[AppSec] Emit rasp.error and rasp.rule.skipped telemetry - #9090
Open
dromanol wants to merge 1 commit into
Open
Conversation
Add the two missing RASP telemetry count metrics: rasp.error when the WAF returns an error for a RASP evaluation, and rasp.rule.skipped when the evaluation never reaches the WAF because of the request lifecycle. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Execution-Time Benchmarks Report ⏱️Execution-time results for samples comparing This PR (9090) and master. ✅ No regressions detected |
BenchmarksBenchmark execution time: 2026-08-20 18:10:41 Comparing candidate commit d07c891 in PR branch Found 1 performance improvements and 0 performance regressions! Performance is the same for 71 metrics, 0 unstable metrics, 65 known flaky benchmarks, 61 flaky benchmarks without significant changes.
|
andrewlock
reviewed
Aug 21, 2026
| internal sealed partial class MetricsTelemetryCollector | ||
| { | ||
| private const int CountLength = 770; | ||
| private const int CountLength = 800; |
Member
There was a problem hiding this comment.
Urgh, this number is getting quite large, I wonder if we're going to have to do something about it at some point 🙁
Contributor
Author
There was a problem hiding this comment.
Yup, I thought the same when I saw it
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary of changes
Add the two missing RASP telemetry count metrics:
appsec.rasp.error— the WAF returned an error for a RASP evaluation, tagged bywaf_errorandrule_type/rule_variant.appsec.rasp.rule.skipped— a RASP evaluation never reached the WAF, tagged byreasonandrule_type/rule_variant.Reason for change
.NET was the only tracer not emitting these, so RASP errors and lifecycle-skipped evaluations were invisible in telemetry. Fixes APPSEC-69544.
Implementation details
Both metrics are recorded from
RaspModule, which is the only place that knows the address (and therefore the rule type) — no rule type has to be plumbed throughSecurityCoordinator/Context.CheckVulnerability,OnDownstreamRequestandOnDownstreamResponsehad a combinedrootSpan is null || rootSpan.IsFinished || rootSpan.Type != SpanTypes.Webguard. It is split so a finished span reportsafter-requestand the rest reportout-of-request. A missing security coordinator also reportsout-of-request.RunWaf. Anullresult means the WAF never produced one, reported aswaf_error:-127(binding error); otherwise the return code is mapped through the existingToWafErrorTag(). A timeout returns early, since it is already reported byrasp.timeout— same precedence asSecurityReporter.RecordWafTelemetry.RunWafalso returnsnullwhen the additive context was disposed between the lifecycle check and the call, i.e. the request ended in between. The newAppSecRequestContext.IsAdditiveContextDisposeddistinguishes that case so it is reported asrasp.rule.skipped{after-request}rather than a phantom binding error.OnDownstreamRequest/OnDownstreamResponsenow checkAddressEnabled(DownstreamUrl)up front, so a ruleset without SSRF rules doesn't report skips for instrumentation that isn't active.Tag shapes follow the intake spec in dd-go rather than another tracer's implementation. Note
rasp.rule.skippedcarries neitherwaf_versionnorevent_rules_version— the evaluation is skipped before the WAF is reached.The embedded
common_metrics.jsoncopy used byMetricTestsis updated; dd-go needs the same two entries after this merges.Test coverage
New
RaspModuleTelemetryTests(32 tests): both reasons across all 5 rule types, all WAF error codes, success codes and timeouts recording nothing, unknown addresses no-op, the absence ofwaf_versiontags, and the disposed-context vs binding-error split.MetricTestsvalidates both metrics against the intake spec.Other details
rasp.duration/rasp.duration_ext(distributions) are not included and will follow separately.🤖 Generated with Claude Code