@newrelic/security-agent 1.5.0 → 2.1.0

package/lib/instrumentation-security/hooks/http/nr-http.js

@@ -5,7 +5,7 @@
 
 module.exports = initialize
 const requestManager = require('../../core/request-manager');
-const { NR_CSEC_FUZZ_REQUEST_ID, QUESTION_MARK, EMPTY_STRING, UTF8, CONTENT_TYPE, TEXT_HTML, APPLICATION_JSON, APPLICATION_XML, APPLICATION_XHTML, TEXT_PLAIN, APPLICATION_X_FORM_URLENCODED, MULTIPART_FORM_DATA, COMMA } = require('../../core/constants');
+const { NR_CSEC_FUZZ_REQUEST_ID, QUESTION_MARK, EMPTY_STRING, UTF8, CONTENT_TYPE, TEXT_HTML, APPLICATION_JSON, APPLICATION_XML, APPLICATION_XHTML, TEXT_PLAIN, APPLICATION_X_FORM_URLENCODED, MULTIPART_FORM_DATA, COMMA, SEMI_COLON, EQUAL, SECURE, HTTPONLY, SAMESITE, STRICT } = require('../../core/constants');
 const ARRAY_TYPE = 'Array';
 const STRING_TYPE = 'string';
 const BUFFER_TYPE = 'Buffer';
@@ -34,12 +34,14 @@ const semver = require('semver');
 const ExceptionReporting = require('../../../nr-security-agent/lib/core/ExceptionReporting');
 
 const CSEC_SEP = ':IAST:';
-const find = '{{NR_CSEC_VALIDATOR_HOME_TMP}}';
+const sep = require('path').sep;
+const find = `${sep}{{NR_CSEC_VALIDATOR_HOME_TMP}}`;
 const CSEC_HOME_TMP_CONST = new RegExp(find, 'g');
 let CSEC_HOME = NRAgent && NRAgent.config.newrelic_home ? NRAgent.config.newrelic_home : NRAgent && NRAgent.config.logging.filepath ? path.dirname(NRAgent.config.logging.filepath) : require('path').join(process.cwd());
 const CSEC_HOME_TMP = `${CSEC_HOME}/nr-security-home/tmp/language-agent/${process.env.applicationUUID}`
 let lastTransactionId = EMPTY_STRING;
 let uncaughtExceptionReportFlag = false;
+const requestBodyLimit = 500;
 
 
 /**
@@ -90,6 +92,10 @@ function setupRequestMapCleanup() {
  * @param {*} moduleName 
  */
 function outboundHook(shim, mod, method, moduleName) {
+  if (API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.ssrf) {
+    logger.warn('ssrf detection is disabled');
+    return;
+  }
   logger.debug(`Instrumenting ${moduleName}.${method}`);
   shim.wrap(mod, method, function makeRequestWrapper(shim, fn) {
     if (!shim.isFunction(fn)) {
@@ -172,8 +178,12 @@ function parseFuzzheaders(requestData, transactionId) {
       const additionalData = fuzzheaders[NR_CSEC_FUZZ_REQUEST_ID].split(CSEC_SEP);
       logger.debug('AdditionalData:', additionalData);
       if (additionalData.length >= 8) {
-        let encryptedData = additionalData[6];
-        let hashVerifier = additionalData[7];
+        let encryptedData = additionalData[6].trim();
+        let hashVerifier = additionalData[7].trim();
+
+        if (lodash.isEmpty(encryptedData) || lodash.isEmpty(hashVerifier)) {
+          return;
+        }
         let decryptedData = secUtils.decryptData(encryptedData);
         let verifiedHash = secUtils.hashVerifier(decryptedData, hashVerifier);
         logger.debug("verifiedHash:", verifiedHash);
@@ -184,6 +194,7 @@ function parseFuzzheaders(requestData, transactionId) {
           logger.debug("fliesTocreate:", filesToCreate);
           for (let i = 0; i < filesToCreate.length; i++) {
             let file = filesToCreate[i].trim();
+            file = decodeURIComponent(file);
             file = file.replace(CSEC_HOME_TMP_CONST, CSEC_HOME_TMP);
             file = path.resolve(file);
             const parentDir = path.dirname(file);
@@ -222,15 +233,15 @@ function parseFuzzheaders(requestData, transactionId) {
 function addRequestData(shim, request) {
   try {
     const data = Object.assign({});
-    const segment = shim.getActiveSegment();
-    if (segment && segment.transaction) {
+    const transaction = shim.tracer.getTransaction(); 
+    if (transaction) {
       data.protocol = (request.connection && request.connection.encrypted) ? 'https' : 'http';
       data.body = null;
       data.headers = request.headers;
       data.url = request.url;
       data.method = request.method;
       data.httpVersion = request.httpVersion;
-      data.serverPort = segment.transaction.port;
+      data.serverPort = transaction.port;
       data.contextPath = '/';
       const queryObject = URL.parse(request.url, true).query;
       data.parameterMap = {};
@@ -244,7 +255,8 @@ function addRequestData(shim, request) {
         });
       }
       data.clientIP = requestIp.getClientIp(request);
-      const transactionId = segment.transaction.id;
+      data.dataTruncated = false;
+      const transactionId = transaction.id;
       const storedRequest = requestManager.getRequestFromId(transactionId);
       lastTransactionId = transactionId;
       if (storedRequest && storedRequest.uri) {
@@ -284,7 +296,7 @@ function emitHook(shim, mod, moduleName) {
       const resp = arguments[2];
 
