@newrelic/security-agent 0.2.1 → 0.4.0

package/CHANGELOG.md

@@ -1,3 +1,24 @@
+### v0.4.0 (2023-10-27)
+#### Features
+* Added event stats for RASP, IAST and exit events in healthcheck. 
+#### Miscellaneous chores
+* Deps: Updated uuid to v9.0.1 and @aws-sdk/client-lambda to v3.405.0
+* Upgraded axios to 1.6.0 to resolve CVE-2023-45857 
+#### Continuous integration
+* Removed Node.js 14.x from CI.
+* Added should_skip flag to skip CI based on label.
+
+### v0.3.0 (2023-09-25)
+#### Features
+* Last leg acknowledgement in IAST scanning.
+#### Bug Fixes
+* Fix for mysql query params in security events.
+* Logging update for default log level and status file flags.
+* Update in IAST batch size processing.
+* Disable instrumentation when security enabled flag is set to false
+#### Miscellaneous Chores
+* Readme update
+
 ### v0.2.1 (2023-08-07)
 #### Bug Fixes
 * Pinned check-disk-space to v3.3.1 to support Node.js v14

package/README.md

@@ -42,7 +42,7 @@ The `@newrelic/security-agent` must be explicitly enabled in order to perform IA
 The [Developer docs](http://newrelic.github.io/node-newrelic/) for writing instrumentation will be of help. We particularly recommend the [tutorials](https://newrelic.github.io/node-newrelic/tutorial-Instrumentation-Basics.html) and the [shim API](https://newrelic.github.io/node-newrelic/Shim.html) documentation.
 
 ### Supported  Node.js Versions
-- Node version 14.x, 16.x and 18.x
+- Node version 16.x, 18.x and 20.x
 
 ### Supported  Modules
 
@@ -56,7 +56,7 @@ The [Developer docs](http://newrelic.github.io/node-newrelic/) for writing instr
 - [pg](https://www.npmjs.com/package/pg)(7.x and above)
 - [mongodb](https://www.npmjs.com/package/mongodb)(2.x, 3.x and 4.x)
 - [express](https://www.npmjs.com/package/express)(4.x and above)
-- [@koa/router](https://www.npmjs.com/package/@koa/router) ((9.x and above)
+- [@koa/router](https://www.npmjs.com/package/@koa/router) (9.x and above)
 - [koa-router](https://www.npmjs.com/package/koa-router)(9.x and above)
 - [@hapi/hapi](https://www.npmjs.com/package/@hapi/hapi)(19.x and above)
 - [fastify](https://www.npmjs.com/package/fastify)(2.x, 3.x and 4.x)

package/THIRD_PARTY_NOTICES.md

@@ -75,7 +75,7 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 
 ### @aws-sdk/client-lambda
 
-This product includes source derived from [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3) ([v3.379.1](https://github.com/aws/aws-sdk-js-v3/tree/v3.379.1)), distributed under the [Apache-2.0 License](https://github.com/aws/aws-sdk-js-v3/blob/v3.379.1/LICENSE):
+This product includes source derived from [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3) ([v3.435.0](https://github.com/aws/aws-sdk-js-v3/tree/v3.435.0)), distributed under the [Apache-2.0 License](https://github.com/aws/aws-sdk-js-v3/blob/v3.435.0/LICENSE):
 
 ```
                                 Apache License
@@ -284,28 +284,16 @@ This product includes source derived from [@aws-sdk/client-lambda](https://githu
 
 ### axios
 
-This product includes source derived from [axios](https://github.com/axios/axios) ([v0.21.4](https://github.com/axios/axios/tree/v0.21.4)), distributed under the [MIT License](https://github.com/axios/axios/blob/v0.21.4/LICENSE):
+This product includes source derived from [axios](https://github.com/axios/axios) ([v1.6.0](https://github.com/axios/axios/tree/v1.6.0)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.6.0/LICENSE):
 
 ```
-Copyright (c) 2014-present Matt Zabriskie
+# Copyright (c) 2014-present Matt Zabriskie & Collaborators
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
 
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
 
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ```
 
@@ -790,7 +778,7 @@ THE SOFTWARE.
 
