@newrelic/security-agent 1.5.0 → 2.1.0

package/lib/nr-security-agent/lib/core/commonUtils.js

@@ -23,6 +23,23 @@ let websocketHealth;
 
 const ringBuffer = require('ringbufferjs');
 const bufferedLogEvents = new ringBuffer(10);
+const { CronJob } = require('cron');
+let scanStartTime = 0;
+let trafficStartedTime = 0;
+const cron = require('cron');
+
+const skip_detection_category_map = {
+    insecure_settings: ['CRYPTO', 'HASH', 'RANDOM', 'SECURE_COOKIE', 'TRUSTBOUNDARY'],
+    invalid_file_access: ['FILE_OPERATION', 'FILE_INTEGRITY'],
+    sql_injection: ['SQL_DB_COMMAND'],
+    nosql_injection: ['NOSQL_DB_COMMAND'],
+    ldap_injection: ['LDAP'],
+    javascript_injection: ['JS_INJECTION'],
+    command_injection: ['SYSTEM_COMMAND'],
+    xpath_injection: ['XPATH'],
+    ssrf: ['HTTP_REQUEST'],
+    rxss: ['REFLECTED_XSS']
+}
 
 
 /**
@@ -133,7 +150,6 @@ function getOS() {
 function createDirectories() {
     createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home`);
     createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}logs`);
-    createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}logs${SLASH}snapshots`);
     createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp`);
     createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp${SLASH}language-agent`);
     createPathIfNotExist(`${CSEC_HOME}${SLASH}nr-security-home${SLASH}tmp${SLASH}language-agent${SLASH}${getUUID()}`);
@@ -159,14 +175,11 @@ async function initialSetup() {
  */
 function isLogAccessible(logFileName) {
     return new Promise((resolve) => {
-        if (logFileName === njsAgentConstants.STATUS_LOG_FILE && require('./statusUtils').getBufferedHC().length === 0) {
-            resolve('OK');
-        }
         fs.access(logFileName, fs.constants.F_OK | fs.constants.W_OK, (err) => {
             if (err) {
                 resolve('Error');
             }
-            else if ((!logs.isLoggerOk || logger.level.levelStr == 'OFF') && logFileName != njsAgentConstants.STATUS_LOG_FILE) {
+            else if ((!logs.isLoggerOk || logger.level.levelStr == 'OFF')) {
                 resolve('Error');
             }
             else {
@@ -256,42 +269,6 @@ function isAgentActiveState() {
 function iastRestClientStatus() {
     return 'OK';
 }
-/**
- * Utiltity to remove older snapshots
- */
-function removeOlderSnapshots() {
-    try {
-        const basePath = njsAgentConstants.LOG_DIR + 'snapshots' + SLASH;
-        const directoryContent = fs.readdirSync(basePath);
-        const files = directoryContent.filter((filename) => {
-            return fs.statSync(`${basePath}${SLASH}${filename}`).isFile();
-        });
-        const sorted = files.sort((a, b) => {
-            const firstStat = fs.statSync(`${basePath}${SLASH}${a}`);
-            const secondStat = fs.statSync(`${basePath}${SLASH}${b}`);
-            return new Date(secondStat.mtime).getTime() - new Date(firstStat.mtime).getTime();
-        });
-        for (let i = 99; i < sorted.length; i++) {
-            const fileToDelete = basePath + sorted[i];
-            try {
-                fs.unlink(fileToDelete, (err) => {
-                    if (err) {
-                        logger.error(err);
-                    } else {
-                        logger.debug('Snapshot deleted:', fileToDelete);
-                    }
-                });
-            } catch (error) {
-                logger.error(error);
-            }
-        }
-    } catch (error) {
-        logger.debug(error);
-        const LogMessage = require('./LogMessage');
-        const logMessage = new LogMessage.logMessage("DEBUG", 'Error in processing snapshot files', __filename, error);
-        addLogEventtoBuffer(logMessage);
-    }
-}
 /**
  * Utilty to remove older log files.
  */
@@ -311,7 +288,7 @@ function removeOlderlogfiles() {
             return new Date(secondStat.mtime).getTime() - new Date(firstStat.mtime).getTime();
         });
         let maxLogfile = process.env.NR_CSEC_DEBUG_LOGFILE_MAX_COUNT;
-        if(isNaN(maxLogfile)){
+        if (isNaN(maxLogfile)) {
             maxLogfile = 2;
         }
         for (let i = maxLogfile; i < sorted.length; i++) {
@@ -449,7 +426,7 @@ function addLogEventtoBuffer(logMessage) {
  * Utility to get framework from APM
  * @returns 
  */
-function getFramework(){
+function getFramework() {
     let framework = EMPTY_STR;
     try {
         framework = NRAgent.environment.get('Framework')[0];
@@ -459,6 +436,119 @@ function getFramework(){
     return framework;
 }
 