       if (arguments[0] == 'request') {
-        if (NRAgent && NRAgent.config.security.detection.rxss.enabled) {
+        if (NRAgent && !NRAgent.config.security.exclude_from_iast_scan.iast_detection_category.rxss && NRAgent.config.security.detection.rxss.enabled) {
           responseHook(resp, req, shim);
         }
 
@@ -356,14 +368,28 @@ function onDataHook(shim, mod) {
     return function onDataWrapper() {
       const chunk = arguments[0];
       const chunkType = typeof chunk;
-      segment = shim.getActiveSegment()
+      const transaction = shim.tracer.getTransaction();
       if (chunkType === STRING_TYPE || chunkType === ARRAY_TYPE || chunkType === BUFFER_TYPE || chunkType === UINT8ARRAY_TYPE || chunkType === OBJECT_TYPE) {
         let data = chunk.toString();
-        const transactionId = segment.transaction.id;
+        const transactionId = transaction.id;
         const requestData = requestManager.getRequestFromId(transactionId);
         if (requestData) {
           data = requestData.body ? requestData.body.concat(chunk.toString()) : chunk.toString();
-          requestManager.updateRequestBody(shim, data);
+          requestManager.updateRequestBody(shim, data, false);
+          try {
+            const contentLength = Buffer.byteLength(data, 'utf8');
+            let bodyLimit = requestBodyLimit;
+            if (!isNaN(bodyLimit)) {
+              bodyLimit = bodyLimit * 1000;
+              if (contentLength && contentLength > bodyLimit) {
+                data = truncateStringToBytes(data, bodyLimit);
+                requestManager.updateRequestBody(shim, data, true);
+              }
+            }
+
+          } catch (error) {
+            logger.error("Error while truncating request body", error);
+          }
         }
 
       }
@@ -418,6 +444,11 @@ function responseHook(resp, req, shim) {
       } catch (error) {
         logger.debug("Error while reporting error", error);
       }
+      try {
+        secureCookieCheck(response, shim);
+      } catch (error) {
+        logger.debug("Error while generating secure cookie event");
+      }
 
       responseBodyCompute(response, arguments);
 
@@ -594,7 +625,7 @@ function deleteTempFileForIAST(file) {
  */
 process.on('uncaughtException', (err, origin) => {
   console.error(err);
-  if(uncaughtExceptionReportFlag){
+  if (uncaughtExceptionReportFlag) {
     process.exit(1);
   }
   const request = requestManager.getRequestFromId(lastTransactionId);
@@ -606,3 +637,96 @@ process.on('uncaughtException', (err, origin) => {
   uncaughtExceptionReportFlag = true;
 });
 
