tcell_agent 1.0.0 → 1.1.0

data/spec/lib/tcell_agent/policies/command_injection_policy_spec.rb

@@ -4,7 +4,19 @@ module TCellAgent
   module Policies
     describe RustPolicies do
       before(:each) do
-        allow(TCellAgent).to receive(:is_it_safe_to_send_cmdi_events?).and_return(true)
+        configuration = double(
+          'configuration',
+          {
+            'app_id' => 'app_id',
+            'api_key' => 'api_key',
+            'allow_payloads' => true,
+            'js_agent_api_base_url' => 'http://api.tcell.com/',
+            'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
+            'max_csp_header_bytes' => nil
+          }
+        )
+        expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
+        allow(TCellAgent).to receive(:safe_to_send_cmdi_events?).and_return(true)
         @rust_policies = RustPolicies.new
       end
 

data/spec/lib/tcell_agent/policies/patches_policy_spec.rb

@@ -4,6 +4,18 @@ module TCellAgent
   module Policies
     describe RustPolicies do
       before(:each) do
+        configuration = double(
+          'configuration',
+          {
+            'app_id' => 'app_id',
+            'api_key' => 'api_key',
+            'allow_payloads' => true,
+            'js_agent_api_base_url' => 'http://api.tcell.com/',
+            'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
+            'max_csp_header_bytes' => nil
+          }
+        )
+        expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
         @rust_policies = RustPolicies.new
       end
 

data/spec/lib/tcell_agent/rails/middleware/global_middleware_spec.rb

@@ -21,8 +21,6 @@ module TCellAgent
             if rack_request.params['rv']
               response_headers['Location'] = rack_request.params['rv']
             end
-            env['tcell.request_data'].transaction_id = 'a-b-c-d-e-f'
-            # env["tcell.request_data"].route_id = "x-b-c-d-e-f"
             [200, response_headers, ['OK']]
           end
 
@@ -157,7 +155,7 @@ module TCellAgent
                         {
                           'name' => 'Content-Security-Policy-Report-Only',
                           'value' => "script-src 'unsafe-inline'",
-                          'report-uri' => 'http://test.tcell.io/report'
+                          'report_uri' => 'http://test.tcell.io/report'
                         }
                       ]
                     }
@@ -170,46 +168,11 @@ module TCellAgent
                   'action_dispatch.request_id' => '35281717-247e-44e6-bd42-0fb1417e80d'
                 )
                 expect(response['Content-Security-Policy-Report-Only']).to eq(
-                  "script-src 'unsafe-inline'; report-uri http://test.tcell.io/report?tid=a-b-c-d-e-f&c=-654192056"
+                  "script-src 'unsafe-inline'; report-uri http://test.tcell.io/report"
                 )
               end
             end
           end
-
-          # context "when called with a POST request" do
-          #   context "with some particular data" do
-          #     let(:request) { Rack::MockRequest.new(app) }
-
-          #     it "passes the request through unchanged" do
-
-          #       TCellAgent.configuration = TCellAgent::Configuration.new
-          #       TCellAgent.configuration.read_config_from_file("spec/resources/normal_config.json")
-
-          #       agent = ::TCellAgent::Agent.new(Process.pid)
-          #       ::TCellAgent::AgentThread.setThread(agent)
-          #       agent.start
-          #       agent.processPolicyJson({"csp"=>{
-          #         "policy_id"=>"153ed270-7481-11e5-9194-95dad9b9dec3",
-          #         "headers"=>{
-          #           "name"=>"Content-Security-Policy-Report-Only",
-          #           "value"=>"script-src 'unsafe-inline'",
-          #           "report-uri"=>"http://test.tcell.io/report"
-          #         }
-          #       }})
-
-          #       #noop       = Proc.new {[200, {}, ["hello"]]}
-          #       #middleware = ActionDispatch::Static.new(noop, "/my_rails_app/public")
-          #       #request = Rack::MockRequest.new(middleware)
-          #       #puts request.get("/path_i_want_to_hit")
-
-          #       puts request.get("/some/path", 'CONTENT_TYPE' => 'text/plain')
-
-          #      # expect(app['CONTENT_TYPE']).to eq('text/plain')
-          #      # expect(app.request_body).to eq(post_data)
-
-          #     end
-          #   end
-          # end
         end
       end
     end

