@newrelic/security-agent 1.2.0 → 1.3.0

package/lib/instrumentation-security/hooks/grpc-js/nr-grpc.js

@@ -0,0 +1,301 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+
+
+const requestManager = require("../../core/request-manager");
+const secUtils = require("../../core/sec-utils");
+const API = require("../../../nr-security-api");
+const securityMetaData = require('../../core/security-metadata');
+const { EVENT_TYPE, EVENT_CATEGORY } = require('../../core/event-constants');
+const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
+const logger = API.getLogger();
+const semver = require('semver');
+const grpcutils = require('../../core/grpc-utils');
+let serverAddress;
+
+module.exports.initialize = function initialize(shim, grpc, moduleName) {
+  logger.info('Instrumenting grpc', moduleName);
+  const grpcVersion = shim.require('./package.json').version;
+  logger.debug("grpc version:", grpcVersion);
+
+  if (semver.lt(grpcVersion, '1.4.0')) {
+    logger.warn('gRPC server-side instrumentation only supported on grpc-js >=1.4.0')
+    return
+  }
+
+  if (semver.gte(grpcVersion, '1.8.0')) {
+    const resolvingCall = shim.require('./build/src/resolving-call')
+    shim.wrap(resolvingCall.ResolvingCall.prototype, 'start', wrapStart)
+  } else {
+    const callStream = shim.require('./build/src/call-stream')
+    shim.wrap(callStream.Http2CallStream.prototype, 'start', wrapStart)
+  }
+
+  const server = shim.require('./build/src/server')
+  shim.wrap(server.Server.prototype, 'bindAsync', bindAsyncWrapper)
+  shim.wrap(server.Server.prototype, 'register', wrapRegister)
+
+  //get all service
+  shim.wrap(server.Server.prototype, 'addService', wrapAddService);
+
+  //load package definition
+  const makeClient = shim.require('./build/src/make-client');
+  shim.wrap(makeClient, 'loadPackageDefinition', wrapLoadPackageDefinition);
+
+}
+
+module.exports.wrapStartResolve = function wrappedStartResolve(shim, resolvingCall) {
+  shim.wrap(resolvingCall.ResolvingCall.prototype, 'start', wrapStart)
+}
+
+module.exports.wrapStartCall = function wrappedClient(shim, callStream) {
+  shim.wrap(callStream.Http2CallStream.prototype, 'start', wrapStart)
+}
+
+module.exports.wrapServer = function wrappedServer(shim, server) {
+  const grpcVersion = shim.require('./package.json').version
+  logger.info("Instrumenting @grpc/grpc-js", grpcVersion)
+  if (semver.lt(grpcVersion, '1.4.0')) {
+    logger.warn('gRPC server-side instrumentation only supported on grpc-js >=1.4.0')
+    return
+  }
+
+  shim.wrap(server.Server.prototype, 'register', wrapRegister)
+  shim.wrap(server.Server.prototype, 'bindAsync', bindAsyncWrapper)
+  //get all service
+  shim.wrap(server.Server.prototype, 'addService', wrapAddService);
+}
+
+module.exports.wrapMakeClient = function wrapMakeClient(shim, makeClient) {
+  shim.wrap(makeClient, 'loadPackageDefinition', wrapLoadPackageDefinition);
+}
+
+
+/**
+ * Instruments grpc-js client by intercepting the function that
+ * initiates client requests. This handles all four types of client
+ * invocations: unary, client-streaming, server-streaming, and
+ * bidirectional streaming.
+ *
+ * @param {object} shim the generic shim to instrument with
+ * @param {Function} original the original function
+ * @returns {Function} the instrumented function
+ */
+function wrapStart(shim, original) {
+  if (!shim.isFunction(original)) {
+    return original
+  }
+  return function wrappedStart() {
+    const channel = this.channel;
+    const authorityName = (channel.target && channel.target.path) || channel.getDefaultAuthority;
+    // in 1.8.0 this changed from methodName to method
+    const method = this.methodName || this.method;
+    const protocol = 'grpc:';
+    const url = `${protocol}//${authorityName}${method}`;
+    logger.debug("grpc url is:", url)
+    const request = requestManager.getRequest(shim);
+    let urlObj = {
+      "headers":
+      {
+        "host": authorityName
+      },
+      "method": method,
+      "path": method,
+      "protocol": protocol,
+    }
+    if (request) {
+      const traceObject = secUtils.getTraceObject(shim);
+      const secMetadata = securityMetaData.getSecurityMetaData(request, urlObj, traceObject, secUtils.getExecutionId(), EVENT_TYPE.HTTP_REQUEST, EVENT_CATEGORY.HTTP)
+      const secEvent = API.generateSecEvent(secMetadata);
+      API.sendEvent(secEvent);
+    }
+
+    const res = original.apply(this, arguments);
+    return res;
+  }
+}
+
+
+
+function wrapAddService(shim, original) {
+  if (!shim.isFunction(original)) {
+    return original
+  }
+  return function wrappedbindAsync() {
+    const result = original.apply(this, arguments);
+    return result;
+  }
+}
+
+function wrapLoadPackageDefinition(shim, original) {