+/**
+ * utility to parse response headers for cookie check
+ * @param {*} headersString 
+ * @returns 
+ */
+function responseRawHeaderParsing(headersString) {
+  let setCookieValue;
+  try {
+    const headersArray = headersString.split('\r\n');
+    for (const header of headersArray) {
+      if (header.toLowerCase().startsWith('set-cookie:')) {
+        setCookieValue = header.trim().replace('set-cookie:', '');
+        break;
+      }
+    }
+  } catch (error) {
+
+  }
+  return setCookieValue;
+}
+
+/**
+ * Utility to check insecure cookie settings
+ * @param {*} response 
+ * @param {*} shim 
+ */
+function secureCookieCheck(response, shim) {
+  let cookieHeader = response.getHeader('set-cookie') ? response.getHeader('set-cookie') : responseRawHeaderParsing(response._header);
+  let cookieHeaderList = [];
+  if (!cookieHeader) {
+    return;
+  }
+  if (typeof cookieHeader === 'string') {
+    cookieHeaderList.push(cookieHeader)
+  }
+  else {
+    cookieHeaderList = cookieHeaderList.concat(cookieHeader);
+  }
+  let csec_request = requestManager.getRequest(shim);
+  try {
+    let parameters = [];
+    for (const cookieString of cookieHeaderList) {
+      if (cookieString) {
+        const keyValuePairs = cookieString.split(SEMI_COLON);
+        let params = {
+          "isHttpOnly": false,
+          "isSecure": false,
+          "isSameSiteStrict": false,
+        };
+        for (let i = 0; i < keyValuePairs.length; i++) {
+          const pair = keyValuePairs[i];
+          const [key, value] = pair.trim().split(EQUAL);
+          if (i == 0) {
+            params.name = key;
+            params.value = value;
+          }
+
+          if (key.toLowerCase() === SECURE) {
+            params.isSecure = true;
+          }
+          else if (key.toLowerCase() === HTTPONLY) {
+            params.isHttpOnly = true;
+          }
+          else if (key.toLowerCase() === SAMESITE && value.toLowerCase() === STRICT) {
+            params.isSameSiteStrict = true;
+          }
+        }
+        parameters.push(params);
+      }
+    }
+    const traceObject = secUtils.getTraceObject(shim);
+    const secMetadata = securityMetaData.getSecurityMetaData(csec_request, parameters, traceObject, secUtils.getExecutionId(), EVENT_TYPE.SECURE_COOKIE, EVENT_CATEGORY.SECURE_COOKIE)
+    const secEvent = API.generateSecEvent(secMetadata);
+    API.sendEvent(secEvent);
+  } catch (error) {
+    logger.debug("Error while generating secure cookie event:", error);
+  }
+
+}
+
+function truncateStringToBytes(inputString, maxBytes) {
+  if (!inputString || maxBytes <= 0) {
+    return EMPTY_STRING; // Return an empty string if input is invalid
+  }
+  const buffer = Buffer.from(inputString, UTF8);
+  if (buffer.length <= maxBytes) {
+    return inputString;
+  }
+  const truncatedBuffer = buffer.slice(0, maxBytes);
+  const truncatedString = truncatedBuffer.toString(UTF8);
+  return truncatedString;
+}
+

package/lib/instrumentation-security/hooks/koa/@koa/nr-@koa-router.js

@@ -62,14 +62,14 @@ function paramHook(shim, mod, moduleName) {
     shim.wrap(mod && mod.prototype, 'params', function wrapMatch(shim, fn) {
         logger.debug(`Instrumenting ${moduleName}.prototype.params`);
         return function wrappedMatch() {
-            const segment = shim.getActiveSegment();
-            if (segment && segment.transaction) {
-                let request = requestManager.getRequestFromId(segment.transaction.id);
+            const transaction = shim.tracer.getTransaction();
+            if (transaction) {
+                let request = requestManager.getRequestFromId(transaction.id);
                 try {
                     const uri = this.path;
                     if (request) {
                         request.uri = uri;
-                        requestManager.setRequest(segment.transaction.id, request);
+                        requestManager.setRequest(transaction.id, request);
                     }
 
                 } catch (error) {
@@ -97,7 +97,7 @@ function paramHook(shim, mod, moduleName) {
                             }
                         });
                     }
-                    requestManager.setRequest(segment.transaction.id, request);
+                    requestManager.setRequest(transaction.id, request);
                 } catch (error) {
 
                 }

package/lib/instrumentation-security/hooks/ldap/nr-ldap.js

@@ -19,6 +19,10 @@ const logger = API.getLogger();
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName){
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.ldap_injection){
+    logger.warn('ldap_injection detection is disabled');
+    return;
+  }
   logger.info('Instrumenting '+ moduleName )
 
   if(moduleName==='ldapjs' || moduleName==='ldapts'){

package/lib/instrumentation-security/hooks/mongodb/nr-mongodb.js

@@ -32,6 +32,10 @@ module.exports = initialize;
  * @param {Shim} shim
  */
 function initialize(shim, mongodb, moduleName) {
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.nosql_injection){
+    logger.warn('nosql_injection detection is disabled');
+    return;
+  }
   logger.info(`Instrumenting ${moduleName}`);
   if (!mongodb) {
     return;

