                             })
+              @rust_policies.update_policies(
+                {
+                  'appsensor' => {
+                    'version' => 2,
+                    'data' => {}
+                  }
+                }
+              )
 
               expect(@rust_policies.appfirewall_enabled).to eq(false)
             end
@@ -142,12 +156,14 @@ module TCellAgent
                 'Error updating policies: Failed to decode appsensor policy: missing field `version`'
               )
 
-              @rust_policies.update_policies({
-                                               'appsensor' => {
-                                                 'policy_id' => '01a1',
-                                                 'data' => {}
-                                               }
-                                             })
+              @rust_policies.update_policies(
+                {
+                  'appsensor' => {
+                    'policy_id' => '01a1',
+                    'data' => {}
+                  }
+                }
+              )
 
               expect(@rust_policies.appfirewall_enabled).to eq(false)
             end
@@ -235,6 +251,19 @@ module TCellAgent
       describe '#check_appfirewall_injections' do
         context 'with everything enabled policy' do
           before(:each) do
+            configuration = double(
+              'configuration',
+              {
+                'enabled' => true,
+                'app_id' => 'app_id',
+                'api_key' => 'api_key',
+                'allow_payloads' => true,
+                'js_agent_api_base_url' => 'http://api.tcell.com/',
+                'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
+                'max_csp_header_bytes' => nil
+              }
+            )
+            expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
             @rust_policies = RustPolicies.new
             @rust_policies.update_policies(everything_enabled_policy_json)
             @appsensor_meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new(
@@ -275,18 +304,20 @@ module TCellAgent
 
             context 'one csrf exception' do
               it 'should send a csrf exception event' do
-                expect(TCellAgent).to receive(:send_event).with({
-                                                                  'event_type' => 'as',
-                                                                  'dp' => 'excsrf',
-                                                                  'param' => 'ActionController::InvalidAuthenticityToken',
-                                                                  'm' => 'GET',
-                                                                  'rid' => '12345',
-                                                                  'full_uri' => 'http://test.com/?some_param=present',
-                                                                  'uri' => 'http://test.com/?some_param=',
-                                                                  'uid' => 'user_id',
-                                                                  'sid' => 'session_id',
-                                                                  'remote_addr' => '192.168.1.1'
-                                                                })
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'as',
+                    'dp' => 'excsrf',
+                    'param' => 'ActionController::InvalidAuthenticityToken',
+                    'm' => 'GET',
+                    'rid' => '12345',
+                    'full_uri' => 'http://test.com/?some_param=present',
+                    'uri' => 'http://test.com/?some_param=',
+                    'uid' => 'user_id',
+                    'sid' => 'session_id',
+                    'remote_addr' => '192.168.1.1'
+                  }
+                )
 
                 @appsensor_meta.csrf_exception_name = 'ActionController::InvalidAuthenticityToken'
                 @rust_policies.check_appfirewall_injections(
@@ -310,19 +341,25 @@ module TCellAgent
 
             context 'one sql exception' do
               it 'should send one event' do
-                expect(TCellAgent).to receive(:send_event).with({
-                                                                  'event_type' => 'as',
-                                                                  'dp' => 'exsql',
-                                                                  'param' => 'ActiveRecord::StatementInvalid',
-                                                                  'm' => 'GET',
-                                                                  'rid' => '12345',
-                                                                  'full_uri' => 'http://test.com/?some_param=present',
-                                                                  'uri' => 'http://test.com/?some_param=',
-                                                                  'uid' => 'user_id',
-                                                                  'sid' => 'session_id',
-                                                                  'remote_addr' => '192.168.1.1',
-                                                                  'payload' => 'exception message goes here'
-                                                                })
+                logger = double('logger')
+
+                expect(TCellAgent).to receive(:logger).and_return(logger)
+                expect(logger).to receive(:info)
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'as',
+                    'dp' => 'exsql',
+                    'param' => 'ActiveRecord::StatementInvalid',
+                    'm' => 'GET',
+                    'rid' => '12345',
+                    'full_uri' => 'http://test.com/?some_param=present',
+                    'uri' => 'http://test.com/?some_param=',
+                    'uid' => 'user_id',
+                    'sid' => 'session_id',
+                    'remote_addr' => '192.168.1.1',
+                    'payload' => 'exception message goes here'
+                  }
+                )
 
                 @appsensor_meta.sql_exceptions = [{
                   'exception_name' => 'ActiveRecord::StatementInvalid',
@@ -336,32 +373,40 @@ module TCellAgent
 