+  if (!shim.isFunction(original)) {
+    return original
+  }
+  return function wrappedbindAsync() {
+    let serviceObject = arguments[0];
+    const result = original.apply(this, arguments);
+    iterateNestedObjectForServiceLookup(result, serviceObject);
+    return result;
+  }
+}
+
+
+
+
+function bindAsyncWrapper(shim, original) {
+  if (!shim.isFunction(original)) {
+    return original
+  }
+  return function wrappedbindAsync() {
+    serverAddress = arguments[0];
+    shim.grpcServerAddress = serverAddress;
+    try {
+      const splittedData = serverAddress.split(":");
+      serverPort = splittedData[1];
+      shim.serverPort = parseInt(serverPort);
+    } catch (error) {
+
+    }
+    const result = original.apply(this, arguments);
+    return result;
+  }
+}
+
+
+
+/**
+ * Instruments the grpc-js server by intercepting the moment when
+ * server methods are registered from the method implementations
+ * provided to grpc-js. This handles all four types of server
+ * invocations: unary, client-streaming, server-streaming, and
+ * bidirectional streaming.
+ *
+ * @param {object} shim the web shim to instrument with
+ * @param {Function} original the original function
+ * @returns {Function} the instrumented function
+ */
+function wrapRegister(shim, original) {
+  if (!shim.isFunction(original)) {
+    return original
+  }
+  return function wrappedRegister() {
+    wrapHandler(shim, arguments, '1');
+    const result = original.apply(this, arguments);
+    return result;
+  }
+}
+
+
+/**
+ * Wrapper to hook handler function
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} method 
+ */
+function wrapHandler(shim, mod, method) {
+  shim.wrap(mod, method, function wrapHandler(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    return function wrappedHandler() {
+      const type = this.type;
+      const path = this.path;
+      wrapCallback(shim, arguments, '1');
+      addRequestData(shim, type, path, arguments[0]);
+      const result = fn.apply(this, arguments);
+      return result;
+
+    }
+  })
+}
+
+/**
+ * Wrapper to hook callback response
+ * @param {*} shim 
+ * @param {*} mod 
+ * @param {*} method 
+ */
+function wrapCallback(shim, mod, method) {
+  shim.wrap(mod, method, function wrapCallback(shim, fn) {
+    if (!shim.isFunction(fn)) {
+      return fn
+    }
+    return function wrappedCallback() {
+      const response = arguments[1];
+      const result = fn.apply(this, arguments);
+      return result;
+
+    }
+  })
+}
+
+/**
+ * Utility function to add grpc request data in request map
+ * @param {*} shim 
+ * @param {*} type 
+ * @param {*} path 
+ * @param {*} args 
+ */
+function addRequestData(shim, type, path, args) {
+  const data = Object.assign({});
+  try {
+    const segment = shim.getActiveSegment();
+    if (segment && segment.transaction) {
+      data.method = path;
+      data.url = path;
+      data.uri = path;
+      data.headers = args.metadata.getMap();
+      if (data.headers && data.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+        let bufferObj = Buffer.from(data.headers[NR_CSEC_FUZZ_REQUEST_ID], "base64");
+        let decodedString = bufferObj.toString("utf8");
+        data.headers[NR_CSEC_FUZZ_REQUEST_ID] = decodedString;
+      }
+      data.type = type;
+      data.protocol = 'grpc';
+      data.isGRPC = true;
+      data.body = JSON.stringify(args.request);
+      data.serverPort = shim.serverPort;
+      const transactionId = segment.transaction.id;
+      requestManager.setRequest(transactionId, data);
+    }
+  } catch (error) {
+    logger.error("Error occured while extracting grpc request", error);
+  }
+}
+
+/**
+ * Utilty to set grpc util Maps
+ * @param {*} serviceObject 
+ */
+function serviceUtil(serviceObject) {
+  let serviceValues = Object.values(serviceObject)[0];
+  for (const [key, value] of Object.entries(serviceValues)) {
+    let servObj = {
+      'serviceName': serviceObject.serviceName,
+      'originalName': value.originalName,
+    }
+    grpcutils.setMethod(value.path, servObj);
+  }
+}
+
+function iterateNestedObjectForServiceLookup(result, serviceObject) {
+  try {
+    for (const key in result) {
+      if (typeof result[key] === 'object' && result[key] !== 'null') {
+        iterateNestedObjectForServiceLookup(result[key], serviceObject); // Recurse into nested object
+      } else {
+        let value = result[key];
+        if (value && value.serviceName) {
+          if (!value.type && value.serviceName) {
+            grpcutils.setService(value.serviceName, serviceObject);
+            serviceUtil(value);
+          }
+        }
+      }
+    }
+  } catch (error) {
+    logger.error("Error while getting service definition", error);
+  }
+}

