@newrelic/security-agent 0.1.3 → 0.2.1

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+### v0.2.1 (2023-08-07)
+#### Bug Fixes
+* Pinned check-disk-space to v3.3.1 to support Node.js v14
+#### Miscellaneous Chores
+* deps: Updated semver to v7.5.4 and @aws-sdk/client-lambda to v3.363.0
+#### Continuous Integration
+* Add Node.js 20.x to CI
+
+### v0.2.0 (2023-07-24)
+#### Features
+* IAST data pull implementation
+* Logging update
+
+#### Bug Fixes
+* Param fixes for mysql and file hooks.
+
 ### v0.1.3
 * Updated semver to v7.5.3 (Fix for CWE-1333)
 * Updated request-ip, log4js, html-entities, uuid and fast-safe-stringify to latest version.

package/THIRD_PARTY_NOTICES.md

@@ -75,7 +75,7 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 
 ### @aws-sdk/client-lambda
 
-This product includes source derived from [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3) ([v3.358.0](https://github.com/aws/aws-sdk-js-v3/tree/v3.358.0)), distributed under the [Apache-2.0 License](https://github.com/aws/aws-sdk-js-v3/blob/v3.358.0/LICENSE):
+This product includes source derived from [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3) ([v3.379.1](https://github.com/aws/aws-sdk-js-v3/tree/v3.379.1)), distributed under the [Apache-2.0 License](https://github.com/aws/aws-sdk-js-v3/blob/v3.379.1/LICENSE):
 
 ```
                                 Apache License
@@ -311,7 +311,7 @@ THE SOFTWARE.
 
 ### check-disk-space
 
-This product includes source derived from [check-disk-space](https://github.com/Alex-D/check-disk-space) ([v3.4.0](https://github.com/Alex-D/check-disk-space/tree/v3.4.0)), distributed under the [MIT License](https://github.com/Alex-D/check-disk-space/blob/v3.4.0/LICENSE):
+This product includes source derived from [check-disk-space](https://github.com/Alex-D/check-disk-space) ([v3.3.1](https://github.com/Alex-D/check-disk-space/tree/v3.3.1)), distributed under the [MIT License](https://github.com/Alex-D/check-disk-space/blob/v3.3.1/LICENSE):
 
 ```
 MIT License
@@ -684,7 +684,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### semver
 
-This product includes source derived from [semver](https://github.com/npm/node-semver) ([v7.5.3](https://github.com/npm/node-semver/tree/v7.5.3)), distributed under the [ISC License](https://github.com/npm/node-semver/blob/v7.5.3/LICENSE):
+This product includes source derived from [semver](https://github.com/npm/node-semver) ([v7.5.4](https://github.com/npm/node-semver/tree/v7.5.4)), distributed under the [ISC License](https://github.com/npm/node-semver/blob/v7.5.4/LICENSE):
 
 ```
 The ISC License

package/lib/instrumentation-security/core/constants.js

@@ -60,7 +60,6 @@ module.exports = {
     SLASHDOTDOT: '/..',
     UNDEFINED: 'undefined',
     SELF_FD_PATH: '/proc/self/fd/',
-    CSEC_LAST_FUZZ_REQUEST_TIME: 'CSEC_LAST_FUZZ_REQUEST_TIME',
     NR_CSEC_FUZZ_REQUEST_ID: 'nr-csec-fuzz-request-id',
 
 };

package/lib/instrumentation-security/hooks/fs/nr-fs.js

@@ -16,6 +16,7 @@ const logger = API.getLogger();
 const { STRING, QUESTIONMARK, DOTDOTSLASH, UNDEFINED, SELF_FD_PATH, SLASH, SLASHDOTDOT, NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
 const fsConsts = process.binding('constants').fs;
 const agentModule = API.getSecAgent();
+const lodash = require('lodash');
 
 const requireHook = require('../require/nr-require');
 
@@ -127,7 +128,7 @@ function openHook(shim, mod, moduleName) {
           parameters[0] = arguments[0];
         }
       }
-      if (request && typeof parameters[0] === STRING) {
+      if (request && typeof parameters[0] === STRING && !lodash.isEmpty(parameters[0]) ) {
         const policy = API.getPolicy();
         const dynamicScanningFlag = policy.data ? policy.data.vulnerabilityScan.iastScan.enabled : false;
         const url = request.url;
@@ -180,7 +181,7 @@ function probableToFAHooks(shim, mod, moduleName) {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING) {