data/spec/lib/tcell_agent/rails/middleware/tcell_body_proxy_spec.rb

@@ -127,7 +127,9 @@ module TCellAgent
                   expect(TCellAgent::Instrumentation).to receive(:safe_block).with(
                     'Processing tcell body proxy body'
                   ).and_call_original
-                  expect(js_agent_insertion_proc).to receive(:call).with('script_insert', 'some content')
+                  expect(js_agent_insertion_proc).to receive(:call).with(
+                    'script_insert', 'some content'
+                  ).and_return('some content')
                   expect(dlp_cleaner_proc).to receive(:call).with(nil, 'some content')
 
                   tcell_body_proxy.each { |b| }
@@ -182,7 +184,9 @@ module TCellAgent
                 expect(TCellAgent::Instrumentation).to receive(:safe_block).with(
                   'Processing tcell body proxy body'
                 ).and_call_original
-                expect(js_agent_insertion_proc).to receive(:call).with('script_insert', body_chunk)
+                expect(js_agent_insertion_proc).to receive(:call).with(
+                  'script_insert', body_chunk
+                ).and_return(body_chunk)
                 expect(dlp_cleaner_proc).to receive(:call).with(nil, body_chunk)
 
                 tcell_body_proxy.each { |b| }

data/spec/lib/tcell_agent/rails_spec.rb

@@ -18,35 +18,4 @@ module TCellAgent
       @env[key]
     end
   end
-
-  # describe MyMiddleware do
-
-  #   let(:file_like_object) { File.open("spec/resources/normal_config.json") }
-  #   let(:app) { MockRackApp.new }
-  #   subject { described_class.new(app) }
-
-  #   context "when called with a POST request" do
-  #     let(:request) { Rack::MockRequest.new(app) }
-  #     before(:each) do
-  #       request.post("/some/path", input: post_data, 'CONTENT_TYPE' => 'text/plain')
-  #     end
-
-  #     context "with some particular data" do
-  #       let(:post_data) { "String or IO post data" }
-
-  #       it "passes the request through unchanged" do
-  #         #File.stub(:open).with("config/tcell_agent.config","rb") { StringIO.new(file_like_object) }
-  #         #File.should_receive(:read).with('/tmp/myfile').and_return(StringIO.new(file_like_object))
-
-  #         allow(File).to receive(:open).with('config/tcell_agent.config').and_return(file_like_object)
-  #         TCellAgent.configuration = TCellAgent::Configuration.new
-  #         main_worker = ::TCellAgent::AgentWorker.new(Process.pid)
-  #         ::TCellAgent::AgentThread.setThread(main_worker)
-  #         main_worker.start
-  #         expect(app['CONTENT_TYPE']).to eq('text/plain')
-  #         expect(app.request_body).to eq(post_data)
-  #       end
-  #     end
-  #   end
-  # end
 end

data/spec/lib/tcell_agent/rust/whisperer_spec.rb

@@ -7,56 +7,138 @@ module TCellAgent
       require 'tcell_agent/rust/whisperer'
 
       before(:each) do
+        configuration = double(
+          'configuration',
+          {
+            'app_id' => 'app_id',
+            'api_key' => 'api_key',
+            'allow_payloads' => true,
+            'js_agent_api_base_url' => 'http://api.tcell.com/',
+            'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
+            'max_csp_header_bytes' => nil
+          }
+        )
+        expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
         whisper = Whisperer.create_agent
         @agent_ptr = whisper['agent_ptr']
         @report_command_rule_id = 'TJM4ODvkB2jSR47qltL+0Nyy/PGlF6Qa/cin65qtIlc='
         @compound_rule_id = 'Y+IHN7BJDctqOIIZOb71NR8PkUxru01LDkqU1lZwogY='
+        @block_whoois_on_path_rule_id = 'report-rule-with-path'
         policy = {
-          'result' => {
-            'cmdi' => {
-              'data' => {
-                'collect_full_commandline' => false,
-                'command_rules' => [
-                  {
-                    'action' => 'report',
-                    'rule_id' => @report_command_rule_id
-                  }
-                ],
-                'compound_statement_rules' => [
-                  {
-                    'action' => 'report',
-                    'rule_id' => @compound_rule_id
-                  }
-                ]
-              },
-              'policy_id' => '0cf0f090-ffc0-11e7-8080-808080808080',
-              'version' => 1
-            }
+          'cmdi' => {
+            'data' => {
+              'collect_full_commandline' => false,
+              'command_rules' => [
+                {
+                  'action' => 'report',
+                  'rule_id' => @report_command_rule_id
+                },
+                {
+                  'action' => 'block',
+                  'rule_id' => @block_whoois_on_path_rule_id,
+                  'command' => 'whoois',
+                  'path' => { 'exact' => '/some/path', 'method' => 'GET' }
+                }
+              ],
+              'compound_statement_rules' => [
+                {
+                  'action' => 'report',
+                  'rule_id' => @compound_rule_id
+                }
+              ]
+            },
+            'policy_id' => '0cf0f090-ffc0-11e7-8080-808080808080',
+            'version' => 1
           }
         }
 