package/lib/instrumentation-security/index.js

@@ -199,10 +199,39 @@ newrelic.instrumentWebframework({
   }
 })
 
+newrelic.instrument({
+  moduleName: '@grpc/grpc-js/build/src/server',
+  isEsm: true,
+  onRequire: require('./hooks/grpc-js/nr-grpc').wrapServer,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
 
+newrelic.instrument({
+  moduleName: '@grpc/grpc-js/build/src/make-client',
+  isEsm: true,
+  onRequire: require('./hooks/grpc-js/nr-grpc').wrapMakeClient,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
 
+newrelic.instrument({
+  moduleName: '@grpc/grpc-js/build/src/resolving-call',
+  isEsm: true,
+  onRequire: require('./hooks/grpc-js/nr-grpc').wrapStartResolve,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
 
-
-
-
+newrelic.instrument({
+  moduleName: '@grpc/grpc-js/build/src/call-stream',
+  isEsm: true,
+  onRequire: require('./hooks/grpc-js/nr-grpc').wrapStartCall,
+  onError: function intrumentErrorHandler(err) {
+    logger.error(err.message, err.stack)
+  }
+})
 

package/lib/nr-security-agent/index.js

@@ -16,6 +16,13 @@ const njsAgentConstants = require('./lib/core/sec-agent-constants');
 
 const NRLogger = API.newrelic.shim.logger.child({ component: 'security-agent' });
 NRLogger.info("Starting New Relic Node.js Security Agent ");
+try {
+    if (NRAgent.config.security.enabled){
+        require('../instrumentation-security');
+    }
+} catch (error) {
+    logger.error("Error while applying security instrumentation")
+}
 
 const {
     IS_LAMBDA_ENV,
@@ -169,7 +176,6 @@ function getProcCMDLineSanitized(applicationInfoModule) {
         return;
     }
     if (initialize()) {
-        require('../instrumentation-security');
         initLogger.info("[STEP-6] => Application instrumentation applied successfully");
     }
 })();

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -107,7 +107,7 @@ function createPathIfNotExist(dir) {
     } catch (error) {
         logger.debug(dir + ' Not Created', error);
         const LogMessage = require('./LogMessage');
-        const logMessage = new LogMessage.logMessage("SEVERE", 'Error in creating directory', __filename, error);
+        const logMessage = new LogMessage.logMessage("DEBUG", 'Error in creating directory', __filename, error);
         addLogEventtoBuffer(logMessage);
     }
 }
@@ -288,7 +288,7 @@ function removeOlderSnapshots() {
     } catch (error) {
         logger.debug(error);
         const LogMessage = require('./LogMessage');
-        const logMessage = new LogMessage.logMessage("SEVERE", 'Error in processing snapshot files', __filename, error);
+        const logMessage = new LogMessage.logMessage("DEBUG", 'Error in processing snapshot files', __filename, error);
         addLogEventtoBuffer(logMessage);
     }
 }

