Runbook for investigating spike in blocked ingress requests - Githubissues

ministryofjustice / cloud-platform

Documentation on the MoJ cloud platform

MIT License

87 stars 44 forks source link

Runbook for investigating spike in blocked ingress requests #5733

Open poornima-krishnasamy opened 4 months ago

poornima-krishnasamy commented 4 months ago

Recently there was a notification in #ask-cloud-platform about a trigger of ModSecurityBlocking for one of users application. Slack thread: https://mojdt.slack.com/archives/C57UPMZLY/p1718379083813909

Write a runbook covering how to investigate further for these notifications.

Is it a isolated spike to that application
What are the things to check to make sure this is not compromising the security of the Platform
Any wider impact of the platform
Appropriate respond to the users based on the investigation
Any further issue/incident to be raised by CP

Few things that are covered earlier are

Is integration tests failing?
Check kibana for overall 406(modsec) and forbidden by rule(default whitelisting) and look for any spikes in those. How much % is that?
Is it happening now or has happened recently
What IP address it is coming from. Anything suspicious on how many hosts/ingress these requests affect?

Which part of the user docs does this impact

Communicate changes

[ ] post for #cloud-platform-update
[ ] Weeknotes item
[ ] Show the Thing/P&A All Hands/User CoP
[ ] Announcements channel

Questions / Assumptions

Definition of done

[ ] readme has been updated
[ ] user docs have been updated
[ ] another team member has reviewed
[ ] smoke tests are green
[ ] prepare demo for the team

Reference

How to write good user stories

mikebell commented 2 months ago

PR https://github.com/ministryofjustice/cloud-platform/pull/6100