Skip to content

Alert ID in AppSec response to bouncers #4523

Description

@Simbiat

What would you like to be added?

/kind enhancement

Add alert ID to response body sent from AppSec to bouncers

Why is this needed?

As per documentation AppSec's body will contain only action and http_status in case of block, but nothing else. When a bouncer (at least Caddy one) intercepts a decision - it can get a decision ID and then pass it down to whatever extra processing, if required (like I was able to do in this PR for Caddy bouncer hslatman/caddy-crowdsec-bouncer#125). But if block was done by AppSec - there is no such luck, and it may be very difficult to get any information about why a request was blocked, especially if it's done a few hours or even days later (like a user reported a false positive). We even have an example of it in #4518 Having Alert ID gives an option of further processing or, at least, extra logging, to help debug things later.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions