@newrelic/security-agent 0.4.0 → 0.6.0

package/CHANGELOG.md

@@ -1,3 +1,32 @@
+### v0.6.0 (2024-01-03)
+#### Features
+* Added ws headers NR-CSEC-ENTITY-GUID and NR-CSEC-ENTITY-NAME
+* Updated jsonVersion to 1.1.1 in security events
+* Support to send important logs/errors to security engine
+#### Bug fixes
+* Added missing protocol in http request object
+* Fix for honouring probing interval from policy
+#### Miscellaneous chores
+* Added nestjs test cases
+* Additional logging for instrumented modules and methods 
+* Upgraded axios to v1.6.3
+* Removed pinned version for axios and check-disk-space
+* Update in lockfileVersion of package-lock.json
+* Updated @babel/traverse, protobufjs, fast-xml-parser and @aws-sdk/credential-providers
+* Updated Readme.md
+
+
+### v0.5.0 (2023-11-17)
+#### Features
+* IAST support for NestJS framework
+#### Bug Fixes
+* Fixed misspelled constant in fs.open() hook
+* Minor fix in applicationInfo for pod properties
+#### Miscellaneous chores
+* Upgraded ws to v8.14.2 and updated initialization of websocket for v8.x.
+* Upgraded check-disk-space to v3.4.0
+* Upgraded @aws-sdk/client-lambda to v3.436.0
+
 ### v0.4.0 (2023-10-27)
 #### Features
 * Added event stats for RASP, IAST and exit events in healthcheck. 

package/README.md

@@ -62,6 +62,7 @@ The [Developer docs](http://newrelic.github.io/node-newrelic/) for writing instr
 - [fastify](https://www.npmjs.com/package/fastify)(2.x, 3.x and 4.x)
 - [restify](https://www.npmjs.com/package/restify)(8.x, 9.x, 10.x and 11.x)
 - [director](https://www.npmjs.com/package/director)(1.2.x)
+- [@nestjs/core](https://www.npmjs.com/package/@nestjs/core)(8.x and above)
 - [ldapjs](https://www.npmjs.com/package/ldapjs)(2.x and above)
 - [ldapts](https://www.npmjs.com/package/ldapts)(2.x and above)
 - [xpath](https://www.npmjs.com/package/xpath)(0.0.20 and above)

package/THIRD_PARTY_NOTICES.md

@@ -75,7 +75,7 @@ code, the source code can be found at [https://github.com/newrelic/csec-node-age
 
 ### @aws-sdk/client-lambda
 
-This product includes source derived from [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3) ([v3.435.0](https://github.com/aws/aws-sdk-js-v3/tree/v3.435.0)), distributed under the [Apache-2.0 License](https://github.com/aws/aws-sdk-js-v3/blob/v3.435.0/LICENSE):
+This product includes source derived from [@aws-sdk/client-lambda](https://github.com/aws/aws-sdk-js-v3) ([v3.436.0](https://github.com/aws/aws-sdk-js-v3/tree/v3.436.0)), distributed under the [Apache-2.0 License](https://github.com/aws/aws-sdk-js-v3/blob/v3.436.0/LICENSE):
 
 ```
                                 Apache License
@@ -284,7 +284,7 @@ This product includes source derived from [@aws-sdk/client-lambda](https://githu
 
 ### axios
 
-This product includes source derived from [axios](https://github.com/axios/axios) ([v1.6.0](https://github.com/axios/axios/tree/v1.6.0)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.6.0/LICENSE):
+This product includes source derived from [axios](https://github.com/axios/axios) ([v1.6.3](https://github.com/axios/axios/tree/v1.6.3)), distributed under the [MIT License](https://github.com/axios/axios/blob/v1.6.3/LICENSE):
 
 ```
 # Copyright (c) 2014-present Matt Zabriskie & Collaborators
@@ -299,7 +299,7 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### check-disk-space
 
-This product includes source derived from [check-disk-space](https://github.com/Alex-D/check-disk-space) ([v3.3.1](https://github.com/Alex-D/check-disk-space/tree/v3.3.1)), distributed under the [MIT License](https://github.com/Alex-D/check-disk-space/blob/v3.3.1/LICENSE):
+This product includes source derived from [check-disk-space](https://github.com/Alex-D/check-disk-space) ([v3.4.0](https://github.com/Alex-D/check-disk-space/tree/v3.4.0)), distributed under the [MIT License](https://github.com/Alex-D/check-disk-space/blob/v3.4.0/LICENSE):
 
 ```
 MIT License
@@ -795,30 +795,29 @@ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLI
 
 ### ws
 
-This product includes source derived from [ws](https://github.com/websockets/ws) ([v7.5.9](https://github.com/websockets/ws/tree/v7.5.9)), distributed under the [MIT License](https://github.com/websockets/ws/blob/v7.5.9/LICENSE):
+This product includes source derived from [ws](https://github.com/websockets/ws) ([v8.14.2](https://github.com/websockets/ws/tree/v8.14.2)), distributed under the [MIT License](https://github.com/websockets/ws/blob/v8.14.2/LICENSE):
 
 ```
-The MIT License (MIT)
-
 Copyright (c) 2011 Einar Otto Stangvik <einaros@gmail.com>
+Copyright (c) 2013 Arnout Kazemier and contributors
+Copyright (c) 2016 Luigi Pinca and contributors
 
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
 
 The above copyright notice and this permission notice shall be included in all
 copies or substantial portions of the Software.