+        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.FILE_OPERATION, EVENT_CATEGORY.FILE)
           this.secEvent = API.generateSecEvent(secMetadata);
@@ -209,7 +210,7 @@ function probableToFIHooks(shim, mod, moduleName) {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING) {
+        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           if (fun === COPY_FILE || fun === RENAME) {
             const secMetadata = securityMetaData.getSecurityMetaData(request, arguments[1], traceObject, secUtils.getExecutionId(), getCase(arguments[1]), EVENT_CATEGORY.FILE)
@@ -243,7 +244,7 @@ function probablePromiseToFAHooks(shim, mod, moduleName) {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING) {
+        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.FILE_OPERATION, EVENT_CATEGORY.FILE)
           this.secEvent = API.generateSecEvent(secMetadata);
@@ -268,7 +269,7 @@ function probablePromiseToFIHooks(shim, mod, moduleName) {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING) {
+        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           if (fun === COPY_FILE || fun === RENAME) {
             const secMetadata = securityMetaData.getSecurityMetaData(request, arguments[1], traceObject, secUtils.getExecutionId(), getCase(arguments[1]), EVENT_CATEGORY.FILE)

package/lib/instrumentation-security/hooks/mysql/nr-mysql.js

@@ -171,6 +171,19 @@ function wrapQueryable(shim, queryable, isPoolQuery) {
   }
   return true;
 }
+/**
+ * Utility to check list contains only string
+ * @param {*} list 
+ * @returns 
+ */
+function containsOnlyStrings(list) {
+  for (let i = 0; i < list.length; i++) {
+    if (typeof list[i] !== 'string') {
+      return false;
+    }
+  }
+  return true;
+}
 
 /**
  * Utility to extract query from the intercepted args
@@ -199,6 +212,9 @@ function extractQueryArgs(shim, args) {
     param = args[1];
     param =  Object.values(param)
   }
+  if(!containsOnlyStrings(param)){
+    param = [];
+  }
   return {
     rawQuery: rawQuery,
     param: param,

package/lib/instrumentation-security/hooks/require/nr-require.js

@@ -14,9 +14,11 @@ const Module = require('module');
 const refDirRegEx = /^(\.\/)|^(\.\.\/)/g;
 const path = require('path');
 const CSEC = 'nr-security-agent';
+const FN_INSPECT = '@contrast/fn-inspect';
+const NEWRELIC = 'newrelic';
 
 /**
- * Entry point for xpath module hook
+ * Entry point for require module hook
  * @param {*} shim 
  * @param {*} mod 
  * @param {*} moduleName 
@@ -33,17 +35,22 @@ function initialize(shim) {
         if (arguments[0].match(refDirRegEx) && arguments[1] && arguments[1].path) {
             moduleName = path.resolve(arguments[1].path, arguments[0]);
         }
-
+        
         let flag = false;
-        if (moduleName && typeof (moduleName) === STRING && !moduleName.includes(CSEC)) {
+        if (moduleName && typeof (moduleName) === STRING && !moduleName.includes(CSEC) && !moduleName.includes(FN_INSPECT)) {
             flag = true;
         }
-        else if (parent && parent.id && typeof (parent.id) === STRING && moduleName.includes(CSEC) && parent.id.includes(CSEC)) {
+        else if (parent && parent.id && typeof (parent.id) === STRING && moduleName.includes(CSEC) && parent.id.includes(CSEC) && moduleName.includes(FN_INSPECT)) {
             flag = false;
         }
-        else if (parent && parent.id && moduleName && typeof (moduleName) === STRING && moduleName.includes(CSEC) && parent.id.includes(CSEC)) {
+        else if (parent && parent.id && moduleName && typeof (moduleName) === STRING && moduleName.includes(CSEC) && parent.id.includes(CSEC) && moduleName.includes(FN_INSPECT)) {
             flag = false;
         }
+
+        if ((parent && parent.id && typeof (parent.id) === STRING && parent.id.includes(NEWRELIC)) ||  moduleName.includes(NEWRELIC)){
+            flag = false;
+        }
+
         if (flag) {
             requireHook(shim, moduleName, parent);
         }

package/lib/nr-security-agent/lib/core/Auth-headers.js