package/lib/instrumentation-security/hooks/mysql/nr-mysql.js

@@ -29,6 +29,10 @@ module.exports = initialize;
  */
 function initialize(shim, mysql, moduleName) {
   modName = moduleName;
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.sql_injection){
+    logger.warn('sql_injection detection is disabled');
+    return;
+  }
   logger.info("Instrumenting", moduleName);
   if (shim._moduleRoot.includes("mysql2")) {
     promiseInitialize(shim, mysql, moduleName);

package/lib/instrumentation-security/hooks/native/nr-childProcess.js

@@ -13,6 +13,10 @@ const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
 const logger = API.getLogger();
 
 function initialize(shim, childProcess, moduleName) {
+  if(API && API.getNRAgent() &&  API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.command_injection){
+    logger.warn('command_injection detection is disabled');
+    return;
+  }
   logger.info('Instrumenting child_process');
   execFileHook(shim, childProcess, moduleName);
   spawnHook(shim, childProcess, moduleName);

package/lib/instrumentation-security/hooks/postgres/nr-postgres.js

@@ -15,6 +15,10 @@ const logger = API.getLogger();
 const { NR_CSEC_FUZZ_REQUEST_ID } = require('../../core/constants');
 
 module.exports = function initialize(shim, pgsql, moduleName) {
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.sql_injection){
+    logger.warn('sql_injection detection is disabled');
+    return;
+  }
   logger.info('Instrumenting '+ moduleName)
   // allows for native wrapping to not happen if not necessary
   // when env var is true

package/lib/instrumentation-security/hooks/restify/nr-restify.js

@@ -66,17 +66,17 @@ function initialize(shim, mod, moduleName) {
  * @param {*} req 
  */
 function extractParams(shim, req) {
-    const segment = shim.getActiveSegment();
-    if (segment && segment.transaction) {
+    const transaction = shim.tracer.getTransaction(); 
+    if (transaction) {
 
-        let request = requestManager.getRequestFromId(segment.transaction.id);
+        let request = requestManager.getRequestFromId(transaction.id);
         if (req.params && request) {
             try {
                 Object.keys(req.params).forEach(function (key) {
                     if (req.params[key]) {
                         if (!request.parameterMap[key]) {
                             request.parameterMap[key] = new Array(req.params[key].toString());
-                            requestManager.setRequest(segment.transaction.id, request);
+                            requestManager.setRequest(transaction.id, request);
                         }
                     }
                 });
@@ -91,7 +91,7 @@ function extractParams(shim, req) {
                 Object.keys(query).forEach(function (key) {
                     if (query[key]) {
                         request.parameterMap[key] = new Array(query[key].toString());
-                        requestManager.setRequest(segment.transaction.id, request);
+                        requestManager.setRequest(transaction.id, request);
                     }
                 });
             } catch (error) {
@@ -100,7 +100,7 @@ function extractParams(shim, req) {
         }
         if (req.route && req.route.path && request) {
             request.uri = req.route.path;
-            requestManager.setRequest(segment.transaction.id, request);
+            requestManager.setRequest(transaction.id, request);
         }
     }
-}
+}

package/lib/instrumentation-security/hooks/undici/nr-undici.js

@@ -24,6 +24,10 @@ const url = require('url');
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName) {
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.ssrf){
+    logger.warn('ssrf detection is disabled');
+    return;
+  }
   logger.info('Instrumenting ' + moduleName);
   fetchHook(shim, mod, "fetch");
   let util = shim.require('./lib/core/util');

package/lib/instrumentation-security/hooks/xpath/nr-xpath.js

@@ -19,6 +19,10 @@ const logger = API.getLogger();
  * @param {*} moduleName 
  */
 function initialize(shim, mod, moduleName){
+  if(API && API.getNRAgent() && API.getNRAgent().config.security.exclude_from_iast_scan.iast_detection_category.xpath_injection){
+    logger.warn('xpath_injection detection is disabled');
+    return;
+  }
  logger.info('Instrumenting '+ moduleName)
 