 
 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
 ```
 

package/lib/instrumentation-security/core/sec-utils.js

@@ -172,6 +172,7 @@ function addRequestData(shim, request) {
       const data = Object.assign({});
       const segment = shim.getActiveSegment();
       if (segment && segment.transaction) {
+        data.protocol = (request.connection && request.connection.encrypted) ? 'https' : 'http';
         data.body = null;
         data.headers = request.headers;
         data.url = request.url;

package/lib/instrumentation-security/hooks/@nestjs/nr-nestjs-core.js

@@ -0,0 +1,63 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+
+'use strict'
+
+const secUtils = require('../../core/sec-utils');
+const { ATTHERATE, DOUBLE_DOLLAR, EMPTY_STR } = require('../../core/constants');
+const routeManager = require('../../core/route-manager');
+const API = require("../../../nr-security-api");
+const logger = API.getLogger();
+const semver = require('semver')
+
+const RequestMethods = {
+  "0": "GET",
+  "1": "POST",
+  "2": "PUT",
+  "3": "DELETE",
+  "4": "PATCH",
+  "5": "ALL",
+  "6": "OPTIONS",
+  "7": "HEAD",
+  "8": "SEARCH",
+}
+
+module.exports = function initialize(shim) {
+  const nestJsVersion = shim.require('./package.json').version
+  logger.info("Instrumenting nestjs", nestJsVersion)
+  if (semver.lt(nestJsVersion, '8.0.0')) {
+    logger.debug(
+      `Not instrumenting Nest.js version ${nestJsVersion}; minimum instrumentable version is 8.0.0`
+    )
+    return
+  }
+
+  const routerExplorer = shim.require("./router/router-explorer").RouterExplorer;
+
+  shim.wrap(routerExplorer.prototype, 'applyCallbackToRouter', function wrapApplyCallbackToRouter(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    logger.debug(`Instrumenting routerExplorer.prototype.applyCallbackToRouter`)
+    return function wrappedApplyCallbackToRouter() {
+      try {
+        const stakTrace = secUtils.traceElementForRoute();
+        const splittedStack = stakTrace[0].split(DOUBLE_DOLLAR);
+        const verb = RequestMethods[arguments[1].requestMethod];
+        const path = (arguments[4].ctrlPath) + (arguments[1].path[0] == '/' ? EMPTY_STR : arguments[1].path[0]);
+        const key = verb + ATTHERATE + path;
+        routeManager.setRoute(key, splittedStack[0]);
+      } catch (error) {
+      }
+      return fn.apply(this, arguments);
+    }
+  })
+
+}
+
+
+
+
+

package/lib/instrumentation-security/hooks/express/nr-express.js

@@ -42,6 +42,7 @@ function wrapExpress4(shim, express) {
     if (!shim.isFunction(fn)) {
       return fn
     }
+    logger.debug('Instrumenting express.Router.route');
     return function wrappedRoute() {
       try {
         const stakTrace = secUtils.traceElementForRoute();
@@ -62,6 +63,7 @@ function wrapExpress4(shim, express) {
     if (!shim.isFunction(fn)) {
       return fn
     }
+    logger.debug('Instrumenting express.Router.process_params')
     return function wrappedParam() {
       extractParams(shim, arguments[2]);
       const route = fn.apply(this, arguments)

package/lib/instrumentation-security/hooks/fastify/nr-fastify.js

@@ -40,6 +40,7 @@ const setupRouteHandler = (shim, fastify, moduleName) => {
       if (!shim.isFunction(fn)) {
         return fn
       }
+      logger.debug(`Instrumenting ${moduleName}.${fun}`);
       return function wrappedRoute() {
         try {
           const stakTrace = secUtils.traceElementForRoute();

package/lib/instrumentation-security/hooks/fs/nr-fs.js

@@ -94,8 +94,8 @@ const promiseFunctionProbableToFI = [
  */
 function initialize(shim, mod, moduleName) {
 
-  
-  logger.info("Instrumenting FS module");
+
+  logger.info(`Instrumenting ${moduleName}`);
   requireHook.initialize(shim)
   const binding = process.binding("fs");
   openHook(shim, binding, moduleName);
@@ -116,6 +116,7 @@ function initialize(shim, mod, moduleName) {
  */
 function openHook(shim, mod, moduleName) {
   shim.wrap(mod, "open", function makeOpenWrapper(shim, fn) {
+    logger.debug(`Instrumenting ${moduleName}.open`);
     return function openWrapper() {
       const parameters = Array.prototype.slice.apply(arguments);
       const interceptedArgs = [arguments[0]];
@@ -128,7 +129,7 @@ function openHook(shim, mod, moduleName) {
           parameters[0] = arguments[0];
         }
       }
-      if (request && typeof parameters[0] === STRING && !lodash.isEmpty(parameters[0]) ) {
+      if (request && typeof parameters[0] === STRING && !lodash.isEmpty(parameters[0])) {
         const policy = API.getPolicy();
         const dynamicScanningFlag = policy.data ? policy.data.vulnerabilityScan.iastScan.enabled : false;
         const url = request.url;
@@ -136,7 +137,7 @@ function openHook(shim, mod, moduleName) {
         const trimedURL = url.split(QUESTIONMARK)[0];
         if (!trimedURL.includes(path.basename(parameters[0])) || decodedURL.includes(DOTDOTSLASH) || dynamicScanningFlag) {
           try {
-            if (parameters[0].startsWith(DOTDOTSLADH)) {
+            if (parameters[0].startsWith(DOTDOTSLASH)) {
               parameters[0] = agentModule.applicationInfo.serverInfo.deployedApplications[0].deployedPath + SLASH + parameters[0];
             } else if (parameters[0].startsWith(SLASHDOTDOT)) {
               parameters[0] = agentModule.applicationInfo.serverInfo.deployedApplications[0].deployedPath + parameters[0];
@@ -151,14 +152,14 @@ function openHook(shim, mod, moduleName) {
           this.secEvent = API.generateSecEvent(secMetadata);
           API.sendEvent(this.secEvent);
           const callbackFlag = isCallback(arguments);
-          if (callbackFlag &&  request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+          if (callbackFlag && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
             callbackHook(shim, arguments[3], 'oncomplete', this.secEvent);
           }
         }
 
       }
       const result = fn.apply(this, arguments);
-      if(result>0 && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+      if (result > 0 && request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
         //here generate exit event.
