🛡️ 技術調査 - open-appsec

# インストーラのダウンロードと実行権限付与
wget https://downloads.openappsec.io/open-appsec-install && chmod +x open-appsec-install

# 自動インストール（NGINX / APISIX / Kong を自動検出）
./open-appsec-install --auto

# SaaS 管理モードで接続する場合
./open-appsec-install --auto --token <AGENT_TOKEN>

# 初期ポリシーを prevent-learn に設定する場合
./open-appsec-install --auto --prevent

nginx -t
service nginx restart

docker run -d \
  --name open-appsec-agent-unified \
  --restart unless-stopped \
  -p 80:80 \
  -p 443:443 \
  -v /path/to/conf:/etc/cp/conf \
  -v /path/to/data:/etc/cp/data \
  -v /path/to/logs:/var/log/nano_agent \
  -v /path/to/localconfig:/ext/appsec \
  -e user_email=<your-email> \
  -e AGENT_TOKEN=<token> \
  ghcr.io/openappsec/agent-unified:latest /cp-nano-agent

wget https://raw.githubusercontent.com/openappsec/openappsec/main/deployment/docker-compose/nginx/docker-compose.yaml

services:
  appsec-agent:
    image: ghcr.io/openappsec/agent:${APPSEC_VERSION}
    container_name: appsec-agent
    environment:
      - SHARED_STORAGE_HOST=appsec-shared-storage
      - LEARNING_HOST=appsec-smartsync
      - TUNING_HOST=appsec-tuning-svc
      - user_email=${APPSEC_USER_EMAIL}
      - AGENT_TOKEN=${APPSEC_AGENT_TOKEN}
      - registered_server="NGINX"
    ipc: host
    volumes:
      - ${APPSEC_CONFIG}:/etc/cp/conf
      - ${APPSEC_DATA}:/etc/cp/data
      - ${APPSEC_LOGS}:/var/log/nano_agent
      - ${APPSEC_LOCALCONFIG}:/ext/appsec
      - shm-volume:/dev/shm/check-point
    command: /cp-nano-agent

  appsec-nginx:
    image: ghcr.io/openappsec/nginx-attachment:${APPSEC_VERSION}
    container_name: appsec-nginx
    ipc: host
    volumes:
      - ${NGINX_CONFIG}:/etc/nginx/conf.d
      - shm-volume:/dev/shm/check-point
    ports:
      - "80:80"
      - "443:443"

volumes:
  shm-volume:
    driver: local
    driver_opts:
      type: tmpfs
      device: tmpfs

# Local Managed（standalone プロファイル）
COMPOSE_PROFILES=standalone docker-compose up -d

# Centrally Managed
COMPOSE_PROFILES= docker-compose up -d

helm repo add openappsec https://charts.openappsec.io
helm repo update

# Local Managed（standalone）
helm install open-appsec-nginx openappsec/open-appsec-nginx-ingress \
  --set appsec.mode=standalone \
  --set appsec.userEmail="<your-email>" \
  --set appsec.agentToken= \
  --set controller.ingressClass=appsec-nginx \
  --set controller.ingressClassResource.name=appsec-nginx \
  --set controller.ingressClassResource.controllerValue="k8s.io/appsec-nginx" \
  --set appsec.persistence.enabled=false \
  --set controller.service.externalTrafficPolicy=Local \
  --namespace appsec --create-namespace

# Centrally Managed（SaaS）
helm install open-appsec-nginx openappsec/open-appsec-nginx-ingress \
  --set appsec.mode=managed \
  --set appsec.agentToken="<your-token>" \
  --set appsec.userEmail="<your-email>" \
  --set controller.ingressClass=appsec-nginx \
  --set controller.ingressClassResource.name=appsec-nginx \
  --set controller.ingressClassResource.controllerValue="k8s.io/appsec-nginx" \
  --set appsec.persistence.enabled=false \
  --set controller.service.externalTrafficPolicy=Local \
  --namespace appsec --create-namespace

wget https://raw.githubusercontent.com/openappsec/openappsec/main/config/crds/open-appsec-crd-v1beta2.yaml
kubectl apply -f ./open-appsec-crd-v1beta2.yaml

wget https://raw.githubusercontent.com/openappsec/openappsec/main/config/k8s/v1beta2/open-appsec-k8s-default-config-v1beta2.yaml
kubectl apply -f ./open-appsec-k8s-default-config-v1beta2.yaml

# Kong
helm install open-appsec-kong openappsec/open-appsec-kong \
  --set ingressController.ingressClass=appsec-kong \
  --set appsec.userEmail="<your-email>" \
  --set appsec.agentToken= \
  --namespace appsec --create-namespace

