Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Iast new 324109 final changes #19783

Open
wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Iast new 324109 final changes #19783

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e4a6d78
Update install.mdx
newrelic707195 Jan 17, 2025
ac2b0e8
IAST January
newrelic707195 Jan 23, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
217 changes: 195 additions & 22 deletions src/content/docs/iast/install.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,44 +9,131 @@
---

<Callout variant="important">
Run IAST with non-production deployments only. IAST tests by invoking HTTP requests with an exploit payload. You must use IAST in non-production environments with only simulated data to avoid both data corruption and introducing exploits into your live code. In addition, when you run IAST on new code in pre-production, you catch potential vulnerabilities before they go live.
Run IAST with non-production deployments only. IAST tests the application by
invoking HTTP requests with an exploit payload. You must use IAST in
non-production environments with only simulated data to avoid both data
corruption and introducing exploits into your live code. In addition, when you

Check notice on line 15 in src/content/docs/iast/install.mdx

View workflow job for this annotation

GitHub Actions / vale

[vale] src/content/docs/iast/install.mdx#L15 

[Microsoft.Wordiness] Consider using 'also' instead of 'In addition'.
Raw output 
{"message": "[Microsoft.Wordiness] Consider using 'also' instead of 'In addition'.", "location": {"path": "src/content/docs/iast/install.mdx", "range": {"start": {"line": 15, "column": 60}}}, "severity": "INFO"}
run IAST on new code in pre-production, you catch potential vulnerabilities
before they go live.
</Callout>

<Callout variant="important">
Before you start IAST installation, review the IAST testing steps and how exploitable vulnerabilities are detected.

Check notice on line 21 in src/content/docs/iast/install.mdx

View workflow job for this annotation

GitHub Actions / vale

[vale] src/content/docs/iast/install.mdx#L21 

[Microsoft.Passive] 'are detected' looks like passive voice.
Raw output 
{"message": "[Microsoft.Passive] 'are detected' looks like passive voice.", "location": {"path": "src/content/docs/iast/install.mdx", "range": {"start": {"line": 21, "column": 105}}}, "severity": "INFO"}
For more information, refer: [IAST exploitable vulnerabilities](https://docs.newrelic.com/docs/iast/exploitable-vulns/)
</Callout>

<Callout variant="tip">
- It is advisable to watch the [relevant application language video](/docs/iast/install/#check-out-these-demo-videos-for-setting-up-iast-with-different-application-languages) for successful installation of IAST.

Check notice on line 26 in src/content/docs/iast/install.mdx

View workflow job for this annotation

GitHub Actions / vale

[vale] src/content/docs/iast/install.mdx#L26 

[Microsoft.SentenceLength] Try to keep sentences short (< 30 words).
Raw output 
{"message": "[Microsoft.SentenceLength] Try to keep sentences short (\u003c 30 words).", "location": {"path": "src/content/docs/iast/install.mdx", "range": {"start": {"line": 26, "column": 5}}}, "severity": "INFO"}

Check failure on line 26 in src/content/docs/iast/install.mdx

View workflow job for this annotation

GitHub Actions / vale

[vale] src/content/docs/iast/install.mdx#L26 

[Microsoft.Contractions] Use 'it's' instead of 'It is'.
Raw output 
{"message": "[Microsoft.Contractions] Use 'it's' instead of 'It is'.", "location": {"path": "src/content/docs/iast/install.mdx", "range": {"start": {"line": 26, "column": 5}}}, "severity": "ERROR"}
</Callout>

To install New Relic IAST:

<Steps>
<Step>
Go to <DNT>**[one.newrelic.com](https://one.newrelic.com) > All capabilities > IAST**</DNT> and click <DNT>**Set up IAST with applications**</DNT>.
1. Go to <DNT>**[one.newrelic.com](https://one.newrelic.com) > All capabilities > IAST** </DNT> and click <DNT>**Install**</DNT>.
1. Click <DNT>**Start trial**</DNT> to start a free 30-day trial of IAST.

