Mozilla Security Consecutive Request Set Frequency

For events matching the message matcher, identify scenarios where the same set of request paths are being requested in the same order, and generate violation notices/TSV output for clients that exceed set_threshold consecutive occurrences within the timer interval.

The acceptable_variance configuration parameter can be used to specify the upper bounds on the number of unique paths that will be tracked. If a client makes requests to >= this number of unique paths, the client is considered varied enough and is no longer tracked during this interval.

1. Sample Configuration

filename = "moz_security_pathsetfreq.lua"
message_matcher = "Logger == 'input.nginx'"
ticker_interval = 60
preserve_data = false

id_field = "Fields[remote_addr]" -- field to use as the identifier
-- id_field_capture = ",? *([^,]+)$",  -- optional e.g. extract the last entry in a comma delimited list
request_field = "Fields[request] -- field containing HTTP request
-- request_field_capture = "%S+%s+(%S+)" -- optional, e.g., extract second string in field

-- send_iprepd = false -- optional, if true plugin will generate iprepd violation messages
-- violation_type = "fxa:client_pathsetfreq" -- required in violations mode, iprepd violation type
set_threshold = 50 -- consecutive repeats to generate violation/tsv output
acceptable_variance = 5 -- >= unique request paths to ignore client for interval
-- no_single_set = true -- if true, disable tracking set with single path (e.g., repeated)

source code: moz_security_pathsetfreq.lua