         API.generateExitEvent(this.secEvent);
         delete this.secEvent;
@@ -177,18 +178,19 @@ function openHook(shim, mod, moduleName) {
 function probableToFAHooks(shim, mod, moduleName) {
   functionsProbableToFA.forEach(function (fun) {
     shim.wrap(mod, fun, function makeFAWrapper(shim, fn) {
+      logger.debug(`Instrumenting ${moduleName}.${fun}`);
       return function FAWrapper() {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
+        if (request && typeof arguments[0] === STRING && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.FILE_OPERATION, EVENT_CATEGORY.FILE)
           this.secEvent = API.generateSecEvent(secMetadata);
           API.sendEvent(this.secEvent);
           const callbackFlag = isCallback(arguments);
-          if (callbackFlag &&  request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
-            callbackHook(shim, arguments, arguments.length-1, this.secEvent);
+          if (callbackFlag && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+            callbackHook(shim, arguments, arguments.length - 1, this.secEvent);
           }
         }
         return fn.apply(this, arguments);
@@ -206,11 +208,12 @@ function probableToFAHooks(shim, mod, moduleName) {
 function probableToFIHooks(shim, mod, moduleName) {
   functionProbableToFI.forEach(function (fun) {
     shim.wrap(mod, fun, function makeFIWrapper(shim, fn) {
+      logger.debug(`Instrumenting ${moduleName}.${fun}`);
       return function FIWrapper() {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
+        if (request && typeof arguments[0] === STRING && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           if (fun === COPY_FILE || fun === RENAME) {
             const secMetadata = securityMetaData.getSecurityMetaData(request, arguments[1], traceObject, secUtils.getExecutionId(), getCase(arguments[1]), EVENT_CATEGORY.FILE)
@@ -222,7 +225,7 @@ function probableToFIHooks(shim, mod, moduleName) {
           API.sendEvent(this.secEvent);
           const callbackFlag = isCallback(arguments);
           if (callbackFlag && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
-            callbackHook(shim, arguments, arguments.length-1, this.secEvent);
+            callbackHook(shim, arguments, arguments.length - 1, this.secEvent);
           }
         }
         return fn.apply(this, arguments);
@@ -239,12 +242,13 @@ function probableToFIHooks(shim, mod, moduleName) {
  */
 function probablePromiseToFAHooks(shim, mod, moduleName) {
   promiseFunctionsProbableToFA.forEach(function (fun) {
+    logger.debug(`Instrumenting Promise ${moduleName}.${fun}`);
     shim.wrap(mod, fun, function makeFAWrapper(shim, fn) {
       return function FAWrapper() {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
+        if (request && typeof arguments[0] === STRING && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           const secMetadata = securityMetaData.getSecurityMetaData(request, interceptedArgs, traceObject, secUtils.getExecutionId(), EVENT_TYPE.FILE_OPERATION, EVENT_CATEGORY.FILE)
           this.secEvent = API.generateSecEvent(secMetadata);
@@ -264,12 +268,13 @@ function probablePromiseToFAHooks(shim, mod, moduleName) {
  */
 function probablePromiseToFIHooks(shim, mod, moduleName) {
   promiseFunctionProbableToFI.forEach(function (fun) {
+    logger.debug(`Instrumenting Promise ${moduleName}.${fun}`);
     shim.wrap(mod, fun, function makeFIWrapper(shim, fn) {
       return function FIWrapper() {
         const interceptedArgs = [arguments[0]];
         shim.interceptedArgs = interceptedArgs;
         const request = requestManager.getRequest(shim);
-        if (request && typeof arguments[0] === STRING  && !lodash.isEmpty(arguments[0])) {
+        if (request && typeof arguments[0] === STRING && !lodash.isEmpty(arguments[0])) {
           const traceObject = secUtils.getTraceObject(shim);
           if (fun === COPY_FILE || fun === RENAME) {
             const secMetadata = securityMetaData.getSecurityMetaData(request, arguments[1], traceObject, secUtils.getExecutionId(), getCase(arguments[1]), EVENT_CATEGORY.FILE)

package/lib/instrumentation-security/hooks/hapi/nr-hapi.js

@@ -25,7 +25,7 @@ module.exports = function initialize(shim, hapi, moduleName) {
     return
   }
 
-  logger.info("Instrumenting Hapi")
+  logger.info(`Instrumenting ${moduleName}`);
   // 'Server' and 'server' both point to the same export,
   // but we can't make any assumption about which will be used.
   // Since we wrap the prototype, the second wrap should exit early.
@@ -49,6 +49,7 @@ function serverPostConstructor(shim) {
  */
 function wrapProtoRoute(shim, proto) {
   shim.wrap(proto, 'route', function wrapRoute(shim, original) {
+    logger.debug(`Instrumenting ${proto}.route`);
     return function wrappedRoute() {
       const args = shim.argsToArray.apply(shim, arguments)
       if (!shim.isObject(args[0])) {

package/lib/instrumentation-security/hooks/http/nr-http.js

@@ -46,7 +46,7 @@ const CSEC_HOME_TMP = `${CSEC_HOME}/nr-security-home/tmp/language-agent/${proces
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName) {
-  logger.info('Instrumenting HTTP module');
+  logger.info(`Instrumenting ${moduleName}`);
   emitHook(shim, mod, moduleName);
   createServerHook(shim, mod, moduleName);
   outboundHook(shim, mod, 'request', moduleName);
@@ -87,7 +87,11 @@ function setupRequestMapCleanup() {
  * @param {*} moduleName 
  */
 function outboundHook(shim, mod, method, moduleName) {
+  logger.debug(`Instrumenting ${moduleName}.${method}`);
   shim.wrap(mod, method, function makeRequestWrapper(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
     return function requestWrapper() {
       const request = requestManager.getRequest(shim);
       const data = {};
@@ -206,6 +210,7 @@ function addRequestData(shim, request) {
     const data = Object.assign({});
     const segment = shim.getActiveSegment();
     if (segment && segment.transaction) {
+      data.protocol = (request.connection && request.connection.encrypted) ? 'https' : 'http';
       data.body = null;
       data.headers = request.headers;
       data.url = request.url;
@@ -255,6 +260,10 @@ function addRequestData(shim, request) {
  */
 function emitHook(shim, mod, moduleName) {
   shim.wrap(mod && mod.Server && mod.Server.prototype, 'emit', function makeEmitWrapper(shim, fn) {
+    logger.debug(`Instrumenting ${moduleName}.Server.prototype.emit`);
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
     return function emitWrapper() {
       const req = arguments[1];
       const resp = arguments[2];
@@ -263,8 +272,11 @@ function emitHook(shim, mod, moduleName) {
         if (NRAgent && NRAgent.config.security.detection.rxss.enabled) {
           responseHook(resp, req, shim);
         }
-
+        
         shim.wrap(req, 'on', function makeOnWrapper(shim, fn) {
+          if (!shim.isFunction(fn)) {
+            return fn
+          }
           return function OnWrapper() {
             if (!requestManager.getRequest(shim)) {
               addRequestData(shim, req);
@@ -292,10 +304,17 @@ function emitHook(shim, mod, moduleName) {
  * @param {*} shim 
  * @param {*} mod 
  */
-function createServerHook(shim, mod) {
+function createServerHook(shim, mod, moduleName) {
   shim.wrap(mod, 'createServer', function createServerWrapper(shim, fn) {
+    logger.debug(`Instrumenting ${moduleName}.createServer`);
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
     return function wrappedCreateServer() {
       shim.wrap(arguments, '0', function appWrapper(shim, fn) {
+        if (!shim.isFunction(fn)) {
+          return fn
+        }
         return function wrappedApp() {
           let req = arguments[0];
           if (!requestManager.getRequest(shim)) {
@@ -316,6 +335,9 @@ function createServerHook(shim, mod) {
  */
 function onDataHook(shim, mod) {
   shim.wrap(mod, '1', function makeOnDataWrapper(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
     return function onDataWrapper() {
       const chunk = arguments[0];
       const chunkType = typeof chunk;
@@ -347,6 +369,9 @@ function responseHook(resp, req, shim) {
   resp.res.body = EMPTY_STRING;
 
   shim.wrap(resp, 'write', function makeWriteWrapper(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
     return function wrappedWrite() {
       const response = this;
       responseBodyCompute(response, arguments);
@@ -355,6 +380,9 @@ function responseHook(resp, req, shim) {
   })
   // wrapper for response.end() 
   shim.wrap(resp, 'end', function makeEndWrapper(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
     return function wrappedEnd() {
       const response = this;
       responseBodyCompute(response, arguments);

package/lib/instrumentation-security/hooks/koa/@koa/nr-@koa-router.js

@@ -20,7 +20,7 @@ const logger = API.getLogger();
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName) {
-    logger.info('Instrumenting @koa/router');
+    logger.info(`Instrumenting ${moduleName}`);
     const VerbMethods = ['all', 'delete', 'get', 'head', 'opts', 'post', 'put', 'patch'];
 
     // RouteMap hooks
@@ -29,6 +29,7 @@ function initialize(shim, mod, moduleName) {
             if (!shim.isFunction(fn)) {
                 return fn
             }
+            logger.debug(`Instrumenting ${moduleName}.prototype.${fun}`);
             return function wrappedRoute() {
                 try {
                     const stakTrace = secUtils.traceElementForRoute();
@@ -59,6 +60,7 @@ function initialize(shim, mod, moduleName) {
  */
 function paramHook(shim, mod, moduleName) {
     shim.wrap(mod && mod.prototype, 'params', function wrapMatch(shim, fn) {
+        logger.debug(`Instrumenting ${moduleName}.prototype.params`);
         return function wrappedMatch() {
             const segment = shim.getActiveSegment();
             if (segment && segment.transaction) {

package/lib/instrumentation-security/hooks/ldap/nr-ldap.js

@@ -35,6 +35,7 @@ function initialize(shim, mod, moduleName){
  */
 function ldapHooks(shim, mod, methodName, moduleName){
     shim.wrap(mod, methodName, function makeWrapper(shim,fn){
+      logger.debug(`Instrumenting ${moduleName}.${methodName}`);
         return function wrapper(){
           const param = {};
           param.name = arguments[0];

package/lib/instrumentation-security/hooks/mongodb/common.js

@@ -55,6 +55,7 @@ function payloadType(obj) {
 
 function queryHook(shim, mod, method) {
   shim.wrap(mod, method, function makeQueryWrapper(shim, fn) {
+    logger.debug(`Instrumenting mongodb.${method}`);
     return function queryWrapper() {
       const request = requestManager.getRequest(shim);
       if (CURSOR_OPS.includes(method)) {
@@ -194,6 +195,7 @@ function callbackHook(shim, mod, fun, secEvent) {
 
 common.queryHookV2 = function queryHookV2(shim, mod, method) {
   shim.wrap(mod, method, function makeQueryWrapper(shim, fn) {
+    logger.debug(`Instrumenting mongodb.${method}`);
     return function queryWrapper() {
       const request = requestManager.getRequest(shim);
       if (CURSOR_OPS.includes(method)) {

package/lib/instrumentation-security/hooks/mongodb/nr-mongodb.js

@@ -32,7 +32,7 @@ module.exports = initialize;
  * @param {Shim} shim
  */
 function initialize(shim, mongodb, moduleName) {
-  logger.info("Instrumenting Mongodb");
+  logger.info(`Instrumenting ${moduleName}`);
   if (!mongodb) {
     return;
   }

package/lib/instrumentation-security/hooks/mysql/nr-mysql.js

@@ -18,7 +18,7 @@ const symbols = {
   createPoolCluster: Symbol('createPoolCluster'),
   wrappedPoolConnection: Symbol('wrappedPoolConnection')
 }
-
+let modName = '';
 module.exports = initialize;
 
 /**
@@ -28,6 +28,7 @@ module.exports = initialize;
  * @param {*} moduleName 
  */
 function initialize(shim, mysql, moduleName) {
+  modName = moduleName;
   logger.info("Instrumenting", moduleName);
   if (shim._moduleRoot.includes("mysql2")) {
     promiseInitialize(shim, mysql, moduleName);
@@ -119,6 +120,7 @@ function wrapGetConnection(shim, connectable) {
 
   const proto = Object.getPrototypeOf(connectable);
   shim.wrap(proto, "getConnection", function doWrapGetConnection(shim, fn) {
+    logger.debug(`Instrumenting ${modName}.getConnection`);
     return function wrappedGetConnection() {
       const args = shim.toArray(arguments);
       const cbIdx = args.length - 1;
@@ -208,7 +210,7 @@ function extractQueryArgs(shim, args) {