package/lib/nr-security-agent/lib/core/connections/grpcClient.js

@@ -0,0 +1,112 @@
+/*
+ * Copyright 2023 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Pre-Release
+ */
+const logger = require('../logging').getLogger();
+const grpcutils = require('../../../../instrumentation-security/core/grpc-utils');
+const clientMap = new Map();
+let grpc;
+const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/sec-agent-constants');
+
+/**
+ * Utility to get client object
+ * @param {*} config 
+ * @returns 
+ */
+function getGPRCClient(config) {
+    let grpc = require("@grpc/grpc-js");
+    try {
+        const serviceName = grpcutils.getMethod(config.method).serviceName;
+
+        if (clientMap.has(serviceName)) {
+            return clientMap.get(serviceName);
+        }
+        const serviceObject = grpcutils.getService(serviceName);
+        const definition = grpc.loadPackageDefinition(serviceObject);
+        let service = getNestedValue(definition, serviceName)
+        if (service) {
+            logger.info("GRPC client service extracted successfully");
+        }
+        const client = new service(
+            "localhost:" + config.serverPort,
+            grpc.credentials.createInsecure()
+        );
+        if (!clientMap.has(serviceName)) {
+            clientMap.set(serviceName, client);
+        }
+        if(client){
+            logger.info("GRPC IAST client created successfully");
+        }
+        return client;
+    } catch (error) {
+        logger.error("error while creating client:", error);
+    }
+
+}
+
+/**
+ * Utility to fire unary requests
+ * @param {*} client 
+ * @param {*} config 
+ */
+function fireUnaryRequest(client, config) {
+    try {
+        const methodObj = grpcutils.getMethod(config.requestURI);
+        if (methodObj && methodObj.originalName) {
+            let method = methodObj.originalName;
+            let metadata = new grpc.Metadata();
+            let bufferObj = Buffer.from(config.headers[NR_CSEC_FUZZ_REQUEST_ID], "utf8");
+            let base64String = bufferObj.toString("base64");
+            metadata.add(NR_CSEC_FUZZ_REQUEST_ID, base64String);
+            client[method](JSON.parse(config.data), metadata, (err, res) => {
+                if (err) {
+                    logger.debug("Error occured:", err);
+                    return
+                }
+
+                logger.info("Fuzz success: ", JSON.stringify(config));
+                return res;
+            })
+        }
+        else {
+            logger.debug("Not Found:", config.url);
+        }
+    } catch (error) {
+        logger.debug("Error while firing Unary request:", error);
+    }
+}
+
+/**
+ * fire gRPC request based on provided config 
+ * @param {*} config 
+ * @returns 
+ */
+function fireRequest(config) {
+    try {
+        grpc = require("@grpc/grpc-js");
+    } catch (error) {
+        logger.debug("Unable to import grpc module", error);
+    }
+    let client = getGPRCClient(config);
+    fireUnaryRequest(client, config)
+}
+
+
+  function getNestedValue(obj, targetKey) {
+    for (const key in obj) {
+      if (key === targetKey) {
+        return obj[key];
+      } else if (typeof obj[key] === 'object' && obj[key] !== null) {
+        const result = getNestedValue(obj[key], targetKey);
+        if (result !== undefined) {
+          return result;
+        }
+      }
+    }
+    return undefined; // Key not found
+  }
+
+
+module.exports = {
+    fireRequest
+};

package/lib/nr-security-agent/lib/core/connections/websocket/response/IASTUtils.js

@@ -31,6 +31,9 @@ function completedRequestsMapInit(id) {
 
 function addCompletedRequests(id, eventId) {
     let data = completedRequestsMap.get(id);
+    if(!data){
+        return;
+    }
     data.push(eventId);
     completedRequestsMap.set(id, data);
 }

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -7,6 +7,7 @@
 const stringify = require('fast-safe-stringify');
 
 const restClient = require('../../restclient');
+const grpcClient = require('../../grpcClient');
 const { Agent } = require('../../../agent');
 const { FuzzFailEvent } = require('../../../FuzzFailEvent');
 const { CSEC_HOME_TMP, COLON, NR_CSEC_FUZZ_REQUEST_ID, SLASH, CSEC_SEP, SEVERE } = require('../../../sec-agent-constants');
@@ -20,9 +21,6 @@ const LogMessage = require('../../../LogMessage');
 require('dns').setDefaultResultOrder('ipv4first')
 const PolicyManager = require('../../../Policy');
 