   if(moduleName==='xpath'){

package/lib/nr-security-agent/index.js

@@ -17,7 +17,7 @@ const njsAgentConstants = require('./lib/core/sec-agent-constants');
 const NRLogger = API.newrelic.shim.logger.child({ component: 'security-agent' });
 NRLogger.info("Starting New Relic Node.js Security Agent ");
 try {
-    if (NRAgent.config.security.enabled){
+    if (NRAgent.config.security.enabled) {
         require('../instrumentation-security');
     }
 } catch (error) {
@@ -117,11 +117,44 @@ function initialize() {
     if (NRAgent) {
         NRAgent.on('started', () => {
             NRLogger.info("Started New Relic Node.js Security Agent");
+            logger.info('NR Agent started with agent_run_id:', NRAgent.config.run_id, NRAgent.config.account_id);
+            if (Agent.getAgent().status.getStatus() != 'connecting') {
+                Agent.getAgent().delayed = false;
+                wsClient.obeyReconnect();
+                return;
+            }
             if (NRAgent.config.security.enabled || !NRAgent.config.high_security) {
-                wsClient.initialize();
-                logger.info('NR Agent started with agent_run_id:', NRAgent.config.run_id, NRAgent.config.account_id);
-                Agent.getAgent().status.setStatus('connecting');
-                Agent.setNRAgent(NRAgent);
+                let delayFromConfig = parseInt(NRAgent.config.security.scan_schedule.delay);
+                let delay = delayFromConfig;
+                if (isNaN(delay) || delay < 0) {
+                    delay = 0;
+                }
+                NRAgent.config.security.scan_schedule.delay = delay;
+                const allowSampling = NRAgent.config.security.scan_schedule.always_sample_traces;
+
+                if (delay >= 0) {
+                    logger.debug("IAST delay is set to:", delay);
+                    logger.info("Security Agent delay scan time is set to:", commonUtils.getScheduledScanTime(delay))
+                    Agent.getAgent().delayed = true;
+                    setTimeout(() => {
+                        Agent.getAgent().delayed = false;
+                        logger.info("IAST scanning delay of %s minutes over", delay);
+                        commonUtils.honourDurationConfiguration();
+                        commonUtils.executeCronSchedule();
+                        if (!allowSampling) {
+                            wsClient.initialize();
+                            Agent.getAgent().status.setStatus('connecting');
+                            Agent.setNRAgent(NRAgent);
+                        }
+                    }, delay * 60000);
+                }
+                logger.info("Security Agent is running with config:", JSON.stringify(NRAgent.config.security));
+                if (allowSampling) {
+                    wsClient.initialize();
+                    Agent.getAgent().status.setStatus('connecting');
+                    Agent.setNRAgent(NRAgent);
+                }
+                
             }
             else {
                 logger.warn("security.enabled flag is set to false");

package/lib/nr-security-agent/lib/core/Auth-headers.js

@@ -11,6 +11,7 @@ const logger = logs.getLogger();
 const initLogger = logs.getInitLogger();
 const LinkingMetaData = require('./LinkingMetadata');
 const LogMessage = require('./LogMessage');
+const lodash = require('lodash');
 
 
 /* eslint-disable camelcase */
@@ -37,12 +38,29 @@ function AuthHeaders() {
         authHeaders["NR-CSEC-IAST-DATA-TRANSFER-MODE"] = "PULL";
         authHeaders['NR-CSEC-ENTITY-NAME'] = metadata['entity.name'] ? metadata['entity.name'] : '';
         authHeaders['NR-CSEC-ENTITY-GUID'] = metadata['entity.guid'] ? metadata['entity.guid'] : '';
+        let instanceCount = parseInt(NRAgent.config.security.scan_controllers.scan_instance_count);
+        if (isNaN(instanceCount)) {
+            instanceCount = 0;
+        }
+        if (instanceCount < 0 || instanceCount > 1) {
+            instanceCount = 0;
+        }
+        authHeaders['NR-CSEC-IAST-SCAN-INSTANCE-COUNT'] = instanceCount ? instanceCount : 0
+        if ((NRAgent.config.security.iast_test_identifier && !lodash.isEmpty(NRAgent.config.security.iast_test_identifier)) || process.env.NEW_RELIC_SECURITY_IAST_TEST_IDENTIFIER) {
+            let iast_test_identifier = NRAgent.config.security.iast_test_identifier || process.env.NEW_RELIC_SECURITY_IAST_TEST_IDENTIFIER
+            authHeaders['NR-CSEC-IAST-TEST-IDENTIFIER'] = iast_test_identifier;
+            logger.debug("iast_test_identifier is:", iast_test_identifier);
+            authHeaders['NR-CSEC-IAST-SCAN-INSTANCE-COUNT'] = 1;
+        }
+        authHeaders['NR-CSEC-PROCESS-START-TIME'] = Date.now() - Math.floor(process.uptime() * 1000);
+        authHeaders['NR-CSEC-IGNORED-VUL-CATEGORIES'] = commonUtils.listSkipDetectionCategory();
     } catch (error) {
         logger.error("Exception in preparing auth headers:", error);
         const logMessage = new LogMessage.logMessage("SEVERE", 'Exception in preparing auth headers', __filename, error);
         commonUtils.addLogEventtoBuffer(logMessage);
     }
 