             context 'multiple sql exception' do
               it 'should send multiple event' do
-                expect(TCellAgent).to receive(:send_event).with({
-                                                                  'event_type' => 'as',
-                                                                  'dp' => 'exsql',
-                                                                  'param' => 'ActiveRecord::StatementInvalid',
-                                                                  'm' => 'GET',
-                                                                  'rid' => '12345',
-                                                                  'full_uri' => 'http://test.com/?some_param=present',
-                                                                  'uri' => 'http://test.com/?some_param=',
-                                                                  'uid' => 'user_id',
-                                                                  'sid' => 'session_id',
-                                                                  'remote_addr' => '192.168.1.1',
-                                                                  'payload' => 'exception message goes here'
-                                                                })
-                expect(TCellAgent).to receive(:send_event).with({
-                                                                  'event_type' => 'as',
-                                                                  'dp' => 'exsql',
-                                                                  'param' => 'ActiveRecord::StatementInvalid',
-                                                                  'm' => 'GET',
-                                                                  'rid' => '12345',
-                                                                  'full_uri' => 'http://test.com/?some_param=present',
-                                                                  'uri' => 'http://test.com/?some_param=',
-                                                                  'uid' => 'user_id',
-                                                                  'sid' => 'session_id',
-                                                                  'remote_addr' => '192.168.1.1',
-                                                                  'payload' => 'second exception message goes here'
-                                                                })
+                logger = double('logger')
+
+                expect(TCellAgent).to receive(:logger).and_return(logger).twice
+                expect(logger).to receive(:info).twice
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'as',
+                    'dp' => 'exsql',
+                    'param' => 'ActiveRecord::StatementInvalid',
+                    'm' => 'GET',
+                    'rid' => '12345',
+                    'full_uri' => 'http://test.com/?some_param=present',
+                    'uri' => 'http://test.com/?some_param=',
+                    'uid' => 'user_id',
+                    'sid' => 'session_id',
+                    'remote_addr' => '192.168.1.1',
+                    'payload' => 'exception message goes here'
+                  }
+                )
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'as',
+                    'dp' => 'exsql',
+                    'param' => 'ActiveRecord::StatementInvalid',
+                    'm' => 'GET',
+                    'rid' => '12345',
+                    'full_uri' => 'http://test.com/?some_param=present',
+                    'uri' => 'http://test.com/?some_param=',
+                    'uid' => 'user_id',
+                    'sid' => 'session_id',
+                    'remote_addr' => '192.168.1.1',
+                    'payload' => 'second exception message goes here'
+                  }
+                )
 
                 @appsensor_meta.sql_exceptions = [
                   {
@@ -405,18 +450,20 @@ module TCellAgent
 
             context 'one db max result' do
               it 'should send one event' do
-                expect(TCellAgent).to receive(:send_event).with({
-                                                                  'event_type' => 'as',
-                                                                  'dp' => 'dbmaxrows',
-                                                                  'm' => 'GET',
-                                                                  'meta' => { 'rows' => 1001 },
-                                                                  'rid' => '12345',
-                                                                  'full_uri' => 'http://test.com/?some_param=present',
-                                                                  'uri' => 'http://test.com/?some_param=',
-                                                                  'uid' => 'user_id',
-                                                                  'sid' => 'session_id',
-                                                                  'remote_addr' => '192.168.1.1'
-                                                                })
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'as',
+                    'dp' => 'dbmaxrows',
+                    'm' => 'GET',
+                    'meta' => { 'rows' => 1001 },
+                    'rid' => '12345',
+                    'full_uri' => 'http://test.com/?some_param=present',
+                    'uri' => 'http://test.com/?some_param=',
+                    'uid' => 'user_id',
+                    'sid' => 'session_id',
+                    'remote_addr' => '192.168.1.1'
+                  }
+                )
 
                 @appsensor_meta.database_result_sizes = [1001]
                 @rust_policies.check_appfirewall_injections(
@@ -427,30 +474,34 @@ module TCellAgent
 
             context 'multiple db max results' do
               it 'should send multiple event' do
-                expect(TCellAgent).to receive(:send_event).with({
-                                                                  'event_type' => 'as',
-                                                                  'dp' => 'dbmaxrows',
-                                                                  'm' => 'GET',
-                                                                  'meta' => { 'rows' => 1001 },
-                                                                  'rid' => '12345',
-                                                                  'full_uri' => 'http://test.com/?some_param=present',
-                                                                  'uri' => 'http://test.com/?some_param=',
-                                                                  'uid' => 'user_id',
-                                                                  'sid' => 'session_id',
-                                                                  'remote_addr' => '192.168.1.1'
-                                                                })
-                expect(TCellAgent).to receive(:send_event).with({
-                                                                  'event_type' => 'as',
-                                                                  'dp' => 'dbmaxrows',
-                                                                  'm' => 'GET',
-                                                                  'meta' => { 'rows' => 1002 },
-                                                                  'rid' => '12345',
-                                                                  'full_uri' => 'http://test.com/?some_param=present',
-                                                                  'uri' => 'http://test.com/?some_param=',
-                                                                  'uid' => 'user_id',
-                                                                  'sid' => 'session_id',
-                                                                  'remote_addr' => '192.168.1.1'
-                                                                })
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'as',
+                    'dp' => 'dbmaxrows',
+                    'm' => 'GET',
+                    'meta' => { 'rows' => 1001 },
+                    'rid' => '12345',
+                    'full_uri' => 'http://test.com/?some_param=present',
+                    'uri' => 'http://test.com/?some_param=',
+                    'uid' => 'user_id',
+                    'sid' => 'session_id',
+                    'remote_addr' => '192.168.1.1'
+                  }
+                )
+                expect(TCellAgent).to receive(:send_event).with(
+                  {
+                    'event_type' => 'as',
+                    'dp' => 'dbmaxrows',
+                    'm' => 'GET',
+                    'meta' => { 'rows' => 1002 },
+                    'rid' => '12345',
+                    'full_uri' => 'http://test.com/?some_param=present',
+                    'uri' => 'http://test.com/?some_param=',
+                    'uid' => 'user_id',
+                    'sid' => 'session_id',
+                    'remote_addr' => '192.168.1.1'
+                  }
+                )
 
                 @appsensor_meta.database_result_sizes = [1001, 1002]
                 @rust_policies.check_appfirewall_injections(