 ### uuid
 
-This product includes source derived from [uuid](https://github.com/uuidjs/uuid) ([v9.0.0](https://github.com/uuidjs/uuid/tree/v9.0.0)), distributed under the [MIT License](https://github.com/uuidjs/uuid/blob/v9.0.0/LICENSE.md):
+This product includes source derived from [uuid](https://github.com/uuidjs/uuid) ([v9.0.1](https://github.com/uuidjs/uuid/tree/v9.0.1)), distributed under the [MIT License](https://github.com/uuidjs/uuid/blob/v9.0.1/LICENSE.md):
 
 ```
 The MIT License (MIT)

package/lib/instrumentation-security/hooks/express/nr-express.js

@@ -75,6 +75,9 @@ function wrapExpress4(shim, express) {
  * @param {*} req 
  */
 function extractParams(shim, req) {
+  if (!requestManager.getRequest(shim)) {
+    secUtils.addRequestData(shim, req);
+  }
   const segment = shim.getActiveSegment();
   if (segment && segment.transaction) {
     let request = requestManager.getRequestFromId(segment.transaction.id);

package/lib/instrumentation-security/hooks/http/nr-http.js

@@ -36,7 +36,7 @@ const semver = require('semver');
 const CSEC_SEP = ':IAST:';
 const find = '{{NR_CSEC_VALIDATOR_HOME_TMP}}';
 const CSEC_HOME_TMP_CONST = new RegExp(find, 'g');
-const CSEC_HOME = NRAgent && NRAgent.config && NRAgent.config.newrelic_home ? NRAgent.config.newrelic_home : require('path').join(process.cwd());
+let CSEC_HOME = NRAgent && NRAgent.config.newrelic_home ? NRAgent.config.newrelic_home : NRAgent && NRAgent.config.logging.filepath ? path.dirname(NRAgent.config.logging.filepath) : require('path').join(process.cwd());
 const CSEC_HOME_TMP = `${CSEC_HOME}/nr-security-home/tmp/language-agent/${process.env.applicationUUID}`
 
 /**

package/lib/instrumentation-security/hooks/mysql/nr-mysql.js

@@ -177,11 +177,16 @@ function wrapQueryable(shim, queryable, isPoolQuery) {
  * @returns 
  */
 function containsOnlyStrings(list) {
-  for (let i = 0; i < list.length; i++) {
-    if (typeof list[i] !== 'string') {
-      return false;
+  try {
+    for (let i = 0; i < list.length; i++) {
+      if (typeof list[i] !== 'string') {
+        list[i] = list[i].toString();
+      }
     }
+  } catch (error) {
+    return false;
   }
+
   return true;
 }
 
@@ -202,6 +207,13 @@ function extractQueryArgs(shim, args) {
   } else {
     // query(opts [, values], callback)
     rawQuery = args[0].sql;
+    try {
+      if (args[0].values && typeof args[0].values  == 'object') {
+        param = Object.values(args[0].values)
+      }
+    } catch (error) {
+      logger.warn("Not able to extract params for mysql")
+    }
   }
   // Then determine the query values and callback parameters.
   if (shim.isArray(args[1])) {
@@ -210,9 +222,9 @@ function extractQueryArgs(shim, args) {
   }
   else if (args[1] && typeof args[1] == 'object') {
     param = args[1];
-    param =  Object.values(param)
+    param = Object.values(param)
   }
-  if(!containsOnlyStrings(param)){
+  if (!containsOnlyStrings(param)) {
     param = [];
   }
   return {

package/lib/instrumentation-security/index.js

@@ -12,6 +12,7 @@ logger.info("Started instrumentation using shimmer module");
 
 newrelic.instrument({
   moduleName: 'child_process',
+  isEsm: true,
   onRequire: require('./hooks/native/nr-childProcess'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -19,6 +20,7 @@ newrelic.instrument({
 })
 newrelic.instrument({
   moduleName: 'http',
+  isEsm: true,
   onRequire: require('./hooks/http/nr-http'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -27,6 +29,7 @@ newrelic.instrument({
 
 newrelic.instrument({
   moduleName: 'https',
+  isEsm: true,
   onRequire: require('./hooks/http/nr-http'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -35,6 +38,7 @@ newrelic.instrument({
 
 newrelic.instrument({
   moduleName: 'fs',
+  isEsm: true,
   onRequire: require('./hooks/fs/nr-fs'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -43,6 +47,7 @@ newrelic.instrument({
 
 newrelic.instrumentWebframework({
   moduleName: 'express',
+  isEsm: true,
   onRequire: require('./hooks/express/nr-express'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -51,6 +56,7 @@ newrelic.instrumentWebframework({
 
 newrelic.instrumentDatastore({
   moduleName: 'mysql',
+  isEsm: true,
   onRequire: require('./hooks/mysql/nr-mysql'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -59,6 +65,7 @@ newrelic.instrumentDatastore({
 
 newrelic.instrumentDatastore({
   moduleName: 'mysql2',
+  isEsm: true,
   onRequire: require('./hooks/mysql/nr-mysql'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -67,6 +74,7 @@ newrelic.instrumentDatastore({
 
 newrelic.instrumentDatastore({
   moduleName: 'mongodb',
+  isEsm: true,
   onRequire: require('./hooks/mongodb/nr-mongodb'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -75,6 +83,7 @@ newrelic.instrumentDatastore({
 
 newrelic.instrument({
   moduleName: 'ldapjs',
+  isEsm: true,
   onRequire: require('./hooks/ldap/nr-ldap'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -83,6 +92,7 @@ newrelic.instrument({
 
 newrelic.instrument({
   moduleName: 'ldapts',
+  isEsm: true,
   onRequire: require('./hooks/ldap/nr-ldap'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -92,6 +102,7 @@ newrelic.instrument({
 
 newrelic.instrument({
   moduleName: 'xpath',
+  isEsm: true,
   onRequire: require('./hooks/xpath/nr-xpath'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -99,6 +110,7 @@ newrelic.instrument({
 })
 newrelic.instrument({
   moduleName: 'xpath.js',
+  isEsm: true,
   onRequire: require('./hooks/xpath/nr-xpath'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -107,6 +119,7 @@ newrelic.instrument({
 
 newrelic.instrumentDatastore({
   moduleName: 'pg',
+  isEsm: true,
   onRequire: require('./hooks/postgres/nr-postgres'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -115,6 +128,7 @@ newrelic.instrumentDatastore({
 
 newrelic.instrumentWebframework({
   moduleName: 'fastify',
+  isEsm: true,
   onRequire: require('./hooks/fastify/nr-fastify'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -124,6 +138,7 @@ newrelic.instrumentWebframework({
 