     // query(opts [, values], callback)
     rawQuery = args[0].sql;
     try {
-      if (args[0].values && typeof args[0].values  == 'object') {
+      if (args[0].values && typeof args[0].values == 'object') {
         param = Object.values(args[0].values)
       }
     } catch (error) {
@@ -240,6 +242,7 @@ function extractQueryArgs(shim, args) {
  */
 function queryHook(shim, mod, method, isPoolQuery) {
   shim.wrap(mod, method, function makeQueryWrapper(shim, fn) {
+    logger.debug(`Instrumenting ${modName}.${method}`);
     return function queryWrapper() {
       const parameters = extractQueryArgs(shim, arguments);
       shim.interceptedArgs = parameters;

package/lib/instrumentation-security/hooks/native/nr-childProcess.js

@@ -26,6 +26,7 @@ function initialize(shim, childProcess, moduleName) {
  */
 function execFileHook(shim, childProcess, moduleName) {
   shim.wrap(childProcess, "execFile", function makeWrapper(shim, fn) {
+    logger.debug(`Instrumenting ${moduleName}.execFile`);
     return function wrapper() {
       const interceptedArgs = [arguments[0]];
       shim.interceptedArgs = interceptedArgs;
@@ -54,6 +55,7 @@ function execFileHook(shim, childProcess, moduleName) {
  */
 function spawnSyncHook(shim, childProcess, moduleName) {
   shim.wrap(childProcess, "spawn", function makeWrapper(shim, fn) {
+    logger.debug(`Instrumenting ${moduleName}.spawnSync`);
     return function wrapper() {
       const interceptedArgs = arguments[0].args;
       shim.interceptedArgs = interceptedArgs;
@@ -83,6 +85,7 @@ function spawnSyncHook(shim, childProcess, moduleName) {
  */
 function spawnHook(shim, childProcess, moduleName) {
   shim.wrap(childProcess, "spawn", function makeWrapper(shim, fn) {
+    logger.debug(`Instrumenting ${moduleName}.spawn`);
     return function wrapper() {
       let param = [];
       param.push(arguments[0]);

package/lib/instrumentation-security/hooks/postgres/nr-postgres.js

@@ -66,6 +66,7 @@ module.exports = function initialize(shim, pgsql, moduleName) {
 
 function queryHook(shim, mod, method){
   shim.wrap(mod, method, function makeQueryWrapper(shim, fn){
+    logger.debug(`Instrumenting pg.${method}`);
       return function queryWrapper(){
           const request = requestManager.getRequest(shim);
           const sqlArgs = [];

package/lib/instrumentation-security/hooks/restify/nr-restify.js

@@ -21,12 +21,13 @@ const logger = API.getLogger();
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName) {
-    logger.info('Instrumenting Restify');
+    logger.info(`Instrumenting ${moduleName}`);
     try {
         const registryRadix = shim.require("./lib/routerRegistryRadix");
 
         //routerRadix hook
         shim.wrap(registryRadix && registryRadix.prototype, 'add', function makeWrapper(shim, fn) {
+            logger.info(`Instrumenting registryRadix.prototype.add`);
             return function wrapper() {
                 if (arguments[0]) {
                     try {
@@ -47,6 +48,7 @@ function initialize(shim, mod, moduleName) {
         const router = shim.require("./lib/router");
 
         shim.wrap(router && router.prototype, 'lookup', function lookupWrapper(shim, fn) {
+            logger.info(`Instrumenting router.prototype.lookup`);
             return function wrappedLookup() {
                 const result = fn.apply(this, arguments);
                 extractParams(shim, arguments[0]);

package/lib/instrumentation-security/hooks/xpath/nr-xpath.js

@@ -27,7 +27,7 @@ function initialize(shim, mod, moduleName){
     xpathHooks(shim, mod, 'useNamespaces', moduleName);
   }
   else if(moduleName==='xpath.js'){
-    wrappedXPathDotJS(shim, mod);
+    wrappedXPathDotJS(shim, mod, moduleName);
   }
   
 }
@@ -40,6 +40,7 @@ function initialize(shim, mod, moduleName){
  */
 function xpathHooks(shim, mod, methodName, moduleName){
     shim.wrap(mod, methodName, function makeWrapper(shim,fn){
+      logger.debug(`Instrumenting ${moduleName}.${methodName}`);
         return function wrapper(){
           const interceptedArgs = [arguments[0]];
           shim.interceptedArgs = interceptedArgs;
@@ -67,8 +68,9 @@ function xpathHooks(shim, mod, methodName, moduleName){
  * @param {*} shim 
  * @param {*} mod 
  */
-function wrappedXPathDotJS(shim, mod){
+function wrappedXPathDotJS(shim, mod, moduleName){
   const wrappedExport = shim.wrapExport(mod, function wrapXpathJSModule(shim, fn) {
+    logger.debug(`Instrumenting ${moduleName}`);
     return function wrappedXpathJSModule() {
       const interceptedArgs = [arguments[1]];
       shim.interceptedArgs = interceptedArgs;

package/lib/instrumentation-security/index.js

@@ -181,6 +181,15 @@ newrelic.instrumentWebframework({
   }
 })
 
+newrelic.instrumentWebframework({
+  moduleName: '@nestjs/core',
+  isEsm: true,
+  onRequire: require('./hooks/@nestjs/nr-nestjs-core'),
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
+
 
 
 

package/lib/nr-security-agent/index.js

@@ -14,6 +14,9 @@ const agentConfig = require('./resources/config');
 const shaSizeUtil = require('./lib/core/sha-size-util');
 const njsAgentConstants = require('./lib/core/sec-agent-constants');
 
+const NRLogger = API.newrelic.shim.logger.child({ component: 'security-agent' });
+NRLogger.info("Starting New Relic Node.js Security Agent ");
+
 const {
     IS_LAMBDA_ENV,
     AWS_LAMBDA_FUNCTION_NAME_ENV_IDENTIFIER,
@@ -106,6 +109,7 @@ function initialize() {
     initLogger.info("[STEP-3] => Gathering information about the application :", JSON.stringify(applicationInfo));
     if (NRAgent) {
         NRAgent.on('started', () => {
+            NRLogger.info("Started New Relic Node.js Security Agent");
             if (NRAgent.config.security.enabled || !NRAgent.config.high_security) {
                 wsClient.initialize();
                 logger.info('NR Agent started with agent_run_id:', NRAgent.config.run_id, NRAgent.config.account_id);
@@ -113,7 +117,8 @@ function initialize() {
                 Agent.setNRAgent(NRAgent);
             }
             else {
-                logger.info("security.enabled flag is set to false")
+                logger.warn("security.enabled flag is set to false");