# APISIX
helm install open-appsec-apisix openappsec/open-appsec-apisix \
  --set rbac.create=true \
  --set service.type=LoadBalancer \
  --set ingress-controller.enabled=true \
  --set ingress-controller.config.ingressClass=appsec-apisix \
  --set appsec.userEmail="<your-email>" \
  --set appsec.agentToken= \
  --namespace appsec-apisix --create-namespace

# Istio
helm install open-appsec-webhook openappsec/open-appsec-injector \
  --set webhook.objectSelector.labelValue=istio-ingress \
  --set webhook.objectSelector.labelName=app \
  --set kind=istio \
  --set appsec.userEmail=<your-email> \
  --set appsec.agentToken= \
  -n <istio-namespace>

# Kong
helm install open-appsec-webhook openappsec/open-appsec-injector \
  --set webhook.objectSelector.labelName="app.kubernetes.io/name" \
  --set webhook.objectSelector.labelValue=kong \
  --set kind=kong \
  --set appsec.userEmail=<your-email> \
  --set appsec.agentToken= \
  -n <kong-namespace>

kubectl patch envoyproxy <name> --namespace <ns> --type=merge --patch-file envoyproxy-deployment-patch.yaml
kubectl apply -f EnvoyPatchPolicy.yaml -n <gateway-namespace>
kubectl apply -f policy-activation.yaml

initContainers:
  - name: envoy-attachments
    image: ghcr.io/openappsec/openappsec-envoy-filters:latest
    env:
      - name: ENVOY_VERSION
        value: "1.34"
containers:
  - name: openappsec-agent
    image: ghcr.io/openappsec/agent:1.1.29
    env:
      - name: AGENT_TOKEN
        value: "<token>"
      - name: registered_server
        value: "Envoy Gateway"

git clone https://github.com/openappsec/open-appsec-npm.git
cd open-appsec-npm

# Local Managed で起動
COMPOSE_PROFILES=standalone docker-compose up -d

policies:
  default:
    mode: detect-learn
    accessControlPractices:
      - access-control-practice-example
    threatPreventionPractices:
      - threat-prevention-practice-example
    triggers:
      - log-trigger-example
    customResponse: web-user-response-example
    sourceIdentifiers: ""
    trustedSources: ""
    exceptions:
      - exception-example
  specificRules:
    - host: "example.com"
      mode: prevent-learn
      threatPreventionPractices:
        - threat-prevention-practice-example
      accessControlPractices:
        - access-control-practice-example
      triggers:
        - log-trigger-example

policies:
  default:
    mode: detect-learn
    practices:
      - webapp-default-practice
    triggers:
      - appsec-special-log-trigger
    source-identifiers: appsec-source-identifiers-sourceip-example
    trusted-sources: appsec-trusted-source-example
    custom-response: appsec-web-user-response-example
    exceptions:
      - appsec-exception-example
  specific-rules:
    - host: web.server.com/example
      mode: prevent-learn
      practices:
        - webapp-best-practice
      triggers:
        - appsec-special-log-trigger

threatPreventionPractices:
  - name: threat-prevention-practice-example
    practiceMode: inherited
    webAttacks:
      overrideMode: inherited        # inherited / detect / prevent / disabled
      minimumConfidence: high        # medium / high / critical（デフォルト: high）
    intrusionPrevention:
      overrideMode: inherited
      maxPerformanceImpact: medium   # low / medium / high
      minSeverityLevel: medium       # low / medium / high / critical
    schemaValidation:
      overrideMode: inherited
      configmap: openapi-schema-cm   # OpenAPI スキーマを格納する ConfigMap

accessControlPractices:
  - name: access-control-practice-example
    practiceMode: inherited
    rateLimit:
      overrideMode: inherited
      rules:
        - uri: "/api/login"
          limit: 100
          unit: minute               # minute / second
          action: prevent            # detect / prevent

logTriggers:
  - name: log-trigger-example
    accessControlLogging:
      allowEvents: false
      dropEvents: true
    appsecLogging:
      detectEvents: true
      preventEvents: true

exceptions:
  - name: exception-example
    action: "accept"
    condition:
      - key: "countryCode"
        value: "US"

customResponses:
  - name: web-user-response-example
    mode: response-code-only
    httpResponseCode: 403

sourcesIdentifiers:
  - name: sources-identifier-example
    sourcesIdentifiers:
      - identifier: sourceip
        value:
          - "0.0.0.0"

trustedsources:
  - name: appsec-trusted-source-example
    minNumOfSources: 3
    sourcesIdentifiers:
      - "0.0.0.0"
      - "1.1.1.1"
      - "2.2.2.2"