+
     return authHeaders;
 }
 AuthHeaders.prototype.constructor = AuthHeaders;
@@ -75,6 +93,8 @@ function getInstance() {
     return authHeaders;
 }
 
+
+
 module.exports = {
     getInstance
 };

package/lib/nr-security-agent/lib/core/ExceptionReporting.js

@@ -89,6 +89,7 @@ function exceptionReporting(exception, request, responseCode) {
         this.timestamp = Date.now();
         this.httpRequest = request;
         this.httpRequest.route = request.uri ? request.uri : request.url;
+        this.httpRequest.requestURI = request.url.split('?')[0];
         this.exception = null;
         this.counter = 1;
         this.responseCode = responseCode ? responseCode : null

package/lib/nr-security-agent/lib/core/Policy.js

@@ -17,7 +17,6 @@ const logger = logs.getLogger();
 const initLogger = logs.getInitLogger();
 const jsonValidator = require('./jsonValidator');
 const LOG_MESSAGES = require('./sec-agent-constants').LOG_MESSAGES;
-const statusUtils = require('./statusUtils');
 
 function Policy() {
     this.data = {};
@@ -72,7 +71,6 @@ function setDefaultPolicy() {
         logger.info(LOG_MESSAGES.DEFAULT_POL_SET, JSON.stringify(policy.data));
     } catch (e) {
         logger.error(LOG_MESSAGES.UNABLE_SET_DEFAULT_POL, e);
-        statusUtils.addErrortoBuffer(e);
     };
 }
 
@@ -90,16 +88,6 @@ function appInfoVersionUpdate(policy, data) {
     }
 }
 
-/**
- * Function to send updated policy to validator
- * @param {*} data 
- */
-function sendUpdatedPolicy(data) {
-    const wsClient = Agent.getAgent().client;
-    let updatedPolicy = Object.assign({}, data);
-    updatedPolicy.jsonName = 'lc-policy';
-    wsClient.dispatcher(updatedPolicy);
-}
 module.exports = {
     getInstance,
     setPolicyData,

package/lib/nr-security-agent/lib/core/agent.js

@@ -42,6 +42,7 @@ function Agent(applicationInfo, logger, client, status) {
     this.logger = logger;
     this.status = status;
     this.wsStatus = 0;
+    this.delayed = false;
 }
 
 Agent.prototype = {};
@@ -96,6 +97,7 @@ Agent.prototype.setAgentStatus = function setAgentStatus(status) {
     Agent.eventEmitter.emit(EVENTS.AGENT_STATUS_UPDATED_EVENT, status);
 };
 
+
 Agent.EVENTS = EVENTS;
 
 Agent.eventEmitter = new EventEmitter();
@@ -130,13 +132,15 @@ Agent.setNRAgent = function setNRAgent(agent) {
     }
     const CSECAgent = Agent.getAgent();
     if (CSECAgent) {
-        CSECAgent.applicationInfo.entityGuid = NRAgent.config.entity_guid;
+        CSECAgent.applicationInfo.appEntityGuid = NRAgent.config.entity_guid;
+        CSECAgent.applicationInfo.appAccountId = NRAgent.config.account_id;
         CSECAgent.applicationInfo.linkingMetadata = LinkingMetaData.getLinkingMetadata();
         CSECAgent.applicationInfo.linkingMetadata.agentRunId = NRAgent.config.run_id;
         CSECAgent.setApplicationInfo(CSECAgent.applicationInfo);
     }
 };
 
+
 module.exports = {
     Agent
 };

package/lib/nr-security-agent/lib/core/applicationinfo.js

@@ -90,10 +90,10 @@ function ApplicationInfo () {
     const k8sHost = isK8S();
     const ECSEnv = isECSEnv();
     const isLambda = IS_LAMBDA_ENV;
-
     this.jsonName = APPLICATION_INFO_KEYWORD;
     if (NRAgent && NRAgent.config) {
-        this.entityGuid = NRAgent.config.entity_guid;
+        this.appEntityGuid = NRAgent.config.entity_guid;
+        this.appAccountId = NRAgent.config.account_id;
     }
     this.eventType = 'sec_appinfo';
     this.startTime = Date.now();