+                NRLogger.warn("Failed to Start New Relic Node.js Security Agent. Please check security.enabled and high_security flags");
             }
         });
     }
@@ -131,9 +136,9 @@ function initialize() {
             }
         }
         logger.info(LOG_MESSAGES.AGENT_INFO, applicationInfo.collectorVersion, applicationInfo.jsonVersion, applicationInfo.buildNumber);
-        
+
         applicationInfoModule.addProperty('serverInfo.deployedApplications', applications);
-        
+
         shaSizeUtil.setLogger(logger);
 
         // Initialize Agent Status
@@ -159,7 +164,7 @@ function getProcCMDLineSanitized(applicationInfoModule) {
 }
 
 (() => {
-    if(!NRAgent.config.security.enabled){
+    if (!NRAgent.config.security.enabled) {
         logger.warn("security.enabled flag is set to false");
         return;
     }

package/lib/nr-security-agent/lib/core/Auth-headers.js

@@ -9,6 +9,8 @@ const appInfo = require('./applicationinfo').getInstance();
 const logs = require('./logging');
 const logger = logs.getLogger();
 const initLogger = logs.getInitLogger();
+const LinkingMetaData = require('./LinkingMetadata');
+const LogMessage = require('./LogMessage');
 
 
 /* eslint-disable camelcase */
@@ -20,6 +22,7 @@ function AuthHeaders() {
     try {
         const NRAgent = API.getNRAgent();
         authHeaders = {}
+        const metadata = LinkingMetaData.getLinkingMetadata();
         authHeaders['NR-CSEC-CONNECTION-TYPE'] = 'LANGUAGE_COLLECTOR';
         authHeaders['NR-AGENT-RUN-TOKEN'] = NRAgent.config.run_id;
         const COLLECTOR_VERSION = appInfo.collectorVersion || '';
@@ -32,8 +35,12 @@ function AuthHeaders() {
         authHeaders['NR-ACCOUNT-ID'] = NRAgent.config.account_id;
         authHeaders['NR-LICENSE-KEY'] = NRAgent ? NRAgent.config.license_key : '';
         authHeaders["NR-CSEC-IAST-DATA-TRANSFER-MODE"] = "PULL";
+        authHeaders['NR-CSEC-ENTITY-NAME'] = metadata['entity.name'] ? metadata['entity.name'] : '';
+        authHeaders['NR-CSEC-ENTITY-GUID'] = metadata['entity.guid'] ? metadata['entity.guid'] : '';
     } catch (error) {
         logger.error("Exception in preparing auth headers:", error);
+        const logMessage = new LogMessage.logMessage("SEVERE", 'Exception in preparing auth headers', __filename, error);
+        commonUtils.addLogEventtoBuffer(logMessage);
     }
 
     return authHeaders;

package/lib/nr-security-agent/lib/core/LogMessage.js

@@ -6,6 +6,8 @@
 const LinkingMetaData = require('./LinkingMetadata');
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
+const { BasicInfo } = require('./event');
+const applicationInfo = require('./applicationinfo').getInstance();
 
 /**
  * constructor function to create LogMessageException object
@@ -13,10 +15,22 @@ const NRAgent = API.getNRAgent();
  * @param {*} cause
  * @param {*} stacktrace
  */
-function logMessageException (exception) {
-    this.message = exception.message;
-    this.cause = exception.cause ? exception.cause : '';
-    this.stacktrace = exception.stack;
+function logMessageException(exception) {
+    let exceptionObject = {};
+    try {
+        exceptionObject.message = exception.message ? exception.message : '';
+        exceptionObject.cause = exception.cause ? exception.cause : '';
+        if (exception.stack) {
+            let stacktraceInList = exception.stack.split('\n');
+            stacktraceInList = stacktraceInList.slice(1);
+            exceptionObject.stacktrace = stacktraceInList;
+        }
+
+    } catch (error) {
+
+    }
+
+    return exceptionObject;
 }
 
 /**
@@ -28,17 +42,28 @@ function logMessageException (exception) {
   * @param {*} exception
   * @param {*} linkingMetadata
   */
-function logMessage (level, message, caller, exception) {
-    this.timestamp = Date.now();
-    this.level = level;
-    this.message = message;
-    this.caller = caller;
-    if (exception) {
-        this.exception = logMessageException(exception);
-    }
-    if (NRAgent) {
-        this.linkingMetadata = LinkingMetaData.getLinkingMetadata();
+function logMessage(level, message, caller, exception) {
+    try {
+        BasicInfo.call(this);
+        this.jsonVersion = applicationInfo.jsonVersion;
+        this.jsonName = 'log-message';
+        this.applicationUUID = applicationInfo.applicationUUID;
+        this.groupName = applicationInfo.groupName;
+        this.policyVersion = applicationInfo.policyVersion;
+        this.timestamp = Date.now();
+        this.level = level ? level : 'SEVERE';
+        this.message = message;
+        this.caller = caller;
+        if (exception) {
+            this.exception = logMessageException(exception);
+        }
+        if (NRAgent) {
+            this.linkingMetadata = LinkingMetaData.getLinkingMetadata();
+        }
+    } catch (error) {
+
     }
+
 }
 
 module.exports = {

package/lib/nr-security-agent/lib/core/applicationinfo.js

@@ -589,7 +589,7 @@ function setPodProperties (identifier, containerProp) {
         podProp.namespace = getPodNameSpace();
         podProp.name = getHostName();
         podProp.creationTimestamp = new Date().getTime();
-        podProp.ContainerProperties.push(containerProp);
+        podProp.containerProperties.push(containerProp);
         logger.debug("podProp:", podProp);
     } catch (e) {
         logger.error(e);

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -12,16 +12,18 @@ const OS = require('os');
 const path = require('path');
 const checkDiskSpace = require('check-disk-space').default;
 const AgentStatus = require('../core/agent-status');
-const { LOG_MESSAGES, CSEC_HOME, SLASH } = require('./sec-agent-constants');
+const { CSEC_HOME, SLASH } = require('./sec-agent-constants');
 
-const prettyBytes = require('pretty-bytes');
 const njsAgentConstants = require('./sec-agent-constants');
-const LinkingMetaData = require('./LinkingMetadata');
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
 const lodash = require('lodash')
 const backupLogFileRegex = /.log.\d/gm;
 let websocketHealth;
+
+const ringBuffer = require('ringbufferjs');
+const bufferedLogEvents = new ringBuffer(10);
+
 /**
  * Utility to generate UUID
  * @returns UUID
@@ -417,6 +419,26 @@ function getWSHealthStatus() {
     }
 }
 
+/**
+ * return buffered Log Event instance.