@@ -31,6 +31,7 @@ function AuthHeaders() {
         authHeaders['NR-CSEC-BUILD-NUMBER'] = appInfo.buildNumber;
         authHeaders['NR-ACCOUNT-ID'] =  NRAgent.config.account_id;
         authHeaders['NR-LICENSE-KEY'] = NRAgent ? NRAgent.config.license_key : '';
+        authHeaders["NR-CSEC-IAST-DATA-TRANSFER-MODE"] = "PULL";
     } catch (error) {
         logger.error("Exception in preparing auth headers:", error);
     }

package/lib/nr-security-agent/lib/core/applicationinfo.js

@@ -200,7 +200,7 @@ ApplicationInfo.prototype.updateSHAAndSize = async function updateSHAAndSize (Gl
     applicationInfo.sha256 = await shaSizeUtil.getSHA256ForFile(process.argv[0]);
 
     let stat = {};
-    if (process.hasWorker) {
+    if (commonUtils.hasWorker()) {
         stat = await getApplicationSHAAndSizeFromWorker(applicationInfo, application.deployedPath);
     } else {
         stat = await shaSizeUtil.getApplicationSHAAndSize(application.deployedPath, GlobalPromise);

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -55,8 +55,14 @@ function getKindIdPair (identifier, hostId) {
  * @returns 
  */
 function hasWorker () {
-    process.hasWorker = false;
-    return process.hasWorker;
+    let workerFlag = false;
+    try {
+        require('worker_threads');
+        workerFlag = true;
+    } catch (error) {
+        workerFlag = false;
+    }
+    return workerFlag;
 }
 
 function runtimeSupportsFunctionGenerators () {
@@ -136,13 +142,6 @@ function createDirectories () {
  */
 async function initialSetup () {
     try {
-        checkDiskSpace(`${CSEC_HOME}`).then((diskSpace) => {
-            if (diskSpace.free < 1000000000) {
-                logger.error(LOG_MESSAGES.AVAIL_DISK_ERROR, `${CSEC_HOME}`, prettyBytes(diskSpace.free));
-                process.exit();
-            }
-        }).catch(() => {
-        });
         createDirectories();
     } catch (err) {
         logger.error(err);
@@ -329,7 +328,8 @@ function logRollOver () {
             return;
         }
     } catch (error) {
-        logger.error('Error in getting stats of log file:', error);
+        logger.debug('Error in getting stats of log file:', error.message);
+        return;
     }
 
     try {

package/lib/nr-security-agent/lib/core/connections/websocket/index.js

@@ -6,9 +6,6 @@
 const {
     SecWebSocket,
     WSCallbacks,
-    aquireWebSocket,
-    isWebSocketBusy,
-    releaseWebSocket,
     setWebSocketConn
 } = require('./websocket');
 
@@ -17,9 +14,6 @@ const ResponseHandler = require('./response');
 module.exports = {
     SecWebSocket,
     WSCallbacks,
-    aquireWebSocket,
-    isWebSocketBusy,
-    releaseWebSocket,
     setWebSocketConn,
     ResponseHandler
 };

package/lib/nr-security-agent/lib/core/connections/websocket/response/IASTUtils.js

@@ -0,0 +1,50 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+const { Agent } = require('../../../agent');
+let completedRequestIds = new Set();
+const PolicyManager = require('../../../Policy');
+let batchSize;
+const batchthreshold = 300;
+function getCompletedRequestIds() {
+    return [...completedRequestIds];
+}
+
+function addRequestId(id) {
+    completedRequestIds.add(id);
+}
+
+function removeRequestId(id) {
+    completedRequestIds.delete(id);
+}
+
+function generateIASTDataRequest() {
+    const policyInstance = PolicyManager.getInstance();
+    if (policyInstance.data && policyInstance.data.vulnerabilityScan && policyInstance.data.vulnerabilityScan.iastScan) {
+        batchSize = batchSize ? batchSize : policyInstance.data.vulnerabilityScan.iastScan.probing.batchSize;
+        if (batchSize > batchthreshold) {
+            batchSize = policyInstance.data.vulnerabilityScan.iastScan.probing.batchSize;
+        }
+    }
+    if (getCompletedRequestIds().length >= batchSize || batchSize < batchthreshold) {
+        batchSize = (2 * batchSize);
+    }
+    let object = {};
+    object['jsonName'] = 'iast-data-request';
