Collect run metrics for DAST
Collect basic metrics about a DAST scan. The scan_uuid allows joining to other DAST scan metrics.
{
"event": "collect_dast_scan_run_metrics_from_pipeline",
// Columns (join, filter, fast)
"property": "scan_uuid", // join: Allows joining
"value": 5, // fast: Runtime in seconds
"label": "1", // fast: Success (0) or failure (define failure codes:
// - 0 success
// - 1 is generic error exit
// - 2 is panic
// - 3 is auth failed
// - 4 is crawling failed
// - 5 is configuration failed
// - 6 is active checks failed
// - others TBD)
// JSON (slow)
"auth_type": "2", // slow: browserk.AuthType (AuthNone = 0, AuthAuto = 1,
// AuthManual = 2, AuthBasicDigest = 3, AuthScript = 4
// panic_st_* -- Only exist when `parameter` is `2` (panic)
// First function/line of DAST code in stack trace
"panic_st_f" : "main.divideByZero()",
"panic_st_l" : "/path/to/your/file.go:6"
}
Implementation Plan
-
Define new internal event in monolith -
Whitelist event name for use in security report -
Populate event in DAST security report -
Validate event data is populating in snowflake
Getting the golang stack trace
// Get stack trace
pc := make([]uintptr, 10) // Slice to store program counters
n := runtime.Callers(0, pc) // Get current goroutine's call stack
frames := runtime.CallersFrames(pc[:n]) // Create a Frames iterator
fmt.Println("Stack Trace:")
for {
frame, more := frames.Next()
fmt.Printf(" File: %s, Line: %d, Function: %s\n", frame.File, frame.Line, frame.Function)
if !more {
break
}
}
Edited by Michael Eddington