+ */
+function getLogEvents() {
+    return bufferedLogEvents;
+}
+
+
+/**
+ * Utility to add error object in error buffer
+ * @param {*} error
+ */
+function addLogEventtoBuffer(logMessage) {
+    try {
+        bufferedLogEvents.enq(logMessage);
+    } catch (error) {
+        logger.debug(error);
+    }
+}
+
 module.exports = {
     getUUID,
     getKindIdPair,
@@ -438,5 +460,7 @@ module.exports = {
     getCSECmode,
     getPathOfCACert,
     getWSHealthStatus,
-    setWSHealthStatus
+    setWSHealthStatus,
+    addLogEventtoBuffer,
+    getLogEvents
 };

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -9,14 +9,16 @@ const stringify = require('fast-safe-stringify');
 const restClient = require('../../restclient');
 const { Agent } = require('../../../agent');
 const { FuzzFailEvent } = require('../../../FuzzFailEvent');
-const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH, CSEC_SEP } = require('../../../sec-agent-constants');
+const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH, CSEC_SEP, SEVERE } = require('../../../sec-agent-constants');
 const LOCALHOST = 'localhost';
 const COLON_SLASH_SLASH = '://';
 const http = require('http');
 const https = require('https');
 const IASTUtil = require('./IASTUtils');
+const LogMessage = require('../../../LogMessage');
 
 require('dns').setDefaultResultOrder('ipv4first')
+const PolicyManager = require('../../../Policy');
 
 const {
     IS_LAMBDA_ENV,
@@ -42,6 +44,16 @@ function startIASTSchedular() {
     if (iastIntervalConst) {
         clearInterval(iastIntervalConst);
     }
+    let probingInterval = 5;
+
+    const policyInstance = PolicyManager.getInstance();
+    if (policyInstance.data) {
+        probingInterval = policyInstance.data.vulnerabilityScan.iastScan.probing.interval;
+    }
+    if (isNaN(probingInterval)) {
+        probingInterval = 5;
+    }
+
     iastIntervalConst = setInterval(() => {
         let data = IASTUtil.generateIASTDataRequest();
         let currentTime = Date.now();
@@ -55,7 +67,7 @@ function startIASTSchedular() {
         if (timeDiffInSeconds > 5 && additionalCoolDownTime == 0) {
             Agent.getAgent().client.dispatcher(data);
         }
-    }, 5000);
+    }, probingInterval * 1000);
 }
 
 /**
@@ -65,7 +77,7 @@ function startIASTSchedular() {
 function logScannedApiId(fuzzHeader, requestURL) {
     try {
         let apiId = fuzzHeader.split(CSEC_SEP)[0]
-        if (apiId && !fuzzedApiIDSet.has(apiId) ) {
+        if (apiId && !fuzzedApiIDSet.has(apiId)) {
             fuzzedApiIDSet.add(apiId);
             logger.info("IAST Scan for API %s with ID : %s started.", requestURL, apiId);
         }
@@ -87,6 +99,9 @@ function handler(json) {
         IASTUtil.addPendingRequestId(json.id);
     } catch (error) {
         logger.error('Parsing exeception in fuzz request: ', error);
+        
+        const logMessage = new LogMessage.logMessage(SEVERE, 'Parsing exeception in fuzz request', __filename, error);
+        commonUtils.addLogEventtoBuffer(logMessage);
     }
     if (!fuzzRequest) {
         return;
@@ -132,10 +147,10 @@ function handleFuzzRequest(fuzzDetails) {
 
             IASTUtil.completedRequestsMapInit(fuzzRequest.id);
 
-            if(fuzzRequest.headers && fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+            if (fuzzRequest.headers && fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
                 logScannedApiId(fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID], fuzzRequest.requestURI)
             }
-        
+
 
             logger.info('Firing http request:: URL: ' + config.url);
 
@@ -181,7 +196,7 @@ function handleFuzzResponse(response, fuzzDetails) {
 function parseAxiosHttpRequestToFuzz(requestObject) {
     let serverName = requestObject.serverName ? requestObject.serverName : LOCALHOST;
     let host = serverName + COLON + requestObject.serverPort;
-    if(requestObject.headers && requestObject.headers['content-length']){
+    if (requestObject.headers && requestObject.headers['content-length']) {
         delete requestObject.headers['content-length'];
     }
     return {

package/lib/nr-security-agent/lib/core/connections/websocket/response/index.js

@@ -5,7 +5,7 @@
 
 const _ = require('lodash');
 
-const { SERVER_COMMAND } = require('../../../sec-agent-constants');
+const { SERVER_COMMAND, SEVERE } = require('../../../sec-agent-constants');
 const UnsupportedAgentHandler = require('./unsupported-agent-handler');
 const StartupHandshakeHandler = require('./startup-handshake-handler');
 const FuzzRequestHandler = require('./fuzz-request-handler');
@@ -17,6 +17,7 @@ const coolDown = require('./iast-cool-down');
 const recordDeletion = require('./iast-record-deletion');
 const logs = require('../../../logging');
 let logger = logs.getLogger();
+const LogMessage = require('../../../LogMessage');
 
 const commandHandlerMap = {
     [SERVER_COMMAND.STARTUP_WELCOME_MSG]: StartupHandshakeHandler,
@@ -38,7 +39,9 @@ const handle = function handle (json) {
             NoOpHandler.handler.call(this, json);
         }
     } catch (error) {
-        logger.error("Error in handling Control Commnad",error);
+        logger.error("Error in handling Control Command",error);
+        const logMessage = new LogMessage.logMessage(SEVERE, 'Error in handling Control Command', __filename, error);
+        commonUtils.addLogEventtoBuffer(logMessage);
     }
     
 };

package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js

@@ -17,10 +17,11 @@ const hc = require('../../health-check');
 const fs = require('fs');
 const { promisify } = require('../../sec-util');
 const ResponseHandler = require('./response');
-const { EMPTY_APPLICATION_UUID, LOG_MESSAGES, CSEC_SEP, NR_CSEC_FUZZ_REQUEST_ID, EXITEVENT, JSON_NAME, RASP } = require('../../sec-agent-constants');
+const { EMPTY_APPLICATION_UUID, LOG_MESSAGES, CSEC_SEP, NR_CSEC_FUZZ_REQUEST_ID, EXITEVENT, JSON_NAME, RASP, SEVERE } = require('../../sec-agent-constants');
 const statusUtils = require('../../statusUtils');
 const commonUtils = require('../../commonUtils');
 const IASTUtil = require('../websocket/response/IASTUtils');
+const LogMessage = require('../../LogMessage');
 
 const BUSY = 'busy';
 const IDLE = 'idle';
@@ -109,9 +110,12 @@ SecWebSocket.prototype.init = function init() {
         cert = fs.readFileSync(certPath, 'utf8');
     } catch (error) {
         logger.error("Error in reading certificate:", error);
+        const logMessage = new LogMessage.logMessage(SEVERE, 'Error in reading certificate for websocket', __filename, error);
+        commonUtils.addLogEventtoBuffer(logMessage);
+
     }
 
-    webSocket = new WebSocket(validatorService, null, { headers: authHeaders, cert: cert, handshakeTimeout: 10000 });
+    webSocket = new WebSocket(validatorService, { headers: authHeaders, cert: cert, handshakeTimeout: 10000 });
 
     webSocket.on(WS_ON_OPEN, this.openCB);
     webSocket.on(WS_ON_MSG, this.msgCB);
@@ -120,6 +124,17 @@ SecWebSocket.prototype.init = function init() {
         lastPongtime = Date.now();
         commonUtils.setWSHealthStatus('OK');
         logger.debug("Pong received from Validator");
+
+        try {
+            let logBuffer = commonUtils.getLogEvents();
+            while (logBuffer.size() > 0) {
+                let logEvent = logBuffer.deq();
+                this.dispatch(logEvent);
+            }
+        } catch (error) {
+            logger.error("Error while sending log events", error);
+        }
+
     })
     webSocket.on('close', () => {
         logger.warn("WS connection closed");
@@ -172,6 +187,7 @@ SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
 SecWebSocket.prototype.pingWS = async function pingWS() {
     const self = this;
     let currentTime = Date.now();
+
     let timeDiffInPing = (currentTime - lastPongtime) / 1000;
     if (timeDiffInPing > 40 && lastPongtime != 0) {
         self.obeyReconnect();
@@ -193,6 +209,7 @@ SecWebSocket.prototype.pingWS = async function pingWS() {
         commonUtils.setWSHealthStatus('Error');
         return;
     }
+
 }
 
 /**
@@ -412,6 +429,8 @@ const defaultOnErrCB = () => function onClose(error) {
     statusUtils.addErrortoBuffer(error);
     const self = this;
     logger.error("Error while connecting to validator:", error.message)
+    const logMessage = new LogMessage.logMessage(SEVERE, 'Error while connecting to validator', __filename, error);
+    commonUtils.addLogEventtoBuffer(logMessage);
     logger.warn("Security Agent INACTIVE!!!")