+    object['applicationUUID'] = Agent.getAgent().applicationInfo.applicationUUID;
+    object["batchSize"] = batchSize ? batchSize : 300;
+    object['completedRequestIds'] = getCompletedRequestIds();
+    return object;
+
+}
+
+
+module.exports = {
+    getCompletedRequestIds,
+    addRequestId,
+    removeRequestId,
+    generateIASTDataRequest,
+}
+
+

package/lib/nr-security-agent/lib/core/connections/websocket/response/collector-policy-handler.js

@@ -11,7 +11,10 @@ module.exports.handler = function handler(json) {
         const policyData = json.data;
         const PolicyManager = require('../../../Policy');
         PolicyManager.setPolicyData(policyData);
-        
+        if (policyData.vulnerabilityScan.enabled && policyData.vulnerabilityScan.iastScan.enabled) {
+            require('./fuzz-request-handler').startIASTSchedular();
+        }
+
     } catch (error) {
         logger.error('paring exception while parsing configuration', error);
     }

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -9,19 +9,19 @@ const stringify = require('fast-safe-stringify');
 const restClient = require('../../restclient');
 const { Agent } = require('../../../agent');
 const { FuzzFailEvent } = require('../../../FuzzFailEvent');
-const { hasWorker: isWorkerSupported } = require('../../../commonUtils');
 const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH } = require('../../../sec-agent-constants');
 const LOCALHOST = 'localhost';
 const COLON_SLASH_SLASH = '://';
 const http = require('http');
 const https = require('https');
+const IASTUtil = require('./IASTUtils');
+const CSEC_SEP = ':IAST:';
+
 require('dns').setDefaultResultOrder('ipv4first')
 
 const {
     IS_LAMBDA_ENV,
-    AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER,
-    CSEC_LAST_FUZZ_REQUEST_TIME
-} = require('../../../sec-agent-constants');
+    AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER } = require('../../../sec-agent-constants');
 const statusUtils = require('../../../statusUtils');
 
 const find = `${SLASH}{{NR_CSEC_VALIDATOR_HOME_TMP}}`;
@@ -29,23 +29,71 @@ const CSEC_HOME_TMP_CONST = new RegExp(find, 'g');
 
 let logger;
 let lastFuzzEventTime = 0;
+let iastIntervalConst;
+let coolDownIntervalConst;
+let additionalCoolDownTime = 0;
+let fuzzedApiIDSet = new Set();
+
+
+/**
+ * utility to start IAST Schedular
+ */
+function startIASTSchedular() {
+    Agent.getAgent().client.dispatcher(IASTUtil.generateIASTDataRequest());
+    if (iastIntervalConst) {
+        clearInterval(iastIntervalConst);
+    }
+    iastIntervalConst = setInterval(() => {
+        let data = IASTUtil.generateIASTDataRequest();
+        let currentTime = Date.now();
+        let completedListSize = IASTUtil.getCompletedRequestIds().length;
+        let timeDiffInSeconds = ((currentTime - lastFuzzEventTime) / 1000);
+        logger.trace("Time difference since last fuzz request:", timeDiffInSeconds);
+        logger.trace("Completed requests so far:", completedListSize);
+
+        if (timeDiffInSeconds > 5 && additionalCoolDownTime == 0) {
+            Agent.getAgent().client.dispatcher(data);
+        }
+    }, 5000);
+}
+
+/**
+ * Utility to log scanned apiId
+ * @param {*} fuzzHeader 
+ */
+function logScannedApiId(fuzzHeader, requestURL) {
+    try {
+        let apiId = fuzzHeader.split(CSEC_SEP)[0]
+        if (apiId && !fuzzedApiIDSet.has(apiId) ) {
+            fuzzedApiIDSet.add(apiId);
+            logger.info("IAST Scan for API %s with ID : %s started.", requestURL, apiId);
+        }
+    } catch (error) {
+
+    }
+
+}
 
 // handler function to parse fuzz event and prepare fuzz request
-function handler (json) {
-    setLastFuzzEnventTime();
+function handler(json) {
+    setLastFuzzEventTime();
     let rawFuzzRequest = json.arguments[0];
-    logger.debug('Fuzz request received::' + rawFuzzRequest);
     rawFuzzRequest = rawFuzzRequest.replace(CSEC_HOME_TMP_CONST, CSEC_HOME_TMP);
     let fuzzRequest;
     try {