<img
title="Set up IAST with applications"
alt="Set up IAST with applications"
title="Start a free, 30-day IAST trial"
alt="Start a free, 30-day IAST trial"
src="/images/iast_screenshot-full_install.webp"
/>
</Step>

<Step>
Confirm IAST isn't running in a production environment and click <DNT>**Continue**</DNT>.
1. To start trial of IAST, click <DNT>**Set up IAST with applications**</DNT>.

</Step>

<Step>
Select the language of your application and complete the steps.

<img
title="Install New Relic IAST"
alt="Install New Relic IAST"
src="/images/iast_screenshot-crop_install.webp"
/>
## Safety check

Make sure IAST is not running in the production environment and click <DNT>**Continue**</DNT>.

</Step>

<Step>

## Select your application language

APM agent should already be installed with your application, for more information you can check our [APM documentation](https://docs.newrelic.com/docs/apm/new-relic-apm/getting-started/introduction-apm/). Select your application's language and follow the steps. The supported application languages are: <DNT>Java</DNT>, <DNT>Node.js</DNT>, and <DNT>Go</DNT>.

Once you select the application language, make sure to follow the on-screen instructions.

</Step>

<Step>

## Update the APM agent

<CollapserGroup>
<Collapser
id="update-apm-agent-for-java"
title="Update the APM agent for Java application language"
>

Update the APM agent to the latest version. The minimum version supported is: v8.9.0. To update the Java agent, follow these on-screen [instructions](https://docs.newrelic.com/docs/apm/agents/java-agent/installation/update-java-agent/) and verify the agent version using the command:

```
java -jar newrelic.jar -v

```

To configure the security agent, click <DNT>**Next**</DNT>.

</Collapser>

<Collapser
id="setup-application-using-node"
title="Update the APM agent for Node.js runtime environment"
>
Update to the latest version of the agent (minimum v12.0.0). To update the Node.js agent, follow your standard procedures and run the following process as a terminal command or as a script:

Check notice on line 89 in src/content/docs/iast/install.mdx

View workflow job for this annotation

GitHub Actions / vale

[vale] src/content/docs/iast/install.mdx#L89 

[Microsoft.SentenceLength] Try to keep sentences short (< 30 words).
Raw output 
{"message": "[Microsoft.SentenceLength] Try to keep sentences short (\u003c 30 words).", "location": {"path": "src/content/docs/iast/install.mdx", "range": {"start": {"line": 89, "column": 1}}}, "severity": "INFO"}

```
npm install newrelic@latest

```

To configure the security agent, click <DNT>**Next**</DNT>.

</Collapser>

<Collapser
id="setup-application-using-node"
title="Update the APM for Go agent"
>
Update to the latest version of the agent (minimum v3.30.0)
To update the Go agent, follow your standard procedures to run the following process as a terminal command or as a script.
From http://github.com/newrelic/go-agent, use this process:

```
go get -u github.com/newrelic/go-agent/v3/newrelic

```

To configure the security agent, Click <DNT>**Next**</DNT>.

</Collapser>

</CollapserGroup>

</Step>

<Step>
Make sure your `newrelic.yml` config file is updated as follows:

## Configure the security agent

<CollapserGroup>
<Collapser
id="setup-security-agent-java"
title="Configure the security agent for Java application"
>

Configure the security agent by enabling the security agent settings. Make sure your `newrelic.yml` config file is updated as follows:

<CollapserGroup>
<Collapser
id="config-file-example"
title={<><InlineCode>newrelic.yml</InlineCode> config file</>}
title={<><InlineCode>newrelic.yml</InlineCode> config file (This setting is common for EU and Fed users)</>}
>
```yml
security:
Expand Down Expand Up @@ -82,20 +169,104 @@
```
</Collapser>
</CollapserGroup>
</Step>

<Step>
Once you've completed all the steps, restart your application and generate traffic against the application's APIs.
The code shown on-screen for <DNT>**Configure the security agent**</DNT> is the bare minimum requirement to start the IAST.