+function listSkipDetectionCategory() {
+    let skipList = [];
+    try {
+        let skipCataegories = NRAgent.config.security.exclude_from_iast_scan.iast_detection_category;
+        for (const key in skipCataegories) {
+            if (skipCataegories[key]) {
+                skipList = skipList.concat(skip_detection_category_map[key]);
+            }
+        }
+    } catch (error) {
+        logger.error("Error while processing skip detection categories:", error);
+    }
+    return skipList;
+}
+
+function refreshAgent() {
+    const { Agent } = require('./agent');
+    if (Agent.getAgent().status.getStatus() == 'disabled' || Agent.getAgent().delayed) {
+        Agent.getAgent().delayed = false;
+        const wsClient = Agent.getAgent().client;
+        Agent.getAgent().status.setStatus('connecting');
+        wsClient.obeyReconnect();
+        honourDurationConfiguration();
+    }
+}
+
+function executeCronSchedule() {
+    try {
+        let schedule = NRAgent.config.security.scan_schedule.schedule;
+        if (lodash.isEmpty(schedule)) {
+            return;
+        }
+        logger.debug("Schedule config is set to:", schedule);
+        schedule = schedule.replace(/\?/g, '*');
+        logger.info("Security Agent scheduled time is set to:", getScheduledScanTime(Math.ceil(cron.timeout(schedule) / 60000)))
+        const job = new cron.CronJob(
+            schedule, // cronTime
+            function () {
+                logger.debug('Cron schedule invoked');
+                logger.info("Security Agent scheduled time is set to:", getScheduledScanTime(Math.ceil(cron.timeout(schedule) / 60000)))
+                refreshAgent()
+            }, // onTick
+            null, // onComplete
+            true, // start
+        );
+    } catch (error) {
+        logger.error("Error while processing schedule. Please check schedule cron expression", error);
+        shutDownAgent();
+    }
+
+}
+
+function honourDurationConfiguration() {
+    let durationFromConfig = parseInt(NRAgent.config.security.scan_schedule.duration);
+    let duration = durationFromConfig;
+    if (isNaN(duration) || duration < 0) {
+        duration = 0;
+    }
+    logger.debug("IAST duration is set to:", duration);
+    NRAgent.config.security.scan_schedule.duration = duration;
+    if (duration < 1) {
+        return;
+    }
+    logger.info("Security Agent shutdown is set to:", getScheduledScanTime(duration))
+    setTimeout(() => {
+        shutDownAgent();
+    }, duration * 60000);
+}
+/**
+ * Utility to send error to error inbox of APM
+ * @param {*} error 
+ */
+function sendErrorToErrorInbox(error) {
+    API.newrelic.noticeError(error);
+}
+
+const getScheduledScanTime = (delayInMinutes) => {
+    // Get the current time
+    const currentTime = new Date();
+
+    // Add the given minutes to the current time
+    currentTime.setMinutes(currentTime.getMinutes() + delayInMinutes);
+
+    const year = currentTime.getFullYear();
+    const month = currentTime.toLocaleString("default", { month: "long" });
+    const day = currentTime.toLocaleString("default", { weekday: "long" });
+    const date = currentTime.getDate();
+    const hours = currentTime.getHours();
+    const minutes = currentTime.getMinutes();
+    const seconds = currentTime.getSeconds();
+    const futureUpdatedTime = `${hours.toString().padStart(2, "0")}:${minutes.toString().padStart(2, "0")}:${seconds.toString().padStart(2, "0")}`;
+    const futureDateTime = `${day}, ${month} ${date} ${year} ${futureUpdatedTime}`;
+    return futureDateTime
+};
+
+function shutDownAgent() {
+    const { Agent } = require('./agent');
+    if (NRAgent.config.security.scan_schedule.always_sample_traces) {
+        Agent.getAgent().delayed = true;
+        logger.warn('Scan duration completed, IAST going under hibernate mode')
+        return;
+    }
+    if (Agent.getAgent().status.getStatus() === 'disabled') {
+        return;
+    }
+    Agent.getAgent().status.setStatus('disabled');
+    const wsClient = Agent.getAgent().client;
+    wsClient.closeWS();
+    logger.warn("Security Agent status is disabled");
+}
+
+
+
 