         fuzzRequest = JSON.parse(rawFuzzRequest);
+        fuzzRequest['id'] = json.id;
+        let completedList = IASTUtil.getCompletedRequestIds();
+        if (completedList.includes(json.id)) {
+            return;
+        }
     } catch (error) {
         logger.error('Parsing exeception in fuzz request: ', error);
     }
     if (!fuzzRequest) {
         return;
     }
-
+    logger.debug('Fuzz request received::' + JSON.stringify(json));
     logger.info('Fuzz request:: Method: ' + fuzzRequest.method);
     logger.info('Fuzz request:: Headers: ' + stringify(fuzzRequest.headers));
     logger.info('Fuzz request:: Data: ' + fuzzRequest.body);
@@ -61,7 +109,7 @@ function handler (json) {
  *
  * @param {Object} fuzzDetails
  */
-function handleFuzzRequest (fuzzDetails) {
+function handleFuzzRequest(fuzzDetails) {
     const { fuzzRequest } = fuzzDetails;
     try {
         if (IS_LAMBDA_ENV) {
@@ -71,7 +119,7 @@ function handleFuzzRequest (fuzzDetails) {
             const ver = process.env[AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER];
             logger.info('Invoking Lambda:: ARN: ' + arn);
             logger.info('Invoking Lambda:: Version: ' + ver);
-            
+
         } else {
             const config = parseAxiosHttpRequestToFuzz(fuzzRequest);
             const type = config.headers['content-type'];
@@ -81,10 +129,16 @@ function handleFuzzRequest (fuzzDetails) {
                     config.headers['content-type'] = splitted[0];
                 }
             }
+
+            if(fuzzRequest.headers && fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+                logScannedApiId(fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID], fuzzRequest.requestURI)
+            }
+        
+
             logger.info('Firing http request:: URL: ' + config.url);
 
-            const request = restClient.fireRequest(config);
-            handleFuzzResponse(request, fuzzDetails);
+            const response = restClient.fireRequest(config);
+            handleFuzzResponse(response, fuzzDetails);
         }
     } catch (err) {
         statusUtils.addErrortoBuffer(err);
@@ -101,13 +155,14 @@ function handleFuzzRequest (fuzzDetails) {
 /**
  * Handles the fuzz response Promise.
  *
- * @param {Promise} request
+ * @param {Promise} response
  * @param {Object} fuzzDetails
  */
-function handleFuzzResponse (request, fuzzDetails) {
+function handleFuzzResponse(response, fuzzDetails) {
     const { rawFuzzRequest, fuzzRequest } = fuzzDetails;
-    if (request) {
-        request.then(() => {
+    if (response) {
+        IASTUtil.addRequestId(fuzzRequest.id);
+        response.then(() => {
             logger.info('Fuzz success: ' + rawFuzzRequest);
         }).catch(() => {
             logger.debug('Error occured:', fuzzRequest.url, fuzzRequest);
@@ -121,11 +176,11 @@ function handleFuzzResponse (request, fuzzDetails) {
  *
  * @param {JSON} requestObject
  */
-function parseAxiosHttpRequestToFuzz (requestObject) {
+function parseAxiosHttpRequestToFuzz(requestObject) {
     let serverName = requestObject.serverName ? requestObject.serverName : LOCALHOST;
     let host = serverName + COLON + requestObject.serverPort
     return {
-        url: requestObject.protocol + COLON_SLASH_SLASH + host  + requestObject.url,
+        url: requestObject.protocol + COLON_SLASH_SLASH + host + requestObject.url,
         method: requestObject.method,
         data: requestObject.body,
         headers: requestObject.headers,
@@ -141,7 +196,7 @@ function parseAxiosHttpRequestToFuzz (requestObject) {
  * set the handler logger
  * @param {*} l
  */
-function setLogger (l) {
+function setLogger(l) {
     logger = l;
 };
 
@@ -149,25 +204,29 @@ function setLogger (l) {
  * Sets the last fuzz event time epoch
  * @param {Number} time
  */
-function setLastFuzzEnventTime (time = Date.now()) {
-    if (isWorkerSupported()) {
-        process.env[CSEC_LAST_FUZZ_REQUEST_TIME] = time;