</Step>
To fully configure the IAST, click `Advanced security agent configurations` and copy the <DNT>**Security Config**</DNT> code. Now open the **newrelic.yml** file and paste the copied code below `high_security: false` in the file.

<Step>
Click <DNT>**See your data**</DNT> to see an overview of your tested application.
<Callout variant="tip">

`yml` is sensitive to indents and spacing, make sure the code pasted in **newrelic.yml** file is lined up underneath the high security settings.

</Callout>

</Collapser>

<Collapser
id="demo-install-nodejs"
title="Configure the security agent for Node.js"
>
Configure the security agent by enabling the security agent settings.

To enable the security agent, set the `security.enabled` and `security.agent.enabled` flag to true in the newrelic.js config file present at the root directory of your app.

Make sure that the `high_security` mode is turned off for the IAST to work.

The code shown above for **Configure the security agent** is the bare minimum requirement to start the IAST.

To fully configure the IAST, click `Advanced security agent configurations` and copy the <DNT>**Security Config**</DNT> code.

</Collapser>

<Collapser
id="demo-install-nodejs"
title="Configure the Go agent"
>
Configure the security agent by following the below steps:

1. Add this integration to your application by importing.

From https://github.com/newrelic/go-agent/tree/master/v3/integrations/nrsecurityagent, use this command:

```
import "github.com/newrelic/go-agent/v3/integrations/nrsecurityagent"

```

1. Enable IAST testing by adding code to initialize the integration after your call to `newrelic.NewApplication`.

```
app, err := newrelic.NewApplication(
newrelic.ConfigAppName("Your Application Name"),
newrelic.ConfigLicense("NEW_RELIC_LICENSE_KEY"),
)

```

Initialize the `nrsecurityagent` as given below:

```
err := nrsecurityagent.InitSecurityAgent(
app,
nrsecurityagent.ConfigSecurityEnable(true),
nrsecurityagent.ConfigSecurityValidatorServiceEndPointUrl("wss://csec.nr-data.net"),
)

```

1. Please ensure that you wrap your framework router with the WrapRouter function for [Echo](https://pkg.go.dev/github.com/newrelic/go-agent/v3/integrations/nrecho-v4#WrapRouter), [Gin](https://pkg.go.dev/github.com/newrelic/go-agent/v3/integrations/nrgin#WrapRouter), [Gorilla](https://pkg.go.dev/github.com/newrelic/go-agent/v3/integrations/nrgorilla#WrapRouter) frameworks. This is crucial for detecting routes (API endpoints) and enabling provable security in your application.

1. If you are opening an HTTP protocol endpoint, place the [newrelic.WrapListen](https://pkg.go.dev/github.com/newrelic/go-agent/v3/newrelic#WrapListen) function around the endpoint name to enable vulnerability scanning against that endpoint. For example:

```
http.ListenAndServe(newrelic.WrapListen(":8000"), nil)

```

**Note:** Skip this step if you are on linux environment.

1. Based on additional packages imported by the user application, add suitable instrumentation package [Instrumentation packages](https://github.com/newrelic/csec-go-agent#instrumentation-packages).

Make sure that the HighSecurity mode is turned off for the IAST to work.

Click **Next** to restart and test the application.

</Collapser>

</CollapserGroup>

</Step>

<Step>
## Restart and test the application

To start testing with the IAST agent, restart your application and generate traffic against your application’s APIs. Click <DNT>**See your data**</DNT> for an overview of your tested application.

</Step>

</Steps>

For more detailed instructions, check out these examples demo below.
## Check out these demo videos for setting up IAST with different application languages

<CollapserGroup>
<Collapser
Expand All @@ -108,6 +279,7 @@
type="wistia"
id="dbipyzuyok"
/>

</Collapser>

<Collapser
Expand All @@ -120,5 +292,6 @@
type="wistia"
id="1m2suxuvuz"
/>

</Collapser>
</CollapserGroup>
Loading