-const {
-    IS_LAMBDA_ENV,
-    AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER } = require('../../../sec-agent-constants');
 const statusUtils = require('../../../statusUtils');
 
 const find = `${SLASH}{{NR_CSEC_VALIDATOR_HOME_TMP}}`;
@@ -53,7 +51,7 @@ function startIASTSchedular() {
     if (isNaN(probingInterval)) {
         probingInterval = 5;
     }
-
+    
     iastIntervalConst = setInterval(() => {
         let data = IASTUtil.generateIASTDataRequest();
         let currentTime = Date.now();
@@ -125,13 +123,16 @@ function handler(json) {
 function handleFuzzRequest(fuzzDetails) {
     const { fuzzRequest } = fuzzDetails;
     try {
-        if (IS_LAMBDA_ENV) {
-            const qualifiedARN = Agent.getAgent().applicationInfo.applicationUUID;
-            const splitArn = String.prototype.split.call(qualifiedARN, ':');
-            const arn = splitArn.slice(0, splitArn.length - 1).join(':');
-            const ver = process.env[AWS_LAMBDA_FUNCTION_VERSION_ENV_IDENTIFIER];
-            logger.info('Invoking Lambda:: ARN: ' + arn);
-            logger.info('Invoking Lambda:: Version: ' + ver);
+        if (fuzzRequest.protocol == 'grpc') {
+            const config = parseGRPCRequestToFuzz(fuzzRequest);
+            config.headers['nr-csec-parent-id'] = fuzzRequest.id;
+            IASTUtil.completedRequestsMapInit(fuzzRequest.id);
+            grpcClient.fireRequest(config);
+            if (fuzzRequest.headers && fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]) {
+                logScannedApiId(fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID], fuzzRequest.requestURI)
+            }
+
+            IASTUtil.removePendingRequestId(fuzzRequest.id);
 
         } else {
             const config = parseAxiosHttpRequestToFuzz(fuzzRequest);
@@ -153,7 +154,6 @@ function handleFuzzRequest(fuzzDetails) {
 
 
             logger.info('Firing http request:: URL: ' + config.url);
-
             const response = restClient.fireRequest(config);
             handleFuzzResponse(response, fuzzDetails);
         }
@@ -210,6 +210,26 @@ function parseAxiosHttpRequestToFuzz(requestObject) {
     };
 }
 
+/**
+ * Parses the passed fuzz request object to
+ * Axios config.
+ *
+ * @param {JSON} requestObject
+ */
+function parseGRPCRequestToFuzz(requestObject) {
+    let serverName = requestObject.serverName ? requestObject.serverName : LOCALHOST;
+    let host = serverName + COLON + requestObject.serverPort
+    return {
+        url: requestObject.protocol + COLON_SLASH_SLASH + host + requestObject.url,
+        requestURI: requestObject.requestURI,
+        protocol: requestObject.protocol,
+        serverPort: requestObject.serverPort,
+        method: requestObject.method,
+        data: requestObject.body,
+        headers: requestObject.headers,
+        timeout: 5000,
+    };
+}
 
 
 /**

package/lib/nr-security-agent/lib/core/connections/websocket/response/startup-handshake-handler.js

@@ -18,7 +18,7 @@ module.exports.handler = function handler(json) {
       
         initLogger.info(LOG_MESSAGES.AGENT_INIT_WITH_PROP, JSON.stringify(startupConfig.config));
         initLogger.info('Security Agent is now ACTIVE for', applicationInfoModule.getInstance().applicationUUID);
-        const logMessage = new LogMessage.logMessage("SEVERE", `Security Agent is ACTIVE for ${ applicationInfoModule.getInstance().applicationUUID}`, __filename, null);
+        const logMessage = new LogMessage.logMessage("INFO", `Security Agent is ACTIVE for ${ applicationInfoModule.getInstance().applicationUUID}`, __filename, null);
         require('../../../commonUtils').addLogEventtoBuffer(logMessage);
 