-    } else {
-        lastFuzzEventTime = time;
-    }
+function setLastFuzzEventTime(time = Date.now()) {
+    lastFuzzEventTime = time;
 }
 
+
 /**
- * Returns last fuzz event time epoch
- * @returns {Number} lastFuzzEventTime
+ * Sets the last fuzz event time epoch
+ * @param {Number} time
  */
-function getLastFuzzEnventTime () {
-    return isWorkerSupported() ? Number.parseInt(process.env[CSEC_LAST_FUZZ_REQUEST_TIME]) : lastFuzzEventTime;
+function setAdditionalCoolDown(timeInSeconds) {
+    additionalCoolDownTime = timeInSeconds ? timeInSeconds : 10;
+    if (coolDownIntervalConst) {
+        clearTimeout(coolDownIntervalConst)
+    }
+    coolDownIntervalConst = setTimeout(() => {
+        additionalCoolDownTime = 0;
+    }, timeInSeconds * 1000);
 }
 
 module.exports = {
     handler,
     setLogger,
-    setLastFuzzEnventTime,
-    getLastFuzzEnventTime
+    setLastFuzzEventTime,
+    startIASTSchedular,
+    setAdditionalCoolDown
 };

package/lib/nr-security-agent/lib/core/connections/websocket/response/iast-cool-down.js

@@ -0,0 +1,15 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+
+let logger;
+
+module.exports.handler = function handler (json) {
+    logger.debug('IAST cool down command received:', JSON.stringify(json));
+    const fuzzRequestHandler = require('./fuzz-request-handler');
+    fuzzRequestHandler.setLastFuzzEventTime();
+    fuzzRequestHandler.setAdditionalCoolDown(json.data);
+};
+
+module.exports.setLogger = l => { logger = l };

package/lib/nr-security-agent/lib/core/connections/websocket/response/iast-record-deletion.js

@@ -0,0 +1,19 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+
+let logger;
+const IASTUtil = require('./IASTUtils');
+module.exports.handler = function handler (json) {
+    let deletionList =  json.arguments;
+    let count = 0;
+    deletionList.forEach(element => {
+        count++;
+        IASTUtil.removeRequestId(element);
+    });
+    logger.debug("Purging confirmed %s IAST processed records: ", count, JSON.stringify(deletionList));
+
+};
+
+module.exports.setLogger = l => { logger = l };

package/lib/nr-security-agent/lib/core/connections/websocket/response/index.js

@@ -13,6 +13,10 @@ const CollectorPolicyHandler = require('./collector-policy-handler');
 const CollectorPolicyErrorHandler = require('./collecotor-policy-error-handler');
 const NoOpHandler = require('./no-op-handler');
 const WSReconnect = require('./ws-reconnect');
+const coolDown = require('./iast-cool-down');
+const recordDeletion = require('./iast-record-deletion');
+const logs = require('../../../logging');
+let logger = logs.getLogger();
 
 const commandHandlerMap = {
     [SERVER_COMMAND.STARTUP_WELCOME_MSG]: StartupHandshakeHandler,
@@ -20,15 +24,23 @@ const commandHandlerMap = {
     [SERVER_COMMAND.FUZZ_REQUEST]: FuzzRequestHandler,
     [SERVER_COMMAND.COLLECTOR_CONFIG]: CollectorPolicyHandler,
     [SERVER_COMMAND.POLICY_ERROR]: CollectorPolicyErrorHandler,
-    [SERVER_COMMAND.OBEY_WS_RECONNECT]: WSReconnect
+    [SERVER_COMMAND.OBEY_WS_RECONNECT]: WSReconnect,
+    [SERVER_COMMAND.IAST_RECORD_DELETE_CONFIRMATION]:recordDeletion,
+    [SERVER_COMMAND.ENTER_IAST_COOLDOWN]:coolDown
 };
 
 const handle = function handle (json) {
-    if (json && json.controlCommand && json.arguments && commandHandlerMap[json.controlCommand]) {
-        commandHandlerMap[json.controlCommand].handler.call(this, json);
-    } else {
-        NoOpHandler.handler.call(this, json);
+    try {
+        if (json && json.controlCommand && json.arguments && commandHandlerMap[json.controlCommand]) {
+            logger.debug("Incoming Control Command:", JSON.stringify(json));
+            commandHandlerMap[json.controlCommand].handler.call(this, json);
+        } else {
+            NoOpHandler.handler.call(this, json);
+        }
+    } catch (error) {
+        logger.error("Error in handling Control Commnad",error);
     }
+    
 };
 
 const setLogger = function setLogger (logger) {