Skip to content

Incomplete security log format in log_sm.json (missing critical fields) #296

Closed
@travisamartin

Description

@travisamartin

Describe the bug

The format_string value in log_sm.json is missing critical security event fields, which results in incomplete logging for security monitoring in NGINX App Protect WAF.

A user commented via the doc feedback survey:

https://docs.nginx.com/nginx-instance-manager/nginx-app-protect/security-monitoring/set-up-app-protect-instances/

The format of the string is wrong.
"format_string": "%blocking_exception_reason%,%dest_port%,%ip_client%,%severity%,%uri%",
You can find the correct one, here
https://docs.nginx.com/nginx-instance-manager/monitoring/security-monitoring/configure/set-up-app-protect-instances/

Actual format_string

Image

Expected format_string

"format_string": 
    "%blocking_exception_reason%,%dest_port%,%ip_client%,%is_truncated_bool%,"
    "%method%,%policy_name%,%protocol%,%request_status%,%response_code%,"
    "%severity%,%sig_cves%,%sig_set_names%,%src_port%,%sub_violations%,"
    "%support_id%,%threat_campaign_names%,%violation_rating%,%vs_name%,"
    "%x_forwarded_for_header_value%,%outcome%,%outcome_reason%,%violations%,"
    "%violation_details%,%bot_signature_name%,%bot_category%,%bot_anomalies%,"
    "%enforced_bot_anomalies%,%client_class%,%client_application%,"
    "%client_application_version%,%transport_protocol%,%uri%,%request%"

Metadata

Metadata

Assignees

Labels

product/nimNGINX Instance Manager

Type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions