search

corazawaf / coraza-proxy-wasm

proxy-wasm filter based on Coraza WAF
Apache License 2.0
104 stars 23 forks source link

New metric "Matched Rules" #271

Open matheusmattioli opened 5 months ago

matheusmattioli commented 5 months ago

Hello!

In the README we have some metrics with the prefix waf_filter, but it stores only the rules that interrupted a transaction and the total interruptions captured, it is very useful, however, when we are tailoring/troubleshooting our internal configuration of Coraza, it's important to know all the rules triggered and analyzed by the WAF in a specific transaction. Because, in case of false positives, we could understand better what causes the blocking through analysis of the rules triggered. And, with the export of a metric to Prometheus, we also could identify all the matched rules through panels in dashboards like Grafana instead of logs.

I already wrote code to implement this new metric and tested it, could i submit a Pull Request?

fzipi commented 5 months ago

Of course you can!

jcchavezs commented 3 months ago

Hi @matheusmattioli thanks for coming by and apologies for not coming back to you before. I wonder if we truly need such metrics for troubleshooting. Audit logs will provide you such data so I am not sure about we truly needing to export it as metrics. As for the FP concern we willing to monitor the metrics on matched rules that can make sense but segregating them by transaction ID sounds like we can get that from audit logs (WIP in https://github.com/corazawaf/coraza-proxy-wasm/pull/263). WDYT?