 newrelic.instrumentWebframework({
   moduleName: 'restify',
+  isEsm: true,
   onRequire: require('./hooks/restify/nr-restify'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -132,6 +147,7 @@ newrelic.instrumentWebframework({
 
 newrelic.instrumentWebframework({
   moduleName: '@koa/router',
+  isEsm: true,
   onRequire: require('./hooks/koa/@koa/nr-@koa-router'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -140,6 +156,7 @@ newrelic.instrumentWebframework({
 
 newrelic.instrumentWebframework({
   moduleName: 'koa-router',
+  isEsm: true,
   onRequire: require('./hooks/koa/@koa/nr-@koa-router'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -148,6 +165,7 @@ newrelic.instrumentWebframework({
 
 newrelic.instrumentWebframework({
   moduleName: '@hapi/hapi',
+  isEsm: true,
   onRequire: require('./hooks/hapi/nr-hapi'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)
@@ -156,6 +174,7 @@ newrelic.instrumentWebframework({
 
 newrelic.instrumentWebframework({
   moduleName: 'director',
+  isEsm: true,
   onRequire: require('./hooks/director/nr-director'),
   onError: function intrumentErrorHandler(err) {
     logger.error(err.message, err.stack)

package/lib/nr-security-agent/index.js

@@ -159,6 +159,10 @@ function getProcCMDLineSanitized(applicationInfoModule) {
 }
 
 (() => {
+    if(!NRAgent.config.security.enabled){
+        logger.warn("security.enabled flag is set to false");
+        return;
+    }
     if (initialize()) {
         require('../instrumentation-security');
         initLogger.info("[STEP-6] => Application instrumentation applied successfully");

package/lib/nr-security-agent/lib/core/Auth-headers.js

@@ -21,7 +21,7 @@ function AuthHeaders() {
         const NRAgent = API.getNRAgent();
         authHeaders = {}
         authHeaders['NR-CSEC-CONNECTION-TYPE'] = 'LANGUAGE_COLLECTOR';
-        authHeaders['NR-AGENT-RUN-TOKEN'] =  NRAgent.config.run_id;
+        authHeaders['NR-AGENT-RUN-TOKEN'] = NRAgent.config.run_id;
         const COLLECTOR_VERSION = appInfo.collectorVersion || '';
         authHeaders['NR-CSEC-VERSION'] = COLLECTOR_VERSION.trim();
         authHeaders['NR-CSEC-COLLECTOR-TYPE'] = 'NODE';
@@ -29,7 +29,7 @@ function AuthHeaders() {
         authHeaders['NR-CSEC-APP-UUID'] = commonUtils.getUUID();
         authHeaders['NR-CSEC-JSON-VERSION'] = appInfo.jsonVersion;
         authHeaders['NR-CSEC-BUILD-NUMBER'] = appInfo.buildNumber;
-        authHeaders['NR-ACCOUNT-ID'] =  NRAgent.config.account_id;
+        authHeaders['NR-ACCOUNT-ID'] = NRAgent.config.account_id;
         authHeaders['NR-LICENSE-KEY'] = NRAgent ? NRAgent.config.license_key : '';
         authHeaders["NR-CSEC-IAST-DATA-TRANSFER-MODE"] = "PULL";
     } catch (error) {
@@ -49,6 +49,21 @@ AuthHeaders.prototype.constructor = AuthHeaders;
 function getInstance() {
     if (!authHeaders) {
         authHeaders = new AuthHeaders();
+        try {
+            for (const key in authHeaders) {
+                if (authHeaders.hasOwnProperty(key)) {
+                    if (key != 'NR-LICENSE-KEY') {
+                        logger.info(`Adding WS connection header: ${key} -> ${authHeaders[key]}`)
+                    }
+                    else {
+                        logger.info(`Adding WS connection header: ${key} -> ******`)
+                    }
+
+                }
+            }
+        } catch (error) {
+            logger.error("Error while getting authentication headers");
+        }
     }
     return authHeaders;
 }

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -26,13 +26,13 @@ let websocketHealth;
  * Utility to generate UUID
  * @returns UUID
  */
-function getUUID(){
+function getUUID() {
     let uuid = process.env.applicationUUID || uuidV.v4();
     process.env.applicationUUID = uuid;
     return uuid;
 }
 
-function getKindIdPair (identifier, hostId) {
+function getKindIdPair(identifier, hostId) {
     const obj = {};
     if (identifier.isContainer) {
         obj.first = 'CONTAINER';
@@ -54,7 +54,7 @@ function getKindIdPair (identifier, hostId) {
  * Utility to check worker thread support
  * @returns 
  */
-function hasWorker () {
+function hasWorker() {
     let workerFlag = false;
     try {
         require('worker_threads');
@@ -65,7 +65,7 @@ function hasWorker () {
     return workerFlag;
 }
 
-function runtimeSupportsFunctionGenerators () {
+function runtimeSupportsFunctionGenerators() {
     try {
         // eslint-disable-next-line no-eval
         eval('"use strict"; (function* () {})');
@@ -76,7 +76,7 @@ function runtimeSupportsFunctionGenerators () {
     return process.csecRuntimeSupportsFunctionGenerators;
 }
 
-function runtimeSupportsAsyncFunctionGenerators () {
+function runtimeSupportsAsyncFunctionGenerators() {
     try {
         // eslint-disable-next-line no-eval
         eval('"use strict"; (async function* () {})');
@@ -91,7 +91,7 @@ function runtimeSupportsAsyncFunctionGenerators () {
  * Utility to create directory and set permissions
  * @param {*} dir 
  */
-function createPathIfNotExist (dir) {
+function createPathIfNotExist(dir) {
     try {
         if (!fs.existsSync(dir)) {
             fs.mkdirSync(dir, 777, { recursive: true });
@@ -110,7 +110,7 @@ function createPathIfNotExist (dir) {
  * Utility to get OS
  * @returns 
  */
-function getOS () {
+function getOS() {
     if (process.platform === 'darwin') {
         return 'mac';
     }
@@ -124,7 +124,7 @@ function getOS () {
 /**
  * Utility to create directories
  */
-function createDirectories () {
+function createDirectories() {
     createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home`);
     createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}logs`);
     createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}logs${SLASH}snapshots`);
@@ -140,7 +140,7 @@ function createDirectories () {
 /**
  * Utility to check init setup and disk space
  */
-async function initialSetup () {
+async function initialSetup() {
     try {
         createDirectories();
     } catch (err) {
@@ -151,7 +151,7 @@ async function initialSetup () {
 /**