 module.exports = {
     getUUID,
@@ -475,7 +565,6 @@ module.exports = {
     getHCStats,
     isAgentActiveState,
     iastRestClientStatus,
-    removeOlderSnapshots,
     logRollOver,
     getValidatorServiceEndpointURL,
     getCSECmode,
@@ -484,5 +573,12 @@ module.exports = {
     setWSHealthStatus,
     addLogEventtoBuffer,
     getLogEvents,
-    getFramework
+    getFramework,
+    listSkipDetectionCategory,
+    executeCronSchedule,
+    honourDurationConfiguration,
+    scanStartTime,
+    trafficStartedTime,
+    sendErrorToErrorInbox,
+    getScheduledScanTime,
 };

package/lib/nr-security-agent/lib/core/connections/websocket/proxy-util.js

@@ -0,0 +1,61 @@
+/*
+ * Copyright 2024 New Relic Corporation. All rights reserved.
+ * SPDX-License-Identifier: New Relic Software License v1.0
+ */
+
+'use strict'
+
+const { HttpsProxyAgent } = require('https-proxy-agent')
+const logs = require('../../logging');
+let logger = logs.getLogger();
+const commonUtils = require('../../commonUtils');
+const fs = require('fs');
+
+let agentProxyWithKeepAlive = null
+
+exports.proxyAgent = function proxyAgent(config) {
+  if (null !== agentProxyWithKeepAlive) {
+    return agentProxyWithKeepAlive
+  }
+  const proxyUrl = proxyOptions(config)
+  let proxyOpts = {
+    secureEndpoint: config.ssl,
+    auth: proxyUrl.auth,
+    ca: config?.certificates?.length ? config.certificates : [],
+    keepAlive: true
+  }
+  let cert = '';
+  try {
+    const certPath = commonUtils.getPathOfCACert();
+    cert = fs.readFileSync(certPath, 'utf8');
+  } catch (error) {
+    logger.error("Error in reading certificate:", error);
+
+  }
+  proxyOpts.ca.push(cert);
+  logger.info(`Using proxy: ${proxyUrl}`)
+  agentProxyWithKeepAlive = new HttpsProxyAgent(proxyUrl, proxyOpts)
+  return agentProxyWithKeepAlive
+}
+
+/**
+ * Utility to create proxy URL
+ * @param config 
+ * @returns 
+ */
+function proxyOptions(config) {
+  let proxyUrl
+  if (config.proxy) {
+    proxyUrl = config.proxy
+  } else {
+    proxyUrl = 'https://'
+    let proxyAuth = config.proxy_user
+    if (config.proxy_pass !== '') {
+      proxyAuth += ':' + config.proxy_pass
+      proxyUrl += `${proxyAuth}@`
+    }
+
+    proxyUrl += `${config.proxy_host || 'localhost'}:${config.proxy_port || 80}`
+  }
+  return proxyUrl
+}

package/lib/nr-security-agent/lib/core/connections/websocket/response/IASTUtils.js

@@ -6,8 +6,13 @@ const { Agent } = require('../../../agent');
 let pendingRequestIds = new Set();
 let completedRequestsMap = new Map();
 const PolicyManager = require('../../../Policy');
+const API = require('../../../../../../nr-security-api');
 let batchSize;
-const batchthreshold = 160;
+const batchthreshold = 200;
+const logs = require('../../../logging');
+let logger = logs.getLogger();
+const commonUtils = require('../../../commonUtils');
+
 function getPendingRequestIds() {
     return [...pendingRequestIds];
 }
@@ -31,7 +36,7 @@ function completedRequestsMapInit(id) {
 
 function addCompletedRequests(id, eventId) {
     let data = completedRequestsMap.get(id);
-    if(!data){
+    if (!data) {
         return;
     }
     data.push(eventId);
@@ -42,20 +47,21 @@ function getCompletedRequestsMap() {
     return completedRequestsMap;
 }
 
