Skip to content

Commit

Permalink
feat(iast): light copy edits
Browse files Browse the repository at this point in the history
  • Loading branch information
akristen committed Jun 6, 2023
1 parent ef1db4c commit 03487aa
Showing 1 changed file with 18 additions and 6 deletions.
24 changes: 18 additions & 6 deletions src/content/docs/iast/use-iast.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -233,20 +233,24 @@ SELECT * FROM Vulnerability WHERE issueType = 'Application Vulnerability' AND ap
>
Currently, IAST shows findings only.

In order to see the IAST analysis in progress, if you've set the `loglevel` to `debug`, search for `Fuzz request received` in the `nr-security-home/logs/java-security-collector.log` file.
To see IAST analysis in progress:

1. Set the `loglevel` to `debug`
2. Search for `Fuzz request received` in the `nr-security-home/logs/java-security-collector.log` file.

</Collapser>

<Collapser
id="no-vuln"
title="I don't see vulnerabilities in IAST"
>
If you see your application in New Relic and the security agent successfully started IAST, but you don't see vulnerabilities in **[one.newrelic.com](https://one.newrelic.com)** > **All capabilities** > **IAST**, that could be due to:
If you see your application in New Relic and the security agent successfully started IAST, but you don't see vulnerabilities in **[one.newrelic.com](https://one.newrelic.com)** > **All capabilities** > **IAST**, then this could be caused by:

- Your application not being vulnerable.
- Your web socket connection being broken.
- Your application's framework or vulnerability category not being supported.

If you're not sure why this is happening, share your application's configuration and logs with our support team at [support.newrelic.com](https://support.newrelic.com).
If you're not sure why this is happening, share your application's configuration and logs with our [support team](https://support.newrelic.com).

</Collapser>

Expand All @@ -272,7 +276,7 @@ SELECT * FROM Vulnerability WHERE issueType = 'Application Vulnerability' AND ap
id="not-responding"
title="My application is not responding/crashed in the IAST testing"
>
It is possible to see such behavior because as a part of IAST analysis, as the security agent sends new request to the application and that increases the load resulting in increase in resource utilization. This IAST analysis can also expose uncaught error/exception in your application.
It's possible to see this behavior because as a part of IAST analysis, as the security agent sends new request to the application and that increases the load resulting in increase in resource utilization. This IAST analysis can also expose uncaught error/exception in your application.

If the application has crashed due to resources, please increase the resources and restart the application and perform IAST testing.

Expand All @@ -285,10 +289,16 @@ SELECT * FROM Vulnerability WHERE issueType = 'Application Vulnerability' AND ap
For Golang, make sure that you have imported the required instrumentation packages for the libraries and frameworks that your application is using.

For instance, let's suppose that your application is using the following library:

```
https://github.com/robertkrimen/otto
```

For this, you need to import the following instrumentation package:
github.com/newrelic/csec-go-agent/instrumentation/csec_robertkrimen_otto

```
https://github.com/newrelic/csec-go-agent/instrumentation/csec_robertkrimen_otto
```

</Collapser>

Expand All @@ -298,7 +308,9 @@ github.com/newrelic/csec-go-agent/instrumentation/csec_robertkrimen_otto
>
Currently it is expected to miss some vulnerabilities in the windows environment as it is not fully supported at the moment.

WARNING: IAST must only be used in the pre-prod environment
<Callout variant="tip">
IAST must only be used in the pre-production environment
</Callout>

</Collapser>
</CollapserGroup>

0 comments on commit 03487aa

Please sign in to comment.