         whisper = Whisperer.update_policies(@agent_ptr, policy)
-        expect(whisper['enablements']).to eq({
-                                               'appfirewall' => false,
-                                               'patches' => false,
-                                               'cmdi' => true
-                                             })
+        expect(whisper['enablements']).to eq(
+          {
+            'appfirewall' => false,
+            'patches' => false,
+            'cmdi' => true,
+            'headers' => false,
+            'jsagentinjection' => false
+          }
+        )
+        @tcell_context = nil
+      end
+
+      after(:each) do
+        Whisperer.free_agent(@agent_ptr)
       end
 
       context 'empty command' do
         it 'should return empty json object' do
-          result = Whisperer.apply_cmdi(@agent_ptr, nil)
+          result = Whisperer.apply_cmdi(@agent_ptr, nil, @tcell_context)
           expect(result).to eq({})
-          result = Whisperer.apply_cmdi(@agent_ptr, '')
+          result = Whisperer.apply_cmdi(@agent_ptr, '', @tcell_context)
           expect(result).to eq({})
-          result = Whisperer.apply_cmdi(@agent_ptr, '   ')
+          result = Whisperer.apply_cmdi(@agent_ptr, '   ', @tcell_context)
           expect(result).to eq({})
         end
       end
 
+      context 'with a path with method' do
+        it 'that matches, should return event' do
+          tcell_context = TCellAgent::Instrumentation::TCellData.new
+          tcell_context.request_method = 'GET'
+          tcell_context.path = '/some/path'
+          result = Whisperer.apply_cmdi(@agent_ptr, 'whoois', tcell_context)
+          expect(result).to eq(
+            {
+              'apply_response' => {
+                'blocked' => true,
+                'commands' => [{ 'command' => 'whoois', 'arg_count' => 0 }],
+                'matches' => [{ 'rule_id' => @block_whoois_on_path_rule_id,
+                                'command' => 'whoois' }],
+                'full_commandline' => nil
+              }
+            }
+          )
+        end
+
+        it 'that does not match, should match generic report event' do
+          # method doesn't match
+          tcell_context = TCellAgent::Instrumentation::TCellData.new
+          tcell_context.request_method = 'POST'
+          tcell_context.path = '/some/path'
+          result = Whisperer.apply_cmdi(@agent_ptr, 'whoois', tcell_context)
+          expect(result).to eq(
+            {
+              'apply_response' => {
+                'blocked' => false,
+                'commands' => [{ 'command' => 'whoois', 'arg_count' => 0 }],
+                'matches' => [{ 'rule_id' => @report_command_rule_id,
+                                'command' => 'whoois' }],
+                'full_commandline' => nil
+              }
+            }
+          )
+
+          # path doesn't match
+          tcell_context = TCellAgent::Instrumentation::TCellData.new
+          tcell_context.request_method = 'GET'
+          tcell_context.path = '/does/not/match'
+          result = Whisperer.apply_cmdi(@agent_ptr, 'whoois', tcell_context)
+          expect(result).to eq(
+            {
+              'apply_response' => {
+                'blocked' => false,
+                'commands' => [{ 'command' => 'whoois', 'arg_count' => 0 }],
+                'matches' => [{ 'rule_id' => @report_command_rule_id,
+                                'command' => 'whoois' }],
+                'full_commandline' => nil
+              }
+            }
+          )
+        end
+      end
+
       context 'single command' do
         it 'should return single command parsed' do
-          result = Whisperer.apply_cmdi(@agent_ptr, 'ifconfig -a')
+          result = Whisperer.apply_cmdi(@agent_ptr, 'ifconfig -a', @tcell_context)
           expect(result).to eq({
                                  'apply_response' => {
                                    'blocked' => false,
@@ -66,7 +148,7 @@ module TCellAgent
                                    'full_commandline' => nil
                                  }
                                })
-          result = Whisperer.apply_cmdi(@agent_ptr, 'ifconfig')
+          result = Whisperer.apply_cmdi(@agent_ptr, 'ifconfig', @tcell_context)
           expect(result).to eq({
                                  'apply_response' => {
                                    'blocked' => false,
@@ -83,7 +165,8 @@ module TCellAgent
         it 'should return parsed commands' do
           commands = Whisperer.apply_cmdi(
             @agent_ptr,
-            'cd /tcellagent_src && bundle --quiet && bundle exec rake compile && bundle exec rspec'
+            'cd /tcellagent_src && bundle --quiet && bundle exec rake compile && bundle exec rspec',
+            @tcell_context
           )
           expect(commands).to eq({
                                    'apply_response' => {
@@ -105,7 +188,8 @@ module TCellAgent
 