  * Utility function to check if the logfile is accessible or not.
  */
-function isLogAccessible (logFileName) {
+function isLogAccessible(logFileName) {
     return new Promise((resolve) => {
         if (logFileName === njsAgentConstants.STATUS_LOG_FILE && require('./statusUtils').getBufferedHC().length === 0) {
             resolve('OK');
@@ -159,7 +159,11 @@ function isLogAccessible (logFileName) {
         fs.access(logFileName, fs.constants.F_OK | fs.constants.W_OK, (err) => {
             if (err) {
                 resolve('Error');
-            } else {
+            }
+            else if ((!logs.isLoggerOk || logger.level.levelStr == 'OFF') && logFileName != njsAgentConstants.STATUS_LOG_FILE) {
+                resolve('Error');
+            }
+            else {
                 resolve('OK');
             }
         });
@@ -172,7 +176,7 @@ function isLogAccessible (logFileName) {
  * Utility function to get CPU Usage in percentage
  * @param {*} oldUsage
  */
-function getCpuUsage () {
+function getCpuUsage() {
     const usageObj = process.cpuUsage();
     const userUsage = usageObj.user / (usageObj.user + usageObj.system);
     return userUsage;
@@ -183,7 +187,7 @@ function getCpuUsage () {
  * @param {*} bytes
  * @param {*} decimals
  */
-function formatBytesToMB (bytes, decimals = 2) {
+function formatBytesToMB(bytes, decimals = 2) {
     return parseFloat((bytes / (1024 * 1024)).toFixed(decimals));
 }
 
@@ -191,34 +195,34 @@ function formatBytesToMB (bytes, decimals = 2) {
  * Utility to get diskSpace infor for the give path
  * @param {*} path
  */
-async function getDiskSpace (path) {
+async function getDiskSpace(path) {
     try {
-        const x = await checkDiskSpace(path).catch(() => {});
+        const x = await checkDiskSpace(path).catch(() => { });
         return x;
     } catch (error) {
-        logger.error("Error in getting diskpace:",error)
+        logger.error("Error in getting diskpace:", error)
     }
 }
 
 /**
  * Utility to get HC stats
  */
-async function getHCStats () {
+async function getHCStats() {
     const stats = {};
     try {
         const appInfo = require('./applicationinfo').getInstance();
         const rootDiskSpace = await getDiskSpace(path.parse(process.cwd()).root);
         if (appInfo && appInfo.serverInfo && appInfo.serverInfo.deployedApplications[0] && appInfo.serverInfo.deployedApplications[0].deployedPath) {
             const processDirDiskFreeSpace = await getDiskSpace(appInfo.serverInfo.deployedApplications[0].deployedPath);
-            if(processDirDiskFreeSpace){
-            stats.processDirDiskFreeSpaceMB = formatBytesToMB(processDirDiskFreeSpace.free);
+            if (processDirDiskFreeSpace) {
+                stats.processDirDiskFreeSpaceMB = formatBytesToMB(processDirDiskFreeSpace.free);
             }
         }
         const memoryObj = process.memoryUsage();
-        if(rootDiskSpace){
+        if (rootDiskSpace) {
             stats.rootDiskFreeSpaceMB = formatBytesToMB(rootDiskSpace.free);
         }
-      
+
         stats.processHeapUsageMB = formatBytesToMB(memoryObj.heapUsed);
         stats.processRssMB = formatBytesToMB(memoryObj.rss);
         stats.processMaxHeapMB = formatBytesToMB(memoryObj.heapTotal);
@@ -235,23 +239,23 @@ async function getHCStats () {
 /**
  * Utility to check Agent status
  */
-function isAgentActiveState () {
-    if (AgentStatus.getInstance().getStatus() === AgentStatus.CSECAgentStatus.codes.ACTIVE && (NRAgent ? (NRAgent.config.security.enabled && NRAgent.canCollectData()) : true) && getWSHealthStatus()=='OK') {
+function isAgentActiveState() {
+    if (AgentStatus.getInstance().getStatus() === AgentStatus.CSECAgentStatus.codes.ACTIVE && (NRAgent ? (NRAgent.config.security.enabled && NRAgent.canCollectData()) : true) && getWSHealthStatus() == 'OK') {
         return 'OK';
     } else {
         return 'Error';
     }
 }
 
-function iastRestClientStatus () {
+function iastRestClientStatus() {
     return 'OK';
 }
 /**
  * Utiltity to remove older snapshots
  */
-function removeOlderSnapshots () {
+function removeOlderSnapshots() {
     try {
-        const basePath = njsAgentConstants.LOG_DIR + 'snapshots'+ SLASH;
+        const basePath = njsAgentConstants.LOG_DIR + 'snapshots' + SLASH;
         const directoryContent = fs.readdirSync(basePath);
         const files = directoryContent.filter((filename) => {
             return fs.statSync(`${basePath}${SLASH}${filename}`).isFile();
@@ -282,7 +286,7 @@ function removeOlderSnapshots () {
 /**
  * Utilty to remove older log files.
  */
-function removeOlderlogfiles () {
+function removeOlderlogfiles() {
     try {
         const basePath = njsAgentConstants.LOG_DIR;
         const directoryContent = fs.readdirSync(basePath);
@@ -297,8 +301,11 @@ function removeOlderlogfiles () {
             const secondStat = fs.statSync(`${basePath}${SLASH}${b}`);
             return new Date(secondStat.mtime).getTime() - new Date(firstStat.mtime).getTime();
         });
-
-        for (let i = 2; i < sorted.length; i++) {
+        let maxLogfile = process.env.NR_CSEC_DEBUG_LOGFILE_MAX_COUNT;
+        if(isNaN(maxLogfile)){
+            maxLogfile = 2;
+        }
+        for (let i = maxLogfile; i < sorted.length; i++) {
             const fileToDelete = basePath + sorted[i];
             try {
                 fs.unlink(fileToDelete, (err) => {
@@ -320,7 +327,7 @@ function removeOlderlogfiles () {
 /**
  * utilty to roll over the log file. Not in use
  */
-function logRollOver () {
+function logRollOver() {
     const logFileName = `${njsAgentConstants.LOG_DIR}node-security-collector.log`;
     try {
         const stats = fs.statSync(logFileName);
@@ -338,7 +345,7 @@ function logRollOver () {
         if (!fs.existsSync(lockFile)) {
             fs.writeFileSync(lockFile, pid.toString());
         }
-        const fileData = fs.readFileSync(lockFile).toString(); 
+        const fileData = fs.readFileSync(lockFile).toString();
         if (pid.toString() === fileData) {
             try {