     } catch (error) {

package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js

@@ -104,6 +104,7 @@ SecWebSocket.prototype.init = function init() {
     const validatorService = commonUtils.getValidatorServiceEndpointURL();
     const authHeaders = require('../../Auth-headers').getInstance();
     initLogger.info(`Connecting to Validator at ${validatorService}`);
+    IASTUtil.IASTCleanup();
     let cert = ''
     try {
         const certPath = commonUtils.getPathOfCACert();
@@ -138,6 +139,7 @@ SecWebSocket.prototype.init = function init() {
     })
     webSocket.on('close', () => {
         logger.warn("WS connection closed");
+        this.obeyReconnect();
     })
     this.instance = webSocket;
 };
@@ -172,7 +174,7 @@ SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
     }
 
     initTimeOut = setTimeout(() => {
-        IASTUtil.IASTCleanup();
+
         logger.debug("Terminating ws instance and reconnecting");
         try {
             instance.terminate();
@@ -189,18 +191,21 @@ SecWebSocket.prototype.pingWS = async function pingWS() {
     let currentTime = Date.now();
 
     let timeDiffInPing = (currentTime - lastPongtime) / 1000;
-    if (timeDiffInPing > 40 && lastPongtime != 0) {
+    logger.debug("Websocket ready state is:",self.instance.readyState)
+    
+    if (timeDiffInPing > 40 && lastPongtime != 0 && self.instance.readyState > 1) {
         self.obeyReconnect();
         lastPongtime = 0;
         return;
     }
+
     try {
         await promisify(self.instance, self.instance.ping)(ACK, true, function (err) {
             if (err) {
                 logger.debug("Error while pinging:", err);
                 commonUtils.setWSHealthStatus('Error');
                 statusUtils.addErrortoBuffer(err);
-                self.obeyReconnect();
+    
             }
         });
     } catch (err) {
@@ -258,7 +263,7 @@ SecWebSocket.prototype.dispatch = async function dispatch(event) {
                 hc.getInstance().exitEventStats.sent++;
             }
 
-        });
+        })
     } catch (error) {
         logger.debug(LOG_MESSAGES.ERROR_WHILE_SEND_EVENT, eventStr, error);
         statusUtils.addErrortoBuffer(error);

package/lib/nr-security-agent/lib/core/sec-util.js

@@ -101,6 +101,7 @@ function generateSecEvent(securityMetadata) {
         const isAPIBlocked = false;
         const event = new SecEvent(traceObject.sourceDetails.fileName, traceObject.sourceDetails.funcName, traceObject.sourceDetails.lineNumber, securityMetadata.interceptedArgs, securityMetadata.executionId, agentModule.applicationInfo, securityMetadata.request, securityMetadata.eventType, traceObject.sourceDetails.source, securityMetadata.eventCategory, metaData, stakTrace, apiId, isAPIBlocked);
         event.metaData.isClientDetectedFromXFF = isClientDetectedFromXFF;
+        event.httpRequest.route = uri;
         return event;
     } catch (e) {
         statusUtils.addErrortoBuffer(e);

package/lib/nr-security-agent/lib/core/statusUtils.js

@@ -98,7 +98,7 @@ function writeSnapshot() {
         if (err) {
             logger.debug(err.message);
             const LogMessage = require('./LogMessage');
-            const logMessage = new LogMessage.logMessage("SEVERE", 'Error in creating snapshot file', __filename, err);
+            const logMessage = new LogMessage.logMessage("DEBUG", 'Error in creating snapshot file', __filename, err);
             commonUtils.addLogEventtoBuffer(logMessage);
         } else {
             logger.info('Snapshot updated to file: %s', statusFile);

package/lib/nr-security-agent/lib/core/websocket-client.js

@@ -82,7 +82,7 @@ const initialize = function () {
         try {
             const framework = NRAgent.environment.get('Framework')[0];
             const dispatcher = NRAgent.environment.get('Dispatcher')[0];
-            const logMessage = new LogMessage.logMessage("SEVERE", `Detected framework: ${framework} and dispatcher: ${dispatcher}`, __filename, null);
+            const logMessage = new LogMessage.logMessage("INFO", `Detected framework: ${framework} and dispatcher: ${dispatcher}`, __filename, null);
             commonUtils.addLogEventtoBuffer(logMessage);
         } catch (error) {
             logger.debug("Error while extracting data from APM environment",error);