           commands = Whisperer.apply_cmdi(
             @agent_ptr,
-            'cd /tcellagent_src; bundle --quiet; bundle exec rake compile; bundle exec rspec'
+            'cd /tcellagent_src; bundle --quiet; bundle exec rake compile; bundle exec rspec',
+            @tcell_context
           )
           expect(commands).to eq({
                                    'apply_response' => {
@@ -129,7 +213,8 @@ module TCellAgent
 
           commands = Whisperer.apply_cmdi(
             @agent_ptr,
-            'cat /etc/passwd | grep root'
+            'cat /etc/passwd | grep root',
+            @tcell_context
           )
           expect(commands).to eq({
                                    'apply_response' => {
@@ -150,13 +235,14 @@ module TCellAgent
 
         context 'spawning multiple lines' do
           it 'should parse the commands' do
+            multiline_command = "echo 'first-line'; \ \n" \
+                                'cat /etc/passwd | grep root'
             commands = Whisperer.apply_cmdi(
               @agent_ptr,
-              <<-EOS
-echo 'first-line'; \
-cat /etc/passwd | grep root
-              EOS
+              multiline_command,
+              @tcell_context
             )
+
             expect(commands).to eq({
                                      'apply_response' => {
                                        'blocked' => false,
@@ -175,12 +261,12 @@ cat /etc/passwd | grep root
                                      }
                                    })
 
+            multiline_command = "echo 'first-line' && \ \n" \
+                                'cat /etc/passwd | grep root'
             commands = Whisperer.apply_cmdi(
               @agent_ptr,
-              <<-EOS
-echo 'first-line' && \
-cat /etc/passwd | grep root
-              EOS
+              multiline_command,
+              @tcell_context
             )
             expect(commands).to eq({
                                      'apply_response' => {
@@ -200,13 +286,13 @@ cat /etc/passwd | grep root
                                      }
                                    })
 
+            multiline_command = "cd /tcellagent_src; bundle --quiet; \ \n" \
+                                "bundle exec rake compile; \ \n" \
+                                'bundle exec rspec'
             commands = Whisperer.apply_cmdi(
               @agent_ptr,
-              <<-EOS
-cd /tcellagent_src; bundle --quiet; \
-bundle exec rake compile; \
-bundle exec rspec
-              EOS
+              multiline_command,
+              @tcell_context
             )
             expect(commands).to eq({
                                      'apply_response' => {
@@ -233,18 +319,18 @@ bundle exec rspec
 
       context 'with a complex command' do
         it 'should parse the commands' do
+          multiline_command = "magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\ \n" \
+                              "-draw \"text 25,60 \'Magick\'\" -channel RGBA -blur 0x6 -fill darkred -stroke magenta \\ \n" \
+                              "-draw \"text 20,55 \'Magick\'\" fuzzy-magick.png"
           commands = Whisperer.apply_cmdi(
             @agent_ptr,
-            <<-EOS
-magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\
--draw "text 25,60 \'Magick\'" -channel RGBA -blur 0x6 -fill darkred -stroke magenta \\
--draw "text 20,55 \'Magick\'" fuzzy-magick.png
-            EOS
+            multiline_command,
+            @tcell_context
           )
           expect(commands).to eq({
                                    'apply_response' => {
                                      'blocked' => false,
-                                     'commands' => [{ 'command' => 'magick', 'arg_count' => 24 }],
+                                     'commands' => [{ 'command' => 'magick', 'arg_count' => 26 }],
                                      'matches' => [{ 'rule_id' => @report_command_rule_id, 'command' => 'magick' }],
                                      'full_commandline' => nil
                                    }
@@ -252,7 +338,8 @@ magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\
 
           commands = Whisperer.apply_cmdi(
             @agent_ptr,
-            "/usr/local/bin/ruby -eputs 'Hello World!' > /dev/null 2>&1"
+            "/usr/local/bin/ruby -eputs 'Hello World!' > /dev/null 2>&1",
+            @tcell_context
           )
           expect(commands).to eq({
                                    'apply_response' => {
@@ -269,7 +356,8 @@ magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\
         it 'should parse the commands' do
           commands = Whisperer.apply_cmdi(
             @agent_ptr,
-            "echo 'bréak' && cat /etc/passwd && grep root"
+            "echo 'bréak' && cat /etc/passwd && grep root",
+            @tcell_context
           )
           expect(commands).to eq({
                                    'apply_response' => {
@@ -295,7 +383,8 @@ magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\
         it 'should parse the commands' do
           commands = Whisperer.apply_cmdi(
             @agent_ptr,
-            "echo 'br\0ak' && cat /etc/passwd && grep root"
+            "echo 'br\0ak' && cat /etc/passwd && grep root",
+            @tcell_context
           )
           expect(commands).to eq({
                                    'apply_response' => {
@@ -321,7 +410,8 @@ magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\
         it 'should parse the commands' do
           commands = Whisperer.apply_cmdi(
             @agent_ptr,
-            'sh -c "bundle install && rake db:setup db:migrate"'
+            'sh -c "bundle install && rake db:setup db:migrate"',
+            @tcell_context
           )
           expect(commands).to eq(
             {
@@ -349,7 +439,8 @@ magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\
         it 'should parse the commands' do
           commands = Whisperer.apply_cmdi(
             @agent_ptr,
-            '/bin/sh -c "bundle install && rake db:setup db:migrate"'
+            '/bin/sh -c "bundle install && rake db:setup db:migrate"',
+            @tcell_context
           )
           expect(commands).to eq(
             {
@@ -407,77 +498,90 @@ magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\
 
     describe '.apply_appfirewall and .apply_patches' do
       before(:each) do
+        configuration = double(
+          'configuration',
+          {
+            'app_id' => 'app_id',
+            'api_key' => 'api_key',
+            'allow_payloads' => true,
+            'js_agent_api_base_url' => 'http://api.tcell.com/',
+            'js_agent_url' => 'https://jsagent.tcell.io/tcellagent.min.js',
+            'max_csp_header_bytes' => nil
+          }
+        )
+        expect(TCellAgent).to receive(:configuration).and_return(configuration).at_least(:once)
         whisper = Whisperer.create_agent
         @agent_ptr = whisper['agent_ptr']
         policy = {
-          'result' => {
-            'regex' => {
-              'data' => {
-                'patterns' => [
-                  {
-                    'id' => 'tc-xss-1',
-                    'pattern' => '(?:<(script|iframe|embed|frame|frameset|object|img|applet|body|html|style|layer|link|ilayer|meta|bgsound))',
-                    'sensor' => 'xss',
-                    'title' => 'Basic Injection'
-                  }
-                ],
-                'version' => 1_518_546_622_571
-              },
-              'policy_id' => 'f3a313b0-10eb-11e8-8080-808080808080',
-              'version' => 1
+          'regex' => {
+            'data' => {
+              'patterns' => [
+                {
+                  'id' => 'tc-xss-1',
+                  'pattern' => '(?:<(script|iframe|embed|frame|frameset|object|img|applet|body|html|style|layer|link|ilayer|meta|bgsound))',
+                  'sensor' => 'xss',
+                  'title' => 'Basic Injection'
+                }
+              ],
+              'version' => 1_518_546_622_571
             },
+            'policy_id' => 'regex-policy-id',
+            'version' => 1
+          },
 
-            'appsensor' => {
-              'policy_id' => 'f39d6e60-10eb-11e8-8080-808080808080',
-              'version' => 2,
-              'data' => {
-                'sensors' => {
-                  'ignore_rules' => [],
-                  'errors' => {
-                    'csrf_exception_enabled' => true,
-                    'sql_exception_enabled' => true
-                  },
-                  'xss' => {
-                    'dynamic_patterns' => ['tc-xss-1'],
-                    'patterns' => ['1']
-                  }
+          'appsensor' => {
+            'policy_id' => 'appsensor-policy-id',
+            'version' => 2,
+            'data' => {
+              'sensors' => {
+                'ignore_rules' => [],
+                'errors' => {
+                  'csrf_exception_enabled' => true,
+                  'sql_exception_enabled' => true
+                },
+                'xss' => {
+                  'dynamic_patterns' => ['tc-xss-1'],
+                  'patterns' => ['1']
                 }
               }
-            },
+            }
+          },
 
-            'patches' => {
-              'data' => {
-                'block_rules' => [],
-                'blocked_ips' => [],
-                'rules' => [
-                  {
-                    'action' => 'BlockIf',
-                    'destinations' => { 'check_equals' => [{ 'path' => '*' }] },
-                    'id' => 'check-absent-rule',
-                    'ignore' => [],
-                    'matches' => [
-                      {
-                        'all' => [
-                          {
-                            'parameters' => {
-                              'check_present' => {
-                                'queries' => [
-                                  'xss_param'
-                                ]
-                              }
+          'patches' => {
+            'data' => {
+              'block_rules' => [],
+              'blocked_ips' => [],
+              'payloads' => {
+                'send_payloads' => true
+              },
+              'rules' => [
+                {
+                  'action' => 'BlockIf',
+                  'destinations' => { 'check_equals' => [{ 'path' => '*' }] },
+                  'id' => 'check-present-rule',
+                  'ignore' => [],
+                  'matches' => [
+                    {
+                      'all' => [
+                        {
+                          'parameters' => {
+                            'check_present' => {
+                              'queries' => [
+                                'xss_param'
+                              ]
                             }
                           }
-                        ],
-                        'any' => []
-                      }
-                    ],
-                    'title' => 'check absent rule'
-                  }
-                ]
-              },
-              'policy_id' => 'patches-v1-14',
-              'version' => 2
-            }
+                        }
+                      ],
+                      'any' => []
+                    }
+                  ],
+                  'title' => 'check present rule'
+                }
+              ]
+            },
+            'policy_id' => 'patches-v1-14',
+            'version' => 2
           }
         }
 
@@ -486,11 +590,17 @@ magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\
           {
             'appfirewall' => true,
             'patches' => true,
-            'cmdi' => false
+            'cmdi' => false,
+            'headers' => false,
+            'jsagentinjection' => false
           }
         )
       end
 
+      after(:each) do
+        Whisperer.free_agent(@agent_ptr)
+      end
+
       it 'should return appfirewall injections' do
         appsensor_meta = TCellAgent::SensorEvents::AppSensorMetaEvent.new(
           'GET',
@@ -580,7 +690,11 @@ magick -size 320x85 canvas:none -font Bookman-DemiItalic -pointsize 72 \\
             'apply_response' => {
               'status' => 'Blocked',
               'patches_policy_id' => 'patches-v1-14',
-              'rule_id' => 'check-absent-rule'
+              'rule_id' => 'check-present-rule',
+              'regex_pid' => 'regex-policy-id',
+              'payload' => [
+                { 'l' => 'query', 'name' => 'xss_param', 'val' => '<script>' }
+              ]
             }
           }
         )