feat(iast): new doc & imgs #13189

x8a · 2023-05-24T14:06:30Z

No description provided.

github-actions · 2023-05-24T14:06:43Z

Hi @x8a 👋

Thanks for your pull request! Your PR is in a queue, and a writer will take a look soon. We generally publish small edits within one business day, and larger edits within three days.

Gatsby Cloud will automatically generate a preview of your request, and will comment with a link when the preview is ready (usually 20 to 30 minutes).

gatsby-cloud · 2023-05-24T14:53:16Z

✅ docs-website-develop deploy preview ready

Deploy preview
Build logs · 5m build time

nbaenam

I probably would add an introductory text, other than that it's perfect ;-)

nbaenam · 2023-05-26T13:14:20Z

src/content/docs/iast/troubleshoot-iast.mdx

+  - Troubleshooting
+metaDescription: Use Vulnerability Management to find exploitable vulnerabilities in your application.
+---
+


I'd add here an introduction about the page

Yes! I'm waiting on the PM to send me some content for the intro 🙌🏻.

paperclypse · 2023-05-26T22:06:10Z

src/nav/root.yml

@@ -55,6 +55,8 @@ pages:
    path: integrations
  - title: Vulnerability Management
    path: vuln-management
+  - title: Interactive applications security testing (IAST)


Please move this top level IAST category so it's alphabetical in the nav, between Errors inbox and Open-source integrations.

Also, can we get away with just having it be IAST in the left nav?

paperclypse · 2023-05-26T22:10:27Z

src/content/docs/iast/troubleshoot-iast.mdx

@@ -0,0 +1,51 @@
+---
+title: Troubleshooting for interactive applications security testing (IAST)


This doc feels weird as a standalone thing. It doesn't quite much our troubleshooting doc guidelines: https://docs.newrelic.com/docs/style-guide/writing-docs/article-templates/troubleshooting-docs-guide/

I think I'd prefer to either stick this at the end of the Use IAST doc (with each problem statement in a series of collapsers for easy scanning) or have each of these split out into its own troubleshooting doc in a specific Troubleshooting category.

I'll add it to the main doc, then!

paperclypse · 2023-05-26T22:11:57Z

src/content/docs/iast/troubleshoot-iast.mdx

+
+Confirm that the application has started and then review the application's logs for further information.
+
+## How do I make sure that the security agent is working?


Can we restate this as a problem statement instead of a question? (We want to avoid FAQ-style docs on out site and this one is creeping up on that.)

Also, this is pretty generic for a troubleshooting problem statement. Is it not self-evident when the security agent is "working"?

paperclypse · 2023-05-26T22:13:02Z

src/content/docs/iast/troubleshoot-iast.mdx

+7. The application receives and applies your policies and configuration.
+8. You see a first event sent for validation, which means the security agent started successfully.
+
+## How do I know IAST is working?


See comment on the previous section. I'd prefer these were written as problem statements, rather than questions.

paperclypse · 2023-05-26T22:13:49Z

src/content/docs/iast/troubleshoot-iast.mdx

+
+If you're not sure why this is happening, share your application's configuration and logs with our support team at [support.newrelic.com](https://support.newrelic.com).
+
+## I'm facing application stability issues during IAST testing


Can we provide some guidance on what to look for in that log file and what to do with those errors?

I'll ask the devs!

paperclypse · 2023-05-26T22:14:17Z

src/content/docs/iast/troubleshoot-iast.mdx

+metaDescription: Use Vulnerability Management to find exploitable vulnerabilities in your application.
+---
+
+## I don't see my application in New Relic


Can you get more specific with this problem statement?

paperclypse · 2023-05-26T22:14:49Z

src/content/docs/iast/troubleshoot-iast.mdx

+
+## I don't see my application in New Relic
+
+Confirm that the application has started and then review the application's logs for further information.


How do I confirm that? Where do I find the application's logs?

This is your own application logs. That will depend on how your application stores logs. I'll make it more obvious that that's what you need to check.

paperclypse · 2023-05-26T22:15:39Z

src/content/docs/iast/troubleshoot-iast.mdx

+This application instance is now being scanned by New Relic Security under id {{UUID}}
+```
+
+In the `nr-security-home/logs` directory, search for the file called `java-security-collector-init.log`, replace `java` in the path depending on language you used, and make sure these steps work for you:


Is it worth listing all of the languages it could be here? Seems like we could easily provide a list of all of the log file names?