-function clearCompletedRequestMap(){
+function clearCompletedRequestMap() {
     completedRequestsMap.clear();
 }
 
-function clearPendingRequestIdSet(){
+function clearPendingRequestIdSet() {
     pendingRequestIds.clear();
 }
 
-function IASTCleanup(){
+function IASTCleanup() {
     clearCompletedRequestMap();
     clearPendingRequestIdSet();
 }
 
 function generateIASTDataRequest() {
+
     const policyInstance = PolicyManager.getInstance();
     if (policyInstance.data && policyInstance.data.vulnerabilityScan && policyInstance.data.vulnerabilityScan.iastScan) {
         batchSize = batchSize ? batchSize : policyInstance.data.vulnerabilityScan.iastScan.probing.batchSize;
@@ -64,11 +70,33 @@ function generateIASTDataRequest() {
         }
     }
     if (getCompletedRequestsMap().size >= batchSize || batchSize < batchthreshold || getPendingRequestIds().length < batchSize) {
-        batchSize = (2 * batchSize);
+        batchSize = (2 * batchSize) - getPendingRequestIds().length;
+    }
+
+    const NRAgent = API.getNRAgent();
+    let scanRateLimit = 3600;
+    let scanRateLimitFromConfig = parseInt(NRAgent.config.security.scan_controllers.iast_scan_request_rate_limit);
+    scanRateLimit = scanRateLimitFromConfig
+    if (isNaN(scanRateLimitFromConfig)) {
+        scanRateLimit = 3600;
     }
+    if (scanRateLimit >= 0 || scanRateLimit < 0) {
+        batchSize = parseInt(scanRateLimit / 12);
+        if (scanRateLimit < 12) {
+            batchSize = 1;
+        } else if (scanRateLimit > 3600) {
+            batchSize = 300;
+        }
+    }
+
     let object = {};
     object['jsonName'] = 'iast-data-request';
     object['applicationUUID'] = Agent.getAgent().applicationInfo.applicationUUID;
+    object['appEntityGuid'] = Agent.getAgent().applicationInfo.appEntityGuid;
+    object['appAccountId'] = Agent.getAgent().applicationInfo.appAccountId;
+    if (batchSize && batchSize > 100) {
+        batchSize = 100;
+    }
     object["batchSize"] = batchSize ? batchSize : 300;
     object['pendingRequestIds'] = getPendingRequestIds();
     object['completedRequests'] = Object.fromEntries(getCompletedRequestsMap());

package/lib/nr-security-agent/lib/core/connections/websocket/response/fuzz-request-handler.js

@@ -21,10 +21,12 @@ const LogMessage = require('../../../LogMessage');
 require('dns').setDefaultResultOrder('ipv4first')
 const PolicyManager = require('../../../Policy');
 
-const statusUtils = require('../../../statusUtils');
 
 const find = `${SLASH}{{NR_CSEC_VALIDATOR_HOME_TMP}}`;
 const CSEC_HOME_TMP_CONST = new RegExp(find, 'g');
+const commonUtils = require('../../../commonUtils');
+
+const CSEC_HOME_TMP_CONST_ENCODED = new RegExp('%7B%7BNR_CSEC_VALIDATOR_HOME_TMP%7D%7D', 'g');
 
 let logger;
 let lastFuzzEventTime = 0;
@@ -32,13 +34,26 @@ let iastIntervalConst;
 let coolDownIntervalConst;
 let additionalCoolDownTime = 0;
 let fuzzedApiIDSet = new Set();
+const API = require('../../../../../../nr-security-api');
+const NRAgent = API.getNRAgent();
 