                 const newLogFile = logFileName + '.' + Date.now();
@@ -360,9 +367,9 @@ function logRollOver () {
  * Utility to get validator service endpoint
  * @returns 
  */
-function getValidatorServiceEndpointURL(){
-    let validatorServiceEndpointURL = NRAgent ? NRAgent.config.security.validator_service_url: "wss://csec.nr-data.net";
-    if(lodash.isEmpty(validatorServiceEndpointURL)){
+function getValidatorServiceEndpointURL() {
+    let validatorServiceEndpointURL = NRAgent ? NRAgent.config.security.validator_service_url : "wss://csec.nr-data.net";
+    if (lodash.isEmpty(validatorServiceEndpointURL)) {
         validatorServiceEndpointURL = "wss://csec.nr-data.net";
     }
     return validatorServiceEndpointURL
@@ -372,7 +379,7 @@ function getValidatorServiceEndpointURL(){
  * Utility to get security mode
  * @returns 
  */
-function getCSECmode(){
+function getCSECmode() {
     const mode = NRAgent ? NRAgent.config.security.mode : 'IAST';
     return mode
 }
@@ -381,9 +388,9 @@ function getCSECmode(){
  * Utility to get path of CA Cert
  * @returns 
  */
-function getPathOfCACert(){
+function getPathOfCACert() {
     let relativePath = path.resolve(__dirname, '../../resources/cert.pem');
-    if(process.platform == 'win32'){
+    if (process.platform == 'win32') {
         relativePath = path.resolve(__dirname, '..\\..\\resources\\cert.pem');
     }
     const certPath = NRAgent && NRAgent.config.security.ca_bundle_path ? NRAgent.config.security.ca_bundle_path : relativePath;
@@ -393,7 +400,7 @@ function getPathOfCACert(){
  * Setting ws health status
  * @param {*} status 
  */
-function setWSHealthStatus(status){
+function setWSHealthStatus(status) {
     websocketHealth = status;
 }
 
@@ -401,11 +408,11 @@ function setWSHealthStatus(status){
  * Returns value of websocketHealth
  * @returns websocketHealth
  */
-function getWSHealthStatus(){
-    if(!websocketHealth){
+function getWSHealthStatus() {
+    if (!websocketHealth) {
         return 'Error';
     }
-    else{
+    else {
         return websocketHealth;
     }
 }

package/lib/nr-security-agent/lib/core/connections/websocket/response/IASTUtils.js

@@ -3,20 +3,53 @@
  * SPDX-License-Identifier: New Relic Pre-Release
  */
 const { Agent } = require('../../../agent');
-let completedRequestIds = new Set();
+let pendingRequestIds = new Set();
+let completedRequestsMap = new Map();
 const PolicyManager = require('../../../Policy');
 let batchSize;
-const batchthreshold = 300;
-function getCompletedRequestIds() {
-    return [...completedRequestIds];
+const batchthreshold = 160;
+function getPendingRequestIds() {
+    return [...pendingRequestIds];
 }
 
-function addRequestId(id) {
-    completedRequestIds.add(id);
+function addPendingRequestId(id) {
+    pendingRequestIds.add(id);
 }
 
 function removeRequestId(id) {
-    completedRequestIds.delete(id);
+    completedRequestsMap.delete(id);
+}
+
+function removePendingRequestId(id) {
+    pendingRequestIds.delete(id);
+}
+
+// for last leg
+function completedRequestsMapInit(id) {
+    completedRequestsMap.set(id, []);
+}
+
+function addCompletedRequests(id, eventId) {
+    let data = completedRequestsMap.get(id);
+    data.push(eventId);
+    completedRequestsMap.set(id, data);
+}
+
+function getCompletedRequestsMap() {
+    return completedRequestsMap;
+}
+
+function clearCompletedRequestMap(){
+    completedRequestsMap.clear();
+}
+
+function clearPendingRequestIdSet(){
+    pendingRequestIds.clear();
+}
+
+function IASTCleanup(){
+    clearCompletedRequestMap();
+    clearPendingRequestIdSet();
 }
 
 function generateIASTDataRequest() {
@@ -27,24 +60,34 @@ function generateIASTDataRequest() {
             batchSize = policyInstance.data.vulnerabilityScan.iastScan.probing.batchSize;
         }
     }
-    if (getCompletedRequestIds().length >= batchSize || batchSize < batchthreshold) {
+    if (getCompletedRequestsMap().size >= batchSize || batchSize < batchthreshold || getPendingRequestIds().length < batchSize) {
         batchSize = (2 * batchSize);
     }
     let object = {};
     object['jsonName'] = 'iast-data-request';
     object['applicationUUID'] = Agent.getAgent().applicationInfo.applicationUUID;
     object["batchSize"] = batchSize ? batchSize : 300;
-    object['completedRequestIds'] = getCompletedRequestIds();
+    object['pendingRequestIds'] = getPendingRequestIds();
+    object['completedRequests'] = Object.fromEntries(getCompletedRequestsMap());
     return object;
-
 }
 
 
 module.exports = {
-    getCompletedRequestIds,
-    addRequestId,
-    removeRequestId,
+    getPendingRequestIds,
+    addPendingRequestId,
+    removePendingRequestId,
     generateIASTDataRequest,
+
+    // for last leg
+    addCompletedRequests,
+    completedRequestsMapInit,
+    getCompletedRequestsMap,
+    removeRequestId,
+    IASTCleanup
+
+
+
 }
 
 

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -9,13 +9,12 @@ const stringify = require('fast-safe-stringify');
 const restClient = require('../../restclient');
 const { Agent } = require('../../../agent');
 const { FuzzFailEvent } = require('../../../FuzzFailEvent');
-const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH } = require('../../../sec-agent-constants');
+const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH, CSEC_SEP } = require('../../../sec-agent-constants');
 const LOCALHOST = 'localhost';
 const COLON_SLASH_SLASH = '://';
 const http = require('http');
 const https = require('https');
 const IASTUtil = require('./IASTUtils');
-const CSEC_SEP = ':IAST:';
 
 require('dns').setDefaultResultOrder('ipv4first')
 
@@ -46,10 +45,12 @@ function startIASTSchedular() {
     iastIntervalConst = setInterval(() => {
         let data = IASTUtil.generateIASTDataRequest();
         let currentTime = Date.now();
-        let completedListSize = IASTUtil.getCompletedRequestIds().length;
+        let completedListSize = IASTUtil.getCompletedRequestsMap().size;
+        let pendingListSize = IASTUtil.getPendingRequestIds().length;
         let timeDiffInSeconds = ((currentTime - lastFuzzEventTime) / 1000);