Adding all the languages could make it more difficult to maintain and I don't see it adding a lot of value. I can make it more generic so it works for all languages that may come in the future.

paperclypse · 2023-05-26T22:16:58Z

src/content/docs/iast/troubleshoot-iast.mdx

+
+In the `nr-security-home/logs` directory, search for the file called `java-security-collector-init.log`, replace `java` in the path depending on language you used, and make sure these steps work for you:
+
+1. The security agent is starting.


How do I know?

You'll see the above message in your app's logs. I'll move that here, since it makes more sense.

paperclypse · 2023-05-26T22:17:09Z

src/content/docs/iast/troubleshoot-iast.mdx

+In the `nr-security-home/logs` directory, search for the file called `java-security-collector-init.log`, replace `java` in the path depending on language you used, and make sure these steps work for you:
+
+1. The security agent is starting.
+2. It generates a unique identifier. For web socket connection, you'll see Node auth headers.


Where do I find this unique ID?

Where will I see the Node auth headers? Is this all self-evident?

I'll ask the dev about this ID.

paperclypse · 2023-05-26T22:18:18Z

src/content/docs/iast/troubleshoot-iast.mdx

+5. The security agent threads are started.
+6. The application instrumentation is successful.
+7. The application receives and applies your policies and configuration.
+8. You see a first event sent for validation, which means the security agent started successfully.


For all of these steps, I think we need a little more clarity about where I can verify all of these things. I get the feeling that some things are in an application console and some things are in the New Relic UI, but it's tough for me to split them out without knowing more.

This is all part of the log file we mention. I asked the dev to give me a sample file so we can have it here and users can see it in context.

paperclypse · 2023-05-26T22:18:56Z

src/content/docs/iast/troubleshoot-iast.mdx

+
+## How do I know IAST is working?
+
+Currently, IAST shows findings only. Before this feature is publicly available, the New Relic UI will be updated to show progress as well. 


I think we can lose that second sentence. I think it's better not to document things that don't exist yet.

paperclypse · 2023-05-26T22:19:31Z

src/content/docs/iast/troubleshoot-iast.mdx

+
+Currently, IAST shows findings only. Before this feature is publicly available, the New Relic UI will be updated to show progress as well. 
+
+If you have set the `loglevel` to `debug`, you can search for `Fuzz request received` in the `nr-security-home/logs/java-security-collector.log` file. That shows that IAST analysis is in progress.


I'd flip this: In order to see the IAST analysis in progress, if you've set the loglevel to debug, search for...etc

paperclypse · 2023-05-26T22:20:26Z

src/content/docs/iast/troubleshoot-iast.mdx

+
+If you have set the `loglevel` to `debug`, you can search for `Fuzz request received` in the `nr-security-home/logs/java-security-collector.log` file. That shows that IAST analysis is in progress.
+
+## I don't see vulnerabilities in New Relic


Do we first want to make sure they're looking for these in the right place?

paperclypse · 2023-05-26T22:20:56Z

src/content/docs/iast/use-iast.mdx

+
+import iastEnableIast from 'images/iast_screenshot-crop_enable-iast.webp' 
+
+<Callout title="PREVIEW"> 


Is this still in preview?

Do we want to provide some info on what someone can do to sign up to try it out?

Yes, it'll be a public preview. Users don't need to do anything, it'll be in the UI when they release it.

paperclypse · 2023-05-26T22:22:17Z

src/content/docs/iast/use-iast.mdx

+    This feature is currently in preview.
+</Callout>
+
+When your application has exploitable vulnerabilities, it means that someone could take advantage of a misconfiguration to access sensitive information. To help prevent that from happening, install our interactive applications security testing (IAST) to assist in finding exploitable vulnerabilities. 


To help prevent that from happening, install our interactive applications security testing (IAST) to assist in finding exploitable vulnerabilities. -->

To help prevent that, install our interactive applications security testing (IAST).

paperclypse · 2023-05-26T22:24:08Z

src/content/docs/iast/use-iast.mdx

+<Callout variant="important">
+  Run IAST with non-production deployments only.
+
+  IAST tests your applications for any exploitable vulnerability by replaying the generated HTTP request with vulnerable payloads. Run IAST only on non-production deployments to avoid exposing vulnerabilities on your production software.