# 基本操作
open-appsec-ctl --status
open-appsec-ctl --view-logs
open-appsec-ctl -lc http-transaction-handler
open-appsec-ctl -lc orchestrator

# Docker / Kubernetes 経由
docker exec -it open-appsec-agent open-appsec-ctl --status
kubectl exec -it <pod-name> -c openappsec-agent -n appsec -- open-appsec-ctl --status

/var/log/nano_agent/CP-nano-http-transaction-handler.log<番号>

open-appsec-ctl --status
open-appsec-ctl --status --extended

open-appsec-ctl --start-agent
open-appsec-ctl --stop-agent

# デバッグ用（個別サービス制御）
open-appsec-ctl --start-service http-transaction-handler
open-appsec-ctl --stop-service  http-transaction-handler
# 対象サービス: orchestration / attachment-registrator / http-transaction-handler

# ポリシー一覧
open-appsec-ctl --list-policies

# ポリシー確認
open-appsec-ctl --view-policy [policy-file]

# ポリシー編集
open-appsec-ctl --edit-policy [policy-file]

# ポリシー適用（ローカル管理）
open-appsec-ctl --apply-policy [policy-file]

# 実行中サービスへのポリシー再読み込み
open-appsec-ctl -lc http-transaction-handler
open-appsec-ctl -lc orchestrator

[新規デプロイ]
    ↓
detect-learn（最低 2〜3 日、Graduate 到達まで）
    ↓
SaaS "Learn" タブで推奨を確認
    ↓
Events タブで Critical/High イベントを精査
    ↓
False Positive があれば Exception を追加
    ↓
prevent-learn（Critical のみ または High 以上を選択して移行）
    ↓
一定期間監視後、必要に応じて感度を上げる

policies:
  default:
    mode: detect-learn
  specificRules:
    - host: "trusted-app.example.com"
      mode: prevent-learn

trustedsources:
  - name: internal-trusted-sources
    minNumOfSources: 3
    sourcesIdentifiers:
      - "10.0.0.0/8"
      - "192.168.1.10"
      - "192.168.1.20"

exceptions:
  - name: fp-exception-internal-scanner
    action: accept
    condition:
      - key: sourceIp
        value: "10.0.1.50"
      - key: url
        value: "/healthz"

  - name: fp-exception-skip-param
    action: skip
    condition:
      - key: paramName
        value: "custom_payload"
      - key: hostName
        value: "api.example.com"

exceptions:
  - name: fp-exception-legacy
    action: accept
    sourceIp: ["10.0.1.50"]
    url: ["/healthz", "/metrics"]

# $SPLUNK_HOME/etc/system/local/inputs.conf
[udp://5140]
sourcetype = syslog

logtriggers:
  - name: siem-syslog-trigger
    appsec-logging:
      detect-events: true
      prevent-events: true
    log-destination:
      syslog-service:
        - address: "localhost"
          port: 5140
          protocol: UDP

# 現在のポリシーとチューニング提案を確認
open-appsec-ctl --view-policy

# 提案を取り込んだポリシーを編集
open-appsec-ctl --edit-policy /etc/cp/conf/local_policy.yaml

# 適用とリロード
open-appsec-ctl --apply-policy /etc/cp/conf/local_policy.yaml
open-appsec-ctl -lc http-transaction-handler

replicaCount: 2
persistence:
  enabled: true
  storageClass: "standard"
  accessMode: ReadWriteMany

resources:
  requests:
    cpu: "100m"
    memory: "256Mi"
  limits:
    cpu: "500m"
    memory: "512Mi"

# 1. 状態確認
open-appsec-ctl --status --extended

# 2. ログ確認
open-appsec-ctl --view-logs

# 3. ネットワーク疎通確認
curl -v https://inext-agents.cloud.ngen.checkpoint.com
curl -v https://downloads.openappsec.io

# 4. サービス個別再起動
open-appsec-ctl --stop-service orchestration
open-appsec-ctl --start-service orchestration

# 5. ポリシー再適用
open-appsec-ctl --apply-policy /etc/cp/conf/local_policy.yaml
open-appsec-ctl -lc orchestrator
open-appsec-ctl -lc http-transaction-handler

kubectl get pods -n <NAMESPACE>
kubectl logs <POD_NAME> -n <NAMESPACE> -c openappsec-agent
kubectl exec -n <NAMESPACE> <POD_NAME> -c openappsec-agent -- open-appsec-ctl --status

# Linux
open-appsec-ctl --info --upload

# Docker
docker exec -it <CONTAINER_NAME> open-appsec-ctl --info --upload

# Kubernetes
kubectl exec -n <NAMESPACE> <POD_NAME> -c <CONTAINER_NAME> -- open-appsec-ctl --info --upload