         logger.trace("Time difference since last fuzz request:", timeDiffInSeconds);
         logger.trace("Completed requests so far:", completedListSize);
+        logger.trace("Pending requests so far:", pendingListSize);
 
         if (timeDiffInSeconds > 5 && additionalCoolDownTime == 0) {
             Agent.getAgent().client.dispatcher(data);
@@ -83,10 +84,7 @@ function handler(json) {
     try {
         fuzzRequest = JSON.parse(rawFuzzRequest);
         fuzzRequest['id'] = json.id;
-        let completedList = IASTUtil.getCompletedRequestIds();
-        if (completedList.includes(json.id)) {
-            return;
-        }
+        IASTUtil.addPendingRequestId(json.id);
     } catch (error) {
         logger.error('Parsing exeception in fuzz request: ', error);
     }
@@ -130,6 +128,10 @@ function handleFuzzRequest(fuzzDetails) {
                 }
             }
 
+            config.headers['nr-csec-parent-id'] = fuzzRequest.id;
+
+            IASTUtil.completedRequestsMapInit(fuzzRequest.id);
+
             if(fuzzRequest.headers && fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]){
                 logScannedApiId(fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID], fuzzRequest.requestURI)
             }
@@ -161,7 +163,7 @@ function handleFuzzRequest(fuzzDetails) {
 function handleFuzzResponse(response, fuzzDetails) {
     const { rawFuzzRequest, fuzzRequest } = fuzzDetails;
     if (response) {
-        IASTUtil.addRequestId(fuzzRequest.id);
+        IASTUtil.removePendingRequestId(fuzzRequest.id);
         response.then(() => {
             logger.info('Fuzz success: ' + rawFuzzRequest);
         }).catch(() => {
@@ -178,7 +180,10 @@ function handleFuzzResponse(response, fuzzDetails) {
  */
 function parseAxiosHttpRequestToFuzz(requestObject) {
     let serverName = requestObject.serverName ? requestObject.serverName : LOCALHOST;
-    let host = serverName + COLON + requestObject.serverPort
+    let host = serverName + COLON + requestObject.serverPort;
+    if(requestObject.headers && requestObject.headers['content-length']){
+        delete requestObject.headers['content-length'];
+    }
     return {
         url: requestObject.protocol + COLON_SLASH_SLASH + host + requestObject.url,
         method: requestObject.method,

package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js

@@ -9,16 +9,18 @@ const WebSocket = require('ws');
 const RingBuffer = require('ringbufferjs');
 const stringify = require('fast-safe-stringify');
 const { EventEmitter } = require('events');
-
+const API = require('../../../../../nr-security-api');
+const NRAgent = API.getNRAgent();
 const { Agent } = require('../../agent');
 const logs = require('../../logging');
 const hc = require('../../health-check');
 const fs = require('fs');
 const { promisify } = require('../../sec-util');
 const ResponseHandler = require('./response');
-const { EMPTY_APPLICATION_UUID, LOG_MESSAGES } = require('../../sec-agent-constants');
+const { EMPTY_APPLICATION_UUID, LOG_MESSAGES, CSEC_SEP, NR_CSEC_FUZZ_REQUEST_ID, EXITEVENT, JSON_NAME, RASP } = require('../../sec-agent-constants');
 const statusUtils = require('../../statusUtils');
 const commonUtils = require('../../commonUtils');
+const IASTUtil = require('../websocket/response/IASTUtils');
 
 const BUSY = 'busy';
 const IDLE = 'idle';
@@ -155,6 +157,7 @@ SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
     }
 
     initTimeOut = setTimeout(() => {
+        IASTUtil.IASTCleanup();
         logger.debug("Terminating ws instance and reconnecting");
         try {
             instance.terminate();
@@ -162,7 +165,7 @@ SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
             logger.debug("Error while terminating ws instance");
         }
         this.init();
-    }, 15000)
+    }, (5 + (Math.floor(Math.random() * 11))) * 1000)
 
 }
 
@@ -200,6 +203,18 @@ SecWebSocket.prototype.dispatch = async function dispatch(event) {
     if (event.jsonName === APPLICATION_INFO_JSON_NAME) {
         APP_INFO = event;
     }
+    if (event.parentId && event.httpRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+        try {
+            let apiId = event.httpRequest.headers[NR_CSEC_FUZZ_REQUEST_ID].split(CSEC_SEP)[0]
+            if (apiId == event.apiId) {
+                IASTUtil.addCompletedRequests(event.parentId, event.id);
+            }
+        } catch (error) {
+            logger.debug("Error while mapping completedRequests:", error);
+        }
+
+    }
+
     RegExp.prototype.toJSON = RegExp.prototype.toString;
     const eventStr = stringify(event);
     if (!this.instance ||
@@ -212,6 +227,20 @@ SecWebSocket.prototype.dispatch = async function dispatch(event) {
     try {
         await promisify(this.instance, this.instance.send)(eventStr, { mask: true }, () => {
             logger.debug(LOG_MESSAGES.EVENT_SENT + eventStr);
+            if (event.jsonName == JSON_NAME.EVENT) {
+
+                if (event.httpRequest && event.httpRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+                    hc.getInstance().iastEventStats.sent++;
+                }
+                else {
+                    hc.getInstance().raspEventStats.sent++;
+                }
+
+            }
+            if (event.jsonName == EXITEVENT) {
+                hc.getInstance().exitEventStats.sent++;
+            }
+
         });
     } catch (error) {
         logger.debug(LOG_MESSAGES.ERROR_WHILE_SEND_EVENT, eventStr, error);
@@ -291,6 +320,13 @@ const handleDispatchFailure = (self, event, eventStr) => {
     // so feeding an old applicationinfo JSON would be incorrect
     if (eventStr && event.jsonName !== APPLICATION_INFO_JSON_NAME) {
         hc.getInstance().registerEventDrop();
+        if (event.httpRequest && event.httpRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+            hc.getInstance().iastEventStats.errorCount++;
+        }
+        else {
+            hc.getInstance().raspEventStats.errorCount++;
+        }
+
     }
 };
 

package/lib/nr-security-agent/lib/core/event-stats.js