 
 /**
  * utility to start IAST Schedular
  */
 function startIASTSchedular() {
-    Agent.getAgent().client.dispatcher(IASTUtil.generateIASTDataRequest());
+    if (Agent.getAgent().delayed) {
+        let delayFromConfig = parseInt(NRAgent.config.security.scan_schedule.delay);
+        let delay = delayFromConfig;
+        if (isNaN(delay) || delay < 0) {
+            delay = 0;
+        }
+        // logger.debug("IAST data pull request is scheduled at %s", require('../../../commonUtils').getScheduledScanTime(delay))
+    }
+    if (!Agent.getAgent().delayed) {
+        Agent.getAgent().client.dispatcher(IASTUtil.generateIASTDataRequest());
+    }
+
     if (iastIntervalConst) {
         clearInterval(iastIntervalConst);
     }
@@ -51,8 +66,11 @@ function startIASTSchedular() {
     if (isNaN(probingInterval)) {
         probingInterval = 5;
     }
-    
+
     iastIntervalConst = setInterval(() => {
+        if (Agent.getAgent().status.getStatus() == 'disabled' || Agent.getAgent().delayed) {
+            return;
+        }
         let data = IASTUtil.generateIASTDataRequest();
         let currentTime = Date.now();
         let completedListSize = IASTUtil.getCompletedRequestsMap().size;
@@ -87,9 +105,19 @@ function logScannedApiId(fuzzHeader, requestURL) {
 
 // handler function to parse fuzz event and prepare fuzz request
 function handler(json) {
+    if (Agent.getAgent().status.getStatus() == 'disabled') {
+        return;
+    }
     setLastFuzzEventTime();
     let rawFuzzRequest = json.arguments[0];
-    rawFuzzRequest = rawFuzzRequest.replace(CSEC_HOME_TMP_CONST, CSEC_HOME_TMP);
+
+    try {
+        rawFuzzRequest = rawFuzzRequest.replace(CSEC_HOME_TMP_CONST, CSEC_HOME_TMP);
+        rawFuzzRequest = rawFuzzRequest.replace(CSEC_HOME_TMP_CONST_ENCODED, encodeURI(CSEC_HOME_TMP));
+    } catch (error) {
+        logger.debug("Error while replacing place holder", error);
+    }
+
     let fuzzRequest;
     try {
         fuzzRequest = JSON.parse(rawFuzzRequest);
@@ -97,7 +125,7 @@ function handler(json) {
         IASTUtil.addPendingRequestId(json.id);
     } catch (error) {
         logger.error('Parsing exeception in fuzz request: ', error);
-        
+
         const logMessage = new LogMessage.logMessage(SEVERE, 'Parsing exeception in fuzz request', __filename, error);
         require('../../../commonUtils').addLogEventtoBuffer(logMessage);
     }
@@ -158,7 +186,6 @@ function handleFuzzRequest(fuzzDetails) {
             handleFuzzResponse(response, fuzzDetails);
         }
     } catch (err) {
-        statusUtils.addErrortoBuffer(err);
         const fuzzFailEvent = new FuzzFailEvent(fuzzRequest.headers[NR_CSEC_FUZZ_REQUEST_ID]);
         logger.error(stringify(fuzzFailEvent));
         try {
@@ -179,6 +206,9 @@ function handleFuzzResponse(response, fuzzDetails) {
     const { rawFuzzRequest, fuzzRequest } = fuzzDetails;
     if (response) {
         IASTUtil.removePendingRequestId(fuzzRequest.id);
+        if (commonUtils.scanStartTime == 0) {
+            commonUtils.scanStartTime = Date.now();
+        }
         response.then(() => {
             logger.info('Fuzz success: ' + rawFuzzRequest);
         }).catch(() => {

package/lib/nr-security-agent/lib/core/connections/websocket/response/startup-handshake-handler.js

@@ -10,6 +10,10 @@ const initLogger = logs.getInitLogger();
 const LOG_MESSAGES = require('../../../sec-agent-constants').LOG_MESSAGES;
 const applicationInfoModule = require('../../../applicationinfo');
 const LogMessage = require('../../../LogMessage');
+const API = require('../../../../../../nr-security-api');
+const NRAgent = API.getNRAgent();
+const { Agent } = require('../../../agent');
+
 
 module.exports.handler = function handler(json) {
     try {
@@ -20,7 +24,7 @@ module.exports.handler = function handler(json) {
         initLogger.info('Security Agent is now ACTIVE for', applicationInfoModule.getInstance().applicationUUID);
         const logMessage = new LogMessage.logMessage("INFO", `Security Agent is ACTIVE for ${ applicationInfoModule.getInstance().applicationUUID}`, __filename, null);
         require('../../../commonUtils').addLogEventtoBuffer(logMessage);
-
+       
     } catch (error) {
         logger.error(LOG_MESSAGES.PARSING_EXP_WELCOME_MSG, error);
     }

package/lib/nr-security-agent/lib/core/connections/websocket/response/ws-reconnect.js