     if (error && error.code && (error.code === 'ECONNREFUSED' || error.code === 'EPIPE' || error.code === 'ECONNRESET')) {
         logger.debug("WS Client Error callback called:", error);

package/lib/nr-security-agent/lib/core/sec-agent-constants.js

@@ -108,6 +108,9 @@ module.exports = {
     CSEC_SEP: ':IAST:',
     RASP: 'RASP',
     IAST: 'IAST',
+    SEVERE: 'SEVERE',
+    HIGH: 'HIGH',
+    CRITICAL: 'CRITICAL',
 
     LOG_MESSAGES: {
         LOADED_CSEC_ENVS_MSG: '[STEP-1][COMPLETE][env] Environment Information Gathering Done.',

package/lib/nr-security-agent/lib/core/sec-util.js

@@ -9,10 +9,12 @@ const { SecEvent } = require('./event');
 const logs = require('./logging');
 const { Agent } = require('./agent');
 const shaUtil = require('./sha-size-util');
-const { LOG_MESSAGES, NR_CSEC_FUZZ_REQUEST_ID, COLON, VULNERABLE, EXITEVENT, EMPTY_STR, RASP } = require('./sec-agent-constants');
+const { LOG_MESSAGES, NR_CSEC_FUZZ_REQUEST_ID, COLON, VULNERABLE, EXITEVENT, EMPTY_STR, RASP, SEVERE } = require('./sec-agent-constants');
 const API = require('../../../nr-security-api');
 const NRAgent = API.getNRAgent();
 const HC = require('./health-check');
+const LogMessage = require('./LogMessage');
+const commonUtils = require('./commonUtils');
 
 const statusUtils = require('./statusUtils');
 
@@ -67,10 +69,10 @@ function generateSecEvent(securityMetadata) {
     const traceObject = securityMetadata.traceObject;
     const request = securityMetadata.request;
 
-    if(request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+    if (request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
         HC.getInstance().iastEventStats.processed++;
     }
-    else{
+    else {
         HC.getInstance().raspEventStats.processed++;
     }
     try {
@@ -102,11 +104,14 @@ function generateSecEvent(securityMetadata) {
     } catch (e) {
         statusUtils.addErrortoBuffer(e);
         logger.error("Error in generating event:", e);
-       
-        if(request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]){
+
+        const logMessage = new LogMessage.logMessage(SEVERE, 'Error while generating event', __filename, e);
+        commonUtils.addLogEventtoBuffer(logMessage);
+
+        if (request && request.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
             HC.getInstance().iastEventStats.errorCount++;
         }
-        else{
+        else {
             HC.getInstance().raspEventStats.errorCount++;
         }
     }
@@ -141,6 +146,9 @@ function generateExitEvent(secEvent) {
             }
         } catch (error) {
             logger.error('Error in generating exit event', error);
+
+            const logMessage = new LogMessage.logMessage(SEVERE, 'Error in generating exit event', __filename, error);
+            commonUtils.addLogEventtoBuffer(logMessage);
             HC.getInstance().exitEventStats.errorCount++;
         }
     }

package/lib/nr-security-agent/lib/core/websocket-client.js

@@ -140,17 +140,18 @@ const sendHC = async function () {
  * @param {JSON} eventJson
  */
 function getDispatcherAndSendEvent(eventJson) {
-    const eventType = eventJson.jsonName;
-    if (eventType === JSON_NAME.EVENT || eventType === EXITEVENT) {
-        hc.getInstance().registerEventProcessed();
-    }
+    if (eventJson) {
+        const eventType = eventJson.jsonName;
+        if (eventType === JSON_NAME.EVENT || eventType === EXITEVENT) {
+            hc.getInstance().registerEventProcessed();
+        }
 
-    dispatcher(eventJson);
+        dispatcher(eventJson);
 
-    if (eventType === JSON_NAME.EVENT || eventType === EXITEVENT) {
-        hc.getInstance().registerEventSent();
+        if (eventType === JSON_NAME.EVENT || eventType === EXITEVENT) {
+            hc.getInstance().registerEventSent();
+        }
     }
-
 }
 
 /**

package/package.json

@@ -1,9 +1,9 @@
 {
   "name": "@newrelic/security-agent",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "New Relic Security Agent for Node.js",
   "main": "index.js",
-  "jsonVersion": "1.1.0",
+  "jsonVersion": "1.1.1",
   "contributors": [
     {
       "name": "Sumit Suthar",
@@ -35,9 +35,9 @@
     "url": "https://github.com/newrelic/csec-node-agent.git"
   },
   "dependencies": {
-    "@aws-sdk/client-lambda": "^3.405.0",
-    "axios": "1.6.0",
-    "check-disk-space": "3.3.1",
+    "@aws-sdk/client-lambda": "^3.436.0",
+    "axios": "^1.6.3",
+    "check-disk-space": "^3.4.0",
     "content-type": "^1.0.5",
     "fast-safe-stringify": "^2.1.1",
     "find-package-json": "^1.2.0",
@@ -56,7 +56,7 @@
     "unescape": "^1.0.1",
     "unescape-js": "^1.1.4",
     "uuid": "^9.0.1",
-    "ws": "^7.5.9"
+    "ws": "^8.14.2"
   },
   "devDependencies": {
     "@hapi/hapi": "^21.3.0",