@@ -0,0 +1,27 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+
+let eventStats = undefined;
+function EventStats() {
+    this.processed = 0;
+    this.sent = 0;
+    this.rejected = 0;
+    this.errorCount = 0;
+}
+EventStats.prototype.constructor = EventStats;
+
+/**
+ * Returns the current instanceof EventStats
+ * 
+ * @returns {EventStats} instance
+ */
+function getInstance() {
+        return new EventStats();
+}
+
+
+module.exports = {
+    getInstance
+};

package/lib/nr-security-agent/lib/core/event.js

@@ -99,6 +99,7 @@ function SecEvent(fileName, funcName, lineNumber, argument, eid, applicationInfo
     }
     if (httpRequest && httpRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
         this.isIASTRequest = true;
+        this.parentId = httpRequest.headers['nr-csec-parent-id'];
     }
     else {
         this.isIASTRequest = false;

package/lib/nr-security-agent/lib/core/health-check.js

@@ -8,6 +8,7 @@
 const { Agent } = require('./agent');
 const { JSON_NAME } = require('./sec-agent-constants');
 const { BasicInfo } = require('./event');
+const EventStats = require('./event-stats');
 
 const NODE_JS_LITERAL = 'Node.js:';
 
@@ -39,9 +40,10 @@ module.exports.getInstance = function () {
  *
  * @param {ApplicationInfo} info
  */
-function HC (info) {
+function HC(info) {
     BasicInfo.call(this);
 
+
     this.applicationUUID = info.applicationUUID;
     this.eventType = 'sec_health_check_lc';
     if (NRAgent && NRAgent.config) {
@@ -58,7 +60,9 @@ function HC (info) {
     this.buildNumber = info.buildNumber;
     this.jsonName = JSON_NAME.HC;
     this.pid = info.pid;
-
+    this.iastEventStats = EventStats.getInstance();
+    this.raspEventStats = EventStats.getInstance();
+    this.exitEventStats = EventStats.getInstance();
 
 
     /**
@@ -130,6 +134,45 @@ function HC (info) {
         this.httpRequestCount = 0;
     };
 
+    /**
+     * resets the IAST EventStats.
+     */
+    this.resetIASTEventStats = function () {
+        this.iastEventStats.processed = 0;
+        this.iastEventStats.sent = 0;
+        this.iastEventStats.rejected = 0;
+        this.iastEventStats.errorCount = 0;
+    };
+
+    /**
+    * resets the RASP EventStats.
+    */
+    this.resetRASPEventStats = function () {
+        this.raspEventStats.processed = 0;
+        this.raspEventStats.sent = 0;
+        this.raspEventStats.rejected = 0;
+        this.raspEventStats.errorCount = 0;
+    };
+
+    /**
+     * resets the EXIT EventStats.
+     */
+    this.resetEXITEventStats = function () {
+        this.exitEventStats.processed = 0;
+        this.exitEventStats.sent = 0;
+        this.exitEventStats.rejected = 0;
+        this.exitEventStats.errorCount = 0;
+    };
+
+    /**
+    * resets the EventStats.
+    */
+    this.resetEventStats = function () {
+        this.resetIASTEventStats();
+        this.resetRASPEventStats();
+        this.resetEXITEventStats();
+    };
+
 
     /**
      * sets gerate hc timestamp.

package/lib/nr-security-agent/lib/core/logging.js

@@ -24,7 +24,9 @@ const NRAgent = API.getNRAgent();
 const logFileName = `${LOG_DIR}node-security-collector.log`;
 const initLogFileName = `${LOG_DIR}node-security-collector-init.log`;
 let isLoggerOk = true;
-
+const validLogLevels = ["trace", "debug", "info", "warn", "error", "mark", "fatal", "off", "all"];
+const sep = require('path').sep;
+const CSEC_ROOT = `${CSEC_HOME}${sep}nr-security-home${sep}`;
 
 function createLogPathIfNotExist(dir) {
     try {
@@ -45,14 +47,17 @@ function createLogPathIfNotExist(dir) {
  */
 function initialize(applicationUUID) {
     try {
-        const logLevel = NRAgent && NRAgent.config && NRAgent.config.logging.enabled ? NRAgent.config.logging.level : 'info';
+        let logLevel = NRAgent && NRAgent.config && NRAgent.config.logging.enabled ? NRAgent.config.logging.level : 'info';
         const apmLogFilePath = NRAgent && NRAgent.config && NRAgent.config.logging.enabled ? NRAgent.config.logging.filepath : '';
         let appenderType = 'file';
 
-        if (apmLogFilePath === 'stdout') {
+        if (apmLogFilePath === 'stdout' || apmLogFilePath === 'stderr') {
             appenderType = 'stdout';
         }
 
+        if (logLevel && !validLogLevels.includes(logLevel.toLowerCase())) {
+            logLevel = 'info';
+        }
         const appenders = {};
         appenders.NR_CSEC = {
             type: appenderType,
@@ -67,6 +72,7 @@ function initialize(applicationUUID) {
 
 
         createLogPathIfNotExist(CSEC_HOME);
+        createLogPathIfNotExist(CSEC_ROOT);
         createLogPathIfNotExist(LOG_DIR);
 
 
@@ -117,7 +123,7 @@ function initialize(applicationUUID) {
             disableClustering: true
         });
     } catch (error) {
-        console.error("Error while logging into file. Fallback to stdout.", error.message);
+        console.error(`Security agent is unable to write logs into file: ${logFileName}.`, error.message);
         isLoggerOk = false;
     }
 }
@@ -132,7 +138,7 @@ function setLevel(level = INFO) {
         logger.level = level;
     }
     if (!isLoggerOk) {
-        logger.level = INFO;
+        logger.level = "off";
     }
 }
 
@@ -167,7 +173,7 @@ function getLogger(applicationUUID = process.env.applicationUUID) {
         } catch (error) {
         }
         initLogger.info("[STEP-2] => Generating unique identifier:", applicationUUID)
-        if (NRAgent) {
+        if (NRAgent && NRAgent.config.logging.enabled) {
             setLevel(NRAgent.config.logging.level);
         }
 
@@ -196,5 +202,6 @@ module.exports = {
     setLevel,
     getLevel,
     getInitLogger,
-    reCreateLogger
+    reCreateLogger,
+    isLoggerOk
 };

package/lib/nr-security-agent/lib/core/sec-agent-constants.js

@@ -12,7 +12,7 @@ const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
 const sep = require('path').sep;
 
-let CSEC_HOME = NRAgent &&  NRAgent.config.newrelic_home ? NRAgent.config.newrelic_home  : require('path').join(process.cwd());