@@ -4,11 +4,14 @@
  */
 
 let logger;
+const { Agent } = require('../../../agent');
 module.exports.handler = function handler (json) {
-    logger.info('WS reconnect received', json);
-    const { Agent } = require('../../../agent');
-    const wsClient = Agent.getAgent().client;
-    wsClient.obeyReconnect();
+    if (Agent.getAgent().status.getStatus() != 'disabled'){
+        logger.info('WS reconnect received', json);
+        const wsClient = Agent.getAgent().client;
+        wsClient.obeyReconnect();
+    }
+    
 };
 
 module.exports.setLogger = l => { logger = l };

package/lib/nr-security-agent/lib/core/connections/websocket/websocket.js

@@ -17,11 +17,11 @@ const hc = require('../../health-check');
 const fs = require('fs');
 const { promisify } = require('../../sec-util');
 const ResponseHandler = require('./response');
-const { EMPTY_APPLICATION_UUID, LOG_MESSAGES, CSEC_SEP, NR_CSEC_FUZZ_REQUEST_ID, EXITEVENT, JSON_NAME, RASP, SEVERE } = require('../../sec-agent-constants');
-const statusUtils = require('../../statusUtils');
+const { EMPTY_APPLICATION_UUID, LOG_MESSAGES, CSEC_SEP, NR_CSEC_FUZZ_REQUEST_ID, EXITEVENT, JSON_NAME, SEVERE } = require('../../sec-agent-constants');
 const commonUtils = require('../../commonUtils');
 const IASTUtil = require('../websocket/response/IASTUtils');
 const LogMessage = require('../../LogMessage');
+const proxyUtil = require('./proxy-util');
 
 const BUSY = 'busy';
 const IDLE = 'idle';
@@ -105,18 +105,25 @@ SecWebSocket.prototype.init = function init() {
     const authHeaders = require('../../Auth-headers').getInstance();
     initLogger.info(`Connecting to Validator at ${validatorService}`);
     IASTUtil.IASTCleanup();
-    let cert = ''
+    let cert = '';
     try {
         const certPath = commonUtils.getPathOfCACert();
         cert = fs.readFileSync(certPath, 'utf8');
     } catch (error) {
         logger.error("Error in reading certificate:", error);
+        commonUtils.sendErrorToErrorInbox(error)
         const logMessage = new LogMessage.logMessage(SEVERE, 'Error in reading certificate for websocket', __filename, error);
         commonUtils.addLogEventtoBuffer(logMessage);
 
     }
-
-    webSocket = new WebSocket(validatorService, { headers: authHeaders, cert: cert, handshakeTimeout: 10000 });
+    const isProxy = !!(NRAgent.config.proxy || NRAgent.config.proxy_port || NRAgent.config.proxy_host)
+    if(isProxy){
+        const agentWithProxy = proxyUtil.proxyAgent(NRAgent.config);
+        webSocket = new WebSocket(validatorService, { headers: authHeaders, cert: cert, handshakeTimeout: 10000, agent:agentWithProxy });
+    }
+    else{
+        webSocket = new WebSocket(validatorService, { headers: authHeaders, cert: cert, handshakeTimeout: 10000 });
+    }
 
     webSocket.on(WS_ON_OPEN, this.openCB);
     webSocket.on(WS_ON_MSG, this.msgCB);
@@ -162,12 +169,16 @@ SecWebSocket.prototype.reconnect = function reconnect() {
         return;
     }
     commonUtils.setWSHealthStatus('Error');
+    commonUtils.sendErrorToErrorInbox(new Error("Unable to connect to Security Engine"))
     logger.debug(LOG_MESSAGES.DETECTED_BROKEN_CONN);
     this.obeyReconnect();
 
