You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
When using apiVersion: v1beta2 in standalone local policy mode, the configuration for syslogService under logTriggers is completely ignored when translated into the effective policy file (/etc/cp/conf/waap/waap.policy).
In the generated waap.policy, "logToSyslog" is strictly set to false and "urlForSyslog" falls back to the default ":514", preventing any web security event logs (such as SQL Injection block events) from being exported via Syslog.
Additionally, other log trigger fields like additionalSuspiciousEventsLogging.responseCode: true are also lost (reset to false in the effective policy).
Describe the bug
When using
apiVersion: v1beta2in standalone local policy mode, the configuration forsyslogServiceunderlogTriggersis completely ignored when translated into the effective policy file (/etc/cp/conf/waap/waap.policy).In the generated
waap.policy,"logToSyslog"is strictly set tofalseand"urlForSyslog"falls back to the default":514", preventing any web security event logs (such as SQL Injection block events) from being exported via Syslog.Additionally, other log trigger fields like
additionalSuspiciousEventsLogging.responseCode: trueare also lost (reset tofalsein the effective policy).Environment
1.1.35-open-source(Orchestration Engine)Steps to Reproduce
local_policy.yamlusingapiVersion: v1beta2with a definedsyslogServicetarget (e.g., port 5555).open-appsec-ctl --apply-policy./etc/cp/conf/waap/waap.policy.Configuration Snippet (
local_policy.yaml)