+let CSEC_HOME = NRAgent && NRAgent.config.newrelic_home ? NRAgent.config.newrelic_home : NRAgent && NRAgent.config.logging.filepath ? path.dirname(NRAgent.config.logging.filepath) : require('path').join(process.cwd());
 const CSEC_GROUP_NAME = NRAgent ? NRAgent.config.security.mode : 'IAST';
 CSEC_HOME = path.resolve(CSEC_HOME);
 const agentStartTime = new Date().toString();
@@ -49,9 +49,9 @@ module.exports = {
         COLLECTOR_CONFIG: 100,
         BLOCKING: 101,
         POLICY_ERROR: 102,
-        OBEY_WS_RECONNECT:12,
-        ENTER_IAST_COOLDOWN:13,
-        IAST_RECORD_DELETE_CONFIRMATION:14
+        OBEY_WS_RECONNECT: 12,
+        ENTER_IAST_COOLDOWN: 13,
+        IAST_RECORD_DELETE_CONFIRMATION: 14
 
     },
     JSON_NAME: {
@@ -105,6 +105,9 @@ module.exports = {
     DOUBLE_DOLLAR: '$$',
     LOADING_MODULE: 'Loading module ',
     EXITEVENT: 'exit-event',
+    CSEC_SEP: ':IAST:',
+    RASP: 'RASP',
+    IAST: 'IAST',
 
     LOG_MESSAGES: {
         LOADED_CSEC_ENVS_MSG: '[STEP-1][COMPLETE][env] Environment Information Gathering Done.',

package/lib/nr-security-agent/lib/core/sec-util.js

@@ -9,9 +9,10 @@ const { SecEvent } = require('./event');
 const logs = require('./logging');
 const { Agent } = require('./agent');
 const shaUtil = require('./sha-size-util');
-const { LOG_MESSAGES, NR_CSEC_FUZZ_REQUEST_ID, COLON, VULNERABLE, EXITEVENT, EMPTY_STR } = require('./sec-agent-constants');
+const { LOG_MESSAGES, NR_CSEC_FUZZ_REQUEST_ID, COLON, VULNERABLE, EXITEVENT, EMPTY_STR, RASP } = require('./sec-agent-constants');
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
+const HC = require('./health-check');
 
 const statusUtils = require('./statusUtils');
 
@@ -66,6 +67,12 @@ function generateSecEvent(securityMetadata) {
     const traceObject = securityMetadata.traceObject;
     const request = securityMetadata.request;
 
+    if(request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+        HC.getInstance().iastEventStats.processed++;
+    }
+    else{
+        HC.getInstance().raspEventStats.processed++;
+    }
     try {
         let stakTrace = traceObject.stacktrace;
         let uri = EMPTY_STR;
@@ -95,6 +102,13 @@ function generateSecEvent(securityMetadata) {
     } catch (e) {
         statusUtils.addErrortoBuffer(e);
         logger.error("Error in generating event:", e);
+       
+        if(request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+            HC.getInstance().iastEventStats.errorCount++;
+        }
+        else{
+            HC.getInstance().raspEventStats.errorCount++;
+        }
     }
 
 }
@@ -122,10 +136,12 @@ function generateExitEvent(secEvent) {
                 exitEvent.executionId = secEvent.id;
                 exitEvent.caseType = secEvent.caseType;
                 exitEvent.k2RequestIdentifier = secEvent.httpRequest.headers[NR_CSEC_FUZZ_REQUEST_ID];
+                HC.getInstance().exitEventStats.processed++;
                 sendEvent(exitEvent);
             }
         } catch (error) {
             logger.error('Error in generating exit event', error);
+            HC.getInstance().exitEventStats.errorCount++;
         }
     }
 }

package/lib/nr-security-agent/lib/core/websocket-client.js

@@ -23,7 +23,7 @@ const {
     }
 } = require('./connections/websocket');
 const { HC_INTERVAL_MS } = require('../../resources/config');
-const { LOG_DIR } = require('./sec-agent-constants');
+const { LOG_DIR, EXITEVENT, JSON_NAME } = require('./sec-agent-constants');
 const statusUtils = require('./statusUtils');
 const njsAgentConstants = require('./sec-agent-constants');
 
@@ -100,6 +100,7 @@ const sendHC = async function () {
         json = JSON.parse(json);
         json.policyVersion = applicationInfo.policyVersion;
         json.entityGuid = applicationInfo.entityGuid;
+
         try {
             json.stats = await commonUtils.getHCStats();
         } catch (error) {
@@ -114,10 +115,17 @@ const sendHC = async function () {
         json.serviceStatus.agentActiveStat = commonUtils.isAgentActiveState();
         json.serviceStatus.iastRestClient = commonUtils.iastRestClientStatus();
 
+        json.exitEventSentCount = json.exitEventStats.sent;
+        json.eventRejectionCount = json.raspEventStats.rejected + json.iastEventStats.rejected;
+        json.eventProcessingErrorCount = json.raspEventStats.errorCount + json.iastEventStats.errorCount;
+        json.eventSendRejectionCount = json.eventRejectionCount;
+        json.eventSendErrorCount = json.eventProcessingErrorCount;
+
         hc.getInstance().resetDropCount();
         hc.getInstance().resetProcessedCount();
         hc.getInstance().resetEventSentCount();
         hc.getInstance().resetHttpRequestCount();
+        hc.getInstance().resetEventStats();
 
         logger.info('Health Check Status:', JSON.stringify(json));
         statusUtils.addHCtoBuffer(json);
@@ -133,13 +141,13 @@ const sendHC = async function () {
  */
 function getDispatcherAndSendEvent(eventJson) {
     const eventType = eventJson.jsonName;
-    if (eventType === 'Event') {
+    if (eventType === JSON_NAME.EVENT || eventType === EXITEVENT) {
         hc.getInstance().registerEventProcessed();
     }
 
     dispatcher(eventJson);
 
-    if (eventType === 'Event') {
+    if (eventType === JSON_NAME.EVENT || eventType === EXITEVENT) {
         hc.getInstance().registerEventSent();
     }
 

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "0.2.1",
+  "version": "0.4.0",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
-  "jsonVersion": "1.0.1",
+  "jsonVersion": "1.1.0",
   "contributors": [
     {
       "name": "Sumit Suthar",
@@ -35,8 +35,8 @@
     "url": "https://github.com/newrelic/csec-node-agent.git"
   },
   "dependencies": {
-    "@aws-sdk/client-lambda": "^3.363.0",
-    "axios": "0.21.4",
+    "@aws-sdk/client-lambda": "^3.405.0",
+    "axios": "1.6.0",
     "check-disk-space": "3.3.1",
     "content-type": "^1.0.5",
     "fast-safe-stringify": "^2.1.1",
@@ -55,7 +55,7 @@
     "sync-request": "^6.1.0",
     "unescape": "^1.0.1",
     "unescape-js": "^1.1.4",
-    "uuid": "^9.0.0",
+    "uuid": "^9.0.1",
     "ws": "^7.5.9"
   },
   "devDependencies": {