 };
 
 SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
+    if (Agent.getAgent().status.getStatus() == 'disabled') {
+        return;
+    }
     const { instance } = this;
     if (initTimeOut) {
         clearTimeout(initTimeOut);
@@ -186,13 +197,25 @@ SecWebSocket.prototype.obeyReconnect = function obeyReconnect() {
 
 }
 
+SecWebSocket.prototype.closeWS = function closeWS() {
+    const { instance } = this;
+    try {
+        instance.close();
+    } catch (error) {
+        logger.error("Error while closing websocket", error);
+    }
+}
+
 SecWebSocket.prototype.pingWS = async function pingWS() {
+    if (Agent.getAgent().status.getStatus() != 'active') {
+        return;
+    }
     const self = this;
     let currentTime = Date.now();
 
     let timeDiffInPing = (currentTime - lastPongtime) / 1000;
-    logger.debug("Websocket ready state is:",self.instance.readyState)
-    
+    logger.debug("Websocket ready state is:", self.instance.readyState)
+
     if (timeDiffInPing > 40 && lastPongtime != 0 && self.instance.readyState > 1) {
         self.obeyReconnect();
         lastPongtime = 0;
@@ -204,13 +227,11 @@ SecWebSocket.prototype.pingWS = async function pingWS() {
             if (err) {
                 logger.debug("Error while pinging:", err);
                 commonUtils.setWSHealthStatus('Error');
-                statusUtils.addErrortoBuffer(err);
     
             }
         });
     } catch (err) {
         logger.debug("error in ping:", err);
-        statusUtils.addErrortoBuffer(err);
         commonUtils.setWSHealthStatus('Error');
         return;
     }
@@ -266,7 +287,6 @@ SecWebSocket.prototype.dispatch = async function dispatch(event) {
         })
     } catch (error) {
         logger.debug(LOG_MESSAGES.ERROR_WHILE_SEND_EVENT, eventStr, error);
-        statusUtils.addErrortoBuffer(error);
         handleDispatchFailure(this, event, eventStr);
     }
 };
@@ -286,7 +306,6 @@ SecWebSocket.prototype.dispatchApplicationInfo = async function dispatchApplicat
     try {
         await promisify(this.instance, this.instance.send)(eventStr, { mask: true });
     } catch (error) {
-        statusUtils.addErrortoBuffer(error);
         logger.warn('Error while sending applicationInfo:', error);
         this.obeyReconnect();
     }
@@ -325,7 +344,6 @@ SecWebSocket.prototype.flushEventQueue = async function flushEventQueue() {
         const results = await Promise.all(sentEvents);
         hc.getInstance().registerEventsSent(results.length);
     } catch (err) {
-        statusUtils.addErrortoBuffer(err);
         logger.debug('Flush failed, reception of all events on IC couldn\'t be ensured.');
     }
 };
@@ -398,7 +416,7 @@ const defaultOnOpenCB = () => async function onOpen() {
         initLogger.info(LOG_MESSAGES.SENDING_APPINFO_COMPLETE, JSON.stringify(applicationInfo));
     } catch (err) {
         logger.error(`Connection broken: ${err.message}`);
-        statusUtils.addErrortoBuffer(err);
+        commonUtils.sendErrorToErrorInbox(err);
         commonUtils.setWSHealthStatus('Error')
         setWebSocketConn();
         self.setValidatorNotReadyForEvents();
@@ -431,10 +449,10 @@ const defaultOnMsgCB = () => function onMessage(data) {
  */
 const defaultOnErrCB = () => function onClose(error) {
     commonUtils.setWSHealthStatus('Error');
-    statusUtils.addErrortoBuffer(error);
     const self = this;
     logger.error("Error while connecting to validator:", error.message)
     const logMessage = new LogMessage.logMessage(SEVERE, 'Error while connecting to validator', __filename, error);
+    commonUtils.sendErrorToErrorInbox(error);
     commonUtils.addLogEventtoBuffer(logMessage);
     logger.warn("Security Agent INACTIVE!!!")
     if (error && error.code && (error.code === 'ECONNREFUSED' || error.code === 'EPIPE' || error.code === 'ECONNRESET')) {