Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Appearance settings

[Bug] v1beta2 local policy ignores syslogService configuration in effective waap.policy (Regression from v1beta1) #445

Copy link
Copy link

Description

@a009984
Issue body actions

Describe the bug

When using apiVersion: v1beta2 in standalone local policy mode, the configuration for syslogService under logTriggers is completely ignored when translated into the effective policy file (/etc/cp/conf/waap/waap.policy).

In the generated waap.policy, "logToSyslog" is strictly set to false and "urlForSyslog" falls back to the default ":514", preventing any web security event logs (such as SQL Injection block events) from being exported via Syslog.

Additionally, other log trigger fields like additionalSuspiciousEventsLogging.responseCode: true are also lost (reset to false in the effective policy).

Environment

  • open-appsec Agent Version: 1.1.35-open-source (Orchestration Engine)
  • Deployment Mode: Docker Compose

Steps to Reproduce

  1. Configure local_policy.yaml using apiVersion: v1beta2 with a defined syslogService target (e.g., port 5555).
  2. Attach the trigger to a specific host rule.
  3. Run open-appsec-ctl --apply-policy.
  4. Check the generated effective policy in the container at /etc/cp/conf/waap/waap.policy.

Configuration Snippet (local_policy.yaml)

apiVersion: v1beta2
policies:
  specificRules:
    - host: "sdl.hwhs.tc.edu.tw"
      mode: prevent-learn
      threatPreventionPractices: [webapp-default-practice]
      triggers: [appsec-default-log-trigger]

logTriggers:
  - name: appsec-default-log-trigger
    appsecLogging:
      detectEvents: true
      preventEvents: true
      allWebRequests: false
    additionalSuspiciousEventsLogging:
      enabled: true
      responseCode: true
    logDestination:
      cloud: false
      logToAgent: true
      syslogService:
        - address: "192.168.100.220"
          port: 5555

### Actual Behavior (Inside waap.policy under v1beta2)

"triggers":[{
  "$triggerType":"log",
  "name":"local_policy/appsec-default-log-trigger",
  "log":{
    "logToAgent":true,
    "logToSyslog":false,      <-- Bug: Should be true
    "responseCode":false,     <-- Bug: Should be true
    "urlForSyslog":":514"     <-- Bug: Forgot to map "192.168.100.220" and port 5555
  }
}]

### Expected Behavior

"logToSyslog": true,
"urlForSyslog": "192.168.100.220:5555",
"responseCode": true
Reactions are currently unavailable

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions

    Morty Proxy This is a proxified and sanitized view of the page, visit original site.