I think you can tighten up the text in this paragraph. (For example, the second sentence here feels like a loose restatement of the first sentence in the callout)

I wanted to emphasize the fact that users need to avoid using IAST in prod deployments, but I shifted the content a bit.

paperclypse

Looks good!

feat(iast): new doc & imgs

cf66168

x8a added content requests related to docs site content from_tw Identifies issues/PRs from Tech Docs writers labels May 24, 2023

github-actions bot added this to Hero to triage in Docs PRs and Issues May 24, 2023

x8a moved this from Hero to triage to In progress in Docs PRs and Issues May 24, 2023

x8a self-assigned this May 24, 2023

x8a added 4 commits May 24, 2023 17:21

feat(iast): followup edits

382b017

style(iast): small style edits

26df67c

style(iast): removed redundant text

976b0e9

feat(iast): moved to its own category

0c96b6b

x8a requested review from paperclypse and nbaenam May 26, 2023 11:26

nbaenam previously approved these changes May 26, 2023

View reviewed changes

paperclypse reviewed May 26, 2023

View reviewed changes

feat(iast): peer review comments

3bb40fd

x8a dismissed nbaenam’s stale review via 3bb40fd May 29, 2023 10:21

x8a and others added 5 commits May 29, 2023 14:50

feat(iast): added feature value

41323b9

feat(iast): moved content after img

c18cdcd

feat(iast): added draft content per hero request

01753b8

removed periods from problem statements

ef1db4c

feat(iast): light copy edits

03487aa

paperclypse approved these changes Jun 6, 2023

View reviewed changes

akristen merged commit 918f64c into develop Jun 6, 2023
8 checks passed

akristen deleted the 109972-IAST-public_preview branch June 6, 2023 17:18

bradleycamacho mentioned this pull request Jun 6, 2023

Revert "feat(iast): new doc & imgs" #13401

Merged

bradleycamacho restored the 109972-IAST-public_preview branch June 6, 2023 23:37

x8a mentioned this pull request Jun 16, 2023

feat(iast): release PR for IAST content #13402

Merged

		@@ -0,0 +1,51 @@
		---
		title: Troubleshooting for interactive applications security testing (IAST)


		Confirm that the application has started and then review the application's logs for further information.

		## How do I make sure that the security agent is working?


		If you're not sure why this is happening, share your application's configuration and logs with our support team at [support.newrelic.com](https://support.newrelic.com).

		## I'm facing application stability issues during IAST testing


		## I don't see my application in New Relic

		Confirm that the application has started and then review the application's logs for further information.


		In the `nr-security-home/logs` directory, search for the file called `java-security-collector-init.log`, replace `java` in the path depending on language you used, and make sure these steps work for you:

		1. The security agent is starting.


		## How do I know IAST is working?

		Currently, IAST shows findings only. Before this feature is publicly available, the New Relic UI will be updated to show progress as well.


		Currently, IAST shows findings only. Before this feature is publicly available, the New Relic UI will be updated to show progress as well.

		If you have set the `loglevel` to `debug`, you can search for `Fuzz request received` in the `nr-security-home/logs/java-security-collector.log` file. That shows that IAST analysis is in progress.


		If you have set the `loglevel` to `debug`, you can search for `Fuzz request received` in the `nr-security-home/logs/java-security-collector.log` file. That shows that IAST analysis is in progress.

		## I don't see vulnerabilities in New Relic


		import iastEnableIast from 'images/iast_screenshot-crop_enable-iast.webp'

		<Callout title="PREVIEW">

feat(iast): new doc & imgs #13189

feat(iast): new doc & imgs #13189

Conversation

x8a commented May 24, 2023

github-actions bot commented May 24, 2023

gatsby-cloud bot commented May 24, 2023 • edited

✅ docs-website-develop deploy preview ready

nbaenam left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

paperclypse May 26, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

x8a May 29, 2023 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

paperclypse left a comment

Choose a reason for hiding this comment

gatsby-cloud bot commented May 24, 2023 •

edited

paperclypse May 26, 2023 •

edited

x8a May 29, 2023 •

edited