diff --git a/.github/workflows/prod.yml b/.github/workflows/prod.yml
index 164d6534c5..5a2d232968 100644
--- a/.github/workflows/prod.yml
+++ b/.github/workflows/prod.yml
@@ -23,6 +23,11 @@ on:
type: boolean
default: true
description: Internal
+ threat_detection:
+ type: boolean
+ default: true
+ description: Threat Detection Client
+
threat_detection_backend:
type: boolean
default: true
@@ -132,6 +137,11 @@ jobs:
echo "::set-output name=image::$ECR_REGISTRY/akto-internal:$IMAGE_TAG"
fi
+ if [[ "${{ github.event.inputs.threat_detection}}" == "true" ]]; then
+ cd ../threat-detection
+ docker buildx build --platform linux/arm64/v8,linux/amd64 -t $ECR_REGISTRY/akto-threat-detection:$IMAGE_TAG_1 -t $ECR_REGISTRY/akto-threat-detection:$IMAGE_TAG_2 . --push
+ fi
+
if [[ "${{ github.event.inputs.threat_detection_backend}}" == "true" ]]; then
cd ../threat-detection-backend
docker buildx build --platform linux/arm64/v8,linux/amd64 -t $ECR_REGISTRY/akto-threat-detection-backend:$IMAGE_TAG_1 -t $ECR_REGISTRY/akto-threat-detection-backend:$IMAGE_TAG_2 . --push
diff --git a/.github/workflows/staging.yml b/.github/workflows/staging.yml
index 4f6945e08b..eebd097b27 100644
--- a/.github/workflows/staging.yml
+++ b/.github/workflows/staging.yml
@@ -95,6 +95,8 @@ jobs:
docker buildx build --platform linux/arm64/v8,linux/amd64 -t $ECR_REGISTRY/akto-internal:$IMAGE_TAG . --push
cd ../source-code-analyser
docker buildx build --platform linux/arm64/v8,linux/amd64 -t $ECR_REGISTRY/source-code-analyser:$IMAGE_TAG . --push
+ cd ../threat-detection
+ docker buildx build --platform linux/arm64/v8,linux/amd64 -t $ECR_REGISTRY/akto-threat-detection:$IMAGE_TAG . --push
cd ../threat-detection-backend
docker buildx build --platform linux/arm64/v8,linux/amd64 -t $ECR_REGISTRY/akto-threat-detection-backend:$IMAGE_TAG . --push
diff --git a/Makefile b/Makefile
index 0e5f9287bd..895ab09c1f 100644
--- a/Makefile
+++ b/Makefile
@@ -7,4 +7,4 @@ build: proto-gen
mvn install -DskipTests
build-clean: proto-gen
- mvn clean install -DskipTests
\ No newline at end of file
+ mvn clean install -DskipTests
diff --git a/apps/api-threat-detection/Dockerfile b/apps/api-threat-detection/Dockerfile
deleted file mode 100644
index 8498c6d7fc..0000000000
--- a/apps/api-threat-detection/Dockerfile
+++ /dev/null
@@ -1,9 +0,0 @@
-FROM openjdk
-
-WORKDIR /app
-COPY ./target/api-threat-detection-1.0-SNAPSHOT-jar-with-dependencies.jar /app/api-threat-detection-1.0-SNAPSHOT-jar-with-dependencies.jar
-COPY start.sh /app/start.sh
-
-RUN chmod +x /app/start.sh
-
-CMD ["/app/start.sh"]
diff --git a/apps/api-threat-detection/pom.xml b/apps/api-threat-detection/pom.xml
deleted file mode 100644
index 64a129a342..0000000000
--- a/apps/api-threat-detection/pom.xml
+++ /dev/null
@@ -1,190 +0,0 @@
-
-
- 4.0.0
-
-
- com.akto.apps
- apps
- ${revision}
-
-
- com.akto.apps.api-threat-detection
- api-threat-detection
- jar
-
-
-
- org.apache.commons
- commons-lang3
- 3.12.0
-
-
- com.akto.libs.dao
- dao
- ${project.version}
-
-
- com.akto.libs.utils
- utils
- ${project.version}
-
-
- com.akto.apps.mini-runtime
- mini-runtime
- ${project.version}
-
-
- com.akto.apps.testing
- testing
- ${project.version}
-
-
- org.apache.httpcomponents
- httpclient
- 4.5.13
-
-
- org.jetbrains
- annotations
- RELEASE
- compile
-
-
- org.junit.jupiter
- junit-jupiter-api
- 5.4.2
- test
-
-
- org.apache.kafka
- kafka-clients
- 3.0.0
-
-
- com.akto.libs.utils
- utils
- test-jar
- ${project.version}
- test
-
-
-
-
-
-
- org.apache.maven.plugins
- maven-compiler-plugin
- 3.1
-
- 8
- 8
-
-
-
-
- org.apache.maven.plugins
- maven-dependency-plugin
- 3.0.1
-
-
- copy-dependencies
- package
-
- copy-dependencies
-
-
-
-
-
-
- src/main/java
- src/test/java
-
-
- src/main/resources
- true
-
- **/version.txt
-
-
-
-
-
-
-
- normal
-
- true
-
-
-
-
- org.apache.maven.plugins
- maven-assembly-plugin
-
-
- package
-
- single
-
-
-
-
-
- com.akto.threat.detection.Main
-
-
-
-
- jar-with-dependencies
-
-
-
-
-
-
-
-
-
-
- devcontainer
-
-
-
- org.apache.maven.plugins
- maven-jar-plugin
-
- api-threat-detection-1.0-SNAPSHOT-jar-with-dependencies
-
-
- true
- com.akto.threat.detection.Main
- dependency-jars/
-
-
-
-
-
- org.apache.maven.plugins
- maven-dependency-plugin
-
-
- copy-dependencies
- package
-
- copy-dependencies
-
-
- ${project.build.directory}/dependency-jars/
-
-
-
-
-
-
-
-
-
-
diff --git a/apps/api-threat-detection/src/main/java/com/akto/filters/HttpCallFilter.java b/apps/api-threat-detection/src/main/java/com/akto/filters/HttpCallFilter.java
deleted file mode 100644
index ecbc8e5ac7..0000000000
--- a/apps/api-threat-detection/src/main/java/com/akto/filters/HttpCallFilter.java
+++ /dev/null
@@ -1,121 +0,0 @@
-package com.akto.filters;
-
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Map.Entry;
-import java.util.UUID;
-
-import com.akto.dao.context.Context;
-import com.akto.dao.monitoring.FilterYamlTemplateDao;
-import com.akto.data_actor.DataActor;
-import com.akto.data_actor.DataActorFactory;
-import com.akto.dto.ApiInfo.ApiInfoKey;
-import com.akto.dto.HttpResponseParams;
-import com.akto.dto.RawApi;
-import com.akto.dto.bulk_updates.BulkUpdates;
-import com.akto.dto.bulk_updates.UpdatePayload;
-import com.akto.dto.monitoring.FilterConfig;
-import com.akto.dto.test_editor.YamlTemplate;
-import com.akto.dto.traffic.SuspectSampleData;
-import com.akto.dto.type.URLMethods.Method;
-import com.akto.hybrid_parsers.HttpCallParser;
-import com.akto.log.LoggerMaker;
-import com.akto.log.LoggerMaker.LogDb;
-import com.akto.rules.TestPlugin;
-import com.akto.runtime.policies.ApiAccessTypePolicy;
-import com.akto.test_editor.execution.VariableResolver;
-import com.akto.test_editor.filter.data_operands_impl.ValidationResult;
-
-public class HttpCallFilter {
- private static final LoggerMaker loggerMaker = new LoggerMaker(HttpCallFilter.class, LogDb.THREAT_DETECTION);
-
- private Map apiFilters;
- private List bulkUpdates = new ArrayList<>();
- private final int sync_threshold_count;
- private final int sync_threshold_time;
- private int last_synced;
- private int sync_count;
- private HttpCallParser httpCallParser;
-
- private static final int FILTER_REFRESH_INTERVAL = 10 * 60;
- private int lastFilterFetch;
-
- private static final DataActor dataActor = DataActorFactory.fetchInstance();
-
- public HttpCallFilter(int sync_threshold_count, int sync_threshold_time) {
- apiFilters = new HashMap<>();
- bulkUpdates = new ArrayList<>();
- this.sync_threshold_count = sync_threshold_count;
- this.sync_threshold_time = sync_threshold_time;
- last_synced = 0;
- sync_count = 0;
- lastFilterFetch = 0;
- httpCallParser = new HttpCallParser(sync_threshold_count, sync_threshold_time);
- }
-
- public void filterFunction(List responseParams) {
-
- int now = Context.now();
- if ((lastFilterFetch + FILTER_REFRESH_INTERVAL) < now) {
- // TODO: add support for only active templates.
- List templates = dataActor.fetchFilterYamlTemplates();
- apiFilters = FilterYamlTemplateDao.instance.fetchFilterConfig(false, templates, false);
- lastFilterFetch = now;
- }
-
- if (apiFilters != null && !apiFilters.isEmpty()) {
- for (HttpResponseParams responseParam : responseParams) {
- for (Entry apiFilterEntry : apiFilters.entrySet()) {
- try {
- FilterConfig apiFilter = apiFilterEntry.getValue();
- String filterId = apiFilterEntry.getKey();
- String message = responseParam.getOrig();
- List sourceIps = ApiAccessTypePolicy.getSourceIps(responseParam);
- RawApi rawApi = RawApi.buildFromMessage(message);
- int apiCollectionId = httpCallParser.createApiCollectionId(responseParam);
- responseParam.requestParams.setApiCollectionId(apiCollectionId);
- String url = responseParam.getRequestParams().getURL();
- Method method = Method.fromString(responseParam.getRequestParams().getMethod());
- ApiInfoKey apiInfoKey = new ApiInfoKey(apiCollectionId, url, method);
- Map varMap = apiFilter.resolveVarMap