fastly-waf-ece

command module
Version: v0.0.0-...-050fa5c Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Dec 2, 2019 License: Apache-2.0 Imports: 1 Imported by: 0

README

Current Release

Circle CI

Go Report Card

Go Doc

Description

Fastly WAF events come in two flavors. The first is a 'waf' event, which means something in an incoming request triggered an alarm. You'll generally see one of these for every rule that was violated.

Fastly also sends a 'req' event, which has information about the request. This will come out as soon as the request completes.

These two entry types will come in at different times, but must be correlated to truly make sense of what triggered the waf, and to really understand what should be done about it.

This Event Correlation Engine (ECE), is really just a syslog server that receives the log streams from Fastly, and holds them for a certain amount of time (the TTL) waiting for the rest of the entries for a given request to arrive. Once the TTL expires, whatever is in memory is passed on, and the memory is flushed.

The default TTL is 20 seconds.

Correlated logs are written to STDERR and can be redirected as desired.

NOTE: This service is under development

Installation

    go get github.com/scribd/fastly-waf-ece

Running

You can get help at any time by running:

fastly-waf-ece help

Run on a given address:

fastly-waf-ece -a 1.2.3.4:514

Run on a given address with a specific TTL:

fastly-waf-ece -a 1.3.4.5:514 -t 30

Run in debug mode (dumps every log entry seen to STDOUT)

fastly-waf-ece -a 1.2.3.4:514 -d

Documentation

Overview

Copyright © 2018 Scribd Inc. <ops@scribd.com>

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Source Files

Directories

Path Synopsis
pkg
ece

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL