Skip to content

Commit ae09b20

Browse files
TarradeMarcTarradeMarc
committed
✨add default/recommanded duration for decoy respond
1 parent ecd3348 commit ae09b20

File tree

6 files changed

+121
-15
lines changed

6 files changed

+121
-15
lines changed

‎controlpanel/cad/src/app/components/alert-action-table/alert-action-table.component.html‎

Lines changed: 47 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,51 @@
1+
<app-tooltip [showTooltip]="showTooltip"
2+
[title]="tooltipTitle"
3+
[text]="tooltipText"
4+
[link]="tooltipLink"
5+
[topPosition]="topPosition"
6+
[leftPosition]="leftPosition"
7+
(tooltipHover)="onHoverInfo()"
8+
(tooltipLeave)="onLeaveInfo()">
9+
</app-tooltip>
110
<table class="action-table">
211
<thead>
312
<tr>
4-
<th id="source">Source</th>
5-
<th id="behavior">Behavior</th>
6-
<th id="delay">Delay</th>
7-
<th id="duration">Duration</th>
8-
<th id="property">Property</th>
13+
<th id="source">
14+
Source
15+
<img class="info-icon" src="info.svg"
16+
(mouseenter)="onHoverInfo('source', 'Defines what to look for in subsequent request(s)', 'https://github.com/SAP/cloud-active-defense/wiki/Detect#source', $event)"
17+
(mouseout)="onLeaveInfo()"
18+
/>
19+
</th>
20+
21+
<th id="behavior">
22+
Behavior
23+
<img class="info-icon" src="info.svg"
24+
(mouseenter)="onHoverInfo('behavior', 'What will happen to requests matching with what is specified in the source field', 'https://github.com/SAP/cloud-active-defense/wiki/Detect#behavior', $event)"
25+
(mouseout)="onLeaveInfo()"
26+
/>
27+
</th>
28+
<th id="delay">
29+
Delay
30+
<img class="info-icon" src="info.svg"
31+
(mouseenter)="onHoverInfo('delay', 'The number of seconds / minutes / hours to wait before applying the response. \'n\' is for \'now\' (no delay)', 'https://github.com/SAP/cloud-active-defense/wiki/Detect#delay', $event)"
32+
(mouseout)="onLeaveInfo()"
33+
/>
34+
</th>
35+
<th id="duration">
36+
Duration
37+
<img class="info-icon" src="info.svg"
38+
(mouseenter)="onHoverInfo('duration', 'The number of seconds / minutes / hours the response will be applied before expiring. \'d\' is for the default/recommanded maximum value of time and \'f\' is for \'forever\' (infinite duration)', 'https://github.com/SAP/cloud-active-defense/wiki/Detect#duration', $event)"
39+
(mouseout)="onLeaveInfo()"
40+
/>
41+
</th>
42+
<th id="property">
43+
Property
44+
<img class="info-icon" src="info.svg"
45+
(mouseenter)="onHoverInfo('property', 'How many seconds to throttle the request. Can only be in seconds and can be a range of seconds when using \'-\' (e.g. 20-60)', 'https://github.com/SAP/cloud-active-defense/wiki/Detect#property', $event)"
46+
(mouseout)="onLeaveInfo()"
47+
/>
48+
</th>
949
<th class="end-action"></th>
1050
</tr>
1151
<tr class="tr-separator"><td class="row-separator" colspan="6"><hr class="head-separator"/></td></tr>
@@ -34,11 +74,12 @@
3474
</td>
3575
<td>
3676
<div class="table-form-inputception">
37-
<input class="input-action-table inner-input" type="text" name="duration" id="duration" [(ngModel)]="action.duration" (input)="onItemChange()" [disabled]="action.durationExtension == 'forever' || !isEdit" appOnlyNumbers>
77+
<input class="input-action-table inner-input" type="text" name="duration" id="duration" [(ngModel)]="action.formDuration" (input)="onItemChange()" [disabled]="action.durationExtension == 'forever' || !isEdit" appOnlyNumbers>
3878
<select class="inner-select" name="durationExtension" id="durationExtension" [(ngModel)]="action.durationExtension" (change)="onDurationExtensionChange(action.durationExtension, i); onItemChange()" [disabled]="!isEdit">
3979
<option value="s">s</option>
4080
<option value="m">m</option>
4181
<option value="h">h</option>
82+
<option value="default">d</option>
4283
<option value="forever">f</option>
4384
</select>
4485
</div>

‎controlpanel/cad/src/app/components/alert-action-table/alert-action-table.component.scss‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@
1515
th {
1616
text-align: start;
1717
padding: 0.2rem 0.5rem;
18+
.info-icon {
19+
height: 14px;
20+
align-self: flex-start;
21+
margin-top: -5px;
22+
cursor: default;
23+
}
1824
}
1925
.end-action {
2026
box-sizing: content-box;

‎controlpanel/cad/src/app/components/alert-action-table/alert-action-table.component.ts‎

Lines changed: 56 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,15 +5,17 @@ import { DelayType, DurationType, RespondType } from '../../models/decoy';
55
import { FormsModule } from '@angular/forms';
66
import { OnlyNumbersDirective } from '../../directives/only-numbers.directive';
77
import { OnlyValidRespondPropertyDirective } from '../../directives/only-valid-respond-property.directive';
8+
import { TooltipComponent } from '../tooltip/tooltip.component';
89

910
export interface FormRespond extends RespondType {
1011
delayExtension: 's' | 'm' | 'h' | 'now',
11-
durationExtension: 's' | 'm' | 'h' | 'forever'
12+
durationExtension: 's' | 'm' | 'h' | 'forever' | 'default',
13+
formDuration?: DurationType | number | undefined
1214
}
1315

1416
@Component({
1517
selector: 'app-alert-action-table',
16-
imports: [CommonModule, SourceSelectComponent, FormsModule, OnlyNumbersDirective, OnlyValidRespondPropertyDirective],
18+
imports: [CommonModule, SourceSelectComponent, FormsModule, OnlyNumbersDirective, OnlyValidRespondPropertyDirective, TooltipComponent],
1719
templateUrl: './alert-action-table.component.html',
1820
styleUrl: './alert-action-table.component.scss'
1921
})
@@ -22,6 +24,37 @@ export class AlertActionTableComponent {
2224
@Output() actionArrayChange = new EventEmitter<FormRespond[]>();
2325
@Input() isEdit = true;
2426

27+
//#region Tooltip
28+
tooltipTitle = '';
29+
showTooltip = false;
30+
tooltipText = '';
31+
tooltipLink = '';
32+
topPosition: any;
33+
leftPosition: any;
34+
tooltipTimeout:any;
35+
36+
onHoverInfo(tooltipTitle?: string, tooltipText?: string, tooltipLink?: string, e?: MouseEvent) {
37+
clearTimeout(this.tooltipTimeout);
38+
this.showTooltip = true;
39+
if (tooltipTitle) this.tooltipTitle = tooltipTitle;
40+
if (tooltipText) this.tooltipText = tooltipText;
41+
if (tooltipLink) this.tooltipLink = tooltipLink;
42+
if (e) {
43+
this.topPosition = e.clientY ?? this.topPosition;
44+
this.leftPosition = e.clientX ?? this.leftPosition;
45+
}
46+
}
47+
onLeaveInfo() {
48+
this.tooltipTimeout = setTimeout(() => {
49+
this.showTooltip = false;
50+
this.tooltipText = '';
51+
this.topPosition = null;
52+
this.leftPosition = null;
53+
}, 100)
54+
}
55+
//#endregion
56+
57+
2558
onClickAddAction() {
2659
this.actionArray.push({ source: '', behavior: 'error', delayExtension: 's', durationExtension: 's' });
2760
this.actionArrayChange.emit(this.actionArray);
@@ -46,9 +79,27 @@ export class AlertActionTableComponent {
4679
if (newExtension == 'now') this.actionArray[index].delay = 'now';
4780
else if (this.actionArray[index].delay == 'now') this.actionArray[index].delay = undefined;
4881
}
49-
onDurationExtensionChange(newExtension: 's' | 'm' | 'h' | 'forever', index: number) {
50-
if (newExtension == 'forever') this.actionArray[index].duration = 'forever';
51-
else if (this.actionArray[index].duration == 'forever') this.actionArray[index].duration = undefined;
82+
onDurationExtensionChange(newExtension: 's' | 'm' | 'h' | 'default' | 'forever', index: number) {
83+
if (newExtension == 'default') {
84+
if (this.actionArray[index].source.includes('userAgent')) {
85+
this.actionArray[index].durationExtension = 'h';
86+
this.actionArray[index].formDuration = 720;
87+
}
88+
else if (this.actionArray[index].source.includes('ip')) {
89+
this.actionArray[index].durationExtension = 'h';
90+
this.actionArray[index].formDuration = 48;
91+
}
92+
else if (this.actionArray[index].source.includes('session')) {
93+
this.actionArray[index].durationExtension = 'h';
94+
this.actionArray[index].formDuration = 24;
95+
}
96+
else {
97+
this.actionArray[index].durationExtension = 'h';
98+
this.actionArray[index].formDuration = 720;
99+
}
100+
}
101+
if (newExtension == 'forever') this.actionArray[index].formDuration = 'forever';
102+
else if (this.actionArray[index].formDuration == 'forever') this.actionArray[index].formDuration = undefined;
52103
}
53104

54105
sourceToArray(source: string) {

‎controlpanel/cad/src/app/pages/add-decoy/alert-action/alert-action.component.ts‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -135,20 +135,20 @@ export class AlertActionComponent implements OnInit, ValidateDecoyFormDeactivate
135135
if (!newActions) return;
136136
if (!this.decoy.detect) this.decoy.detect = { seek : { in: 'header' }};
137137
if (!this.decoy.detect.alert) this.decoy.detect.alert = { severity: this.alertForm.get('severity')?.value };
138-
this.decoy.detect.respond = newActions.map(({ delayExtension, delay, durationExtension, duration, ...rest }) => {
138+
this.decoy.detect.respond = newActions.map(({ delayExtension, delay, durationExtension, formDuration, ...rest }) => {
139139
let newDelay = '';
140140
let newDuration = '';
141141
let newRespond: RespondType = rest;
142142
if (delayExtension !== 'now' && delayExtension !== undefined && delay !== undefined) {
143143
newDelay = delay + delayExtension;
144144
} else newDelay = 'now'
145-
if (durationExtension !== 'forever' && durationExtension !== undefined && duration !== undefined) {
146-
newDuration = duration + durationExtension;
145+
if (durationExtension !== 'forever' && durationExtension !== undefined && formDuration !== undefined) {
146+
newDuration = formDuration + durationExtension;
147147
} else newDuration = 'forever'
148148
if (delay !== undefined) {
149149
newRespond.delay = newDelay as DelayType;
150150
}
151-
if (duration !== undefined) {
151+
if (formDuration !== undefined) {
152152
newRespond.duration = newDuration as DurationType;
153153
}
154154
return newRespond;

‎proxy/wasm/alert/alert.go‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -156,6 +156,14 @@ func SetAlertAction(alerts []AlertParam, config config_parser.ConfigType, header
156156
}
157157
if respondItem.Duration != "" {
158158
updateBlocklistItem["Duration"] = respondItem.Duration
159+
} else {
160+
if (strings.Contains(respondItem.Source, "userAgent")) {
161+
updateBlocklistItem["Duration"] = "720h"
162+
} else if (strings.Contains(respondItem.Source, "ip")) {
163+
updateBlocklistItem["Duration"] = "48h"
164+
} else if (strings.Contains(respondItem.Source, "session")) {
165+
updateBlocklistItem["Duration"] = "24h"
166+
}
159167
}
160168
updateBlocklistItem["Time"] = strconv.Itoa(int(time.Now().Unix()))
161169
if updateBlocklistItem["Behavior"] == "throttle" {

‎proxy/wasm/cloud-active-defense.wasm‎

419 Bytes
Binary file not shown.

0 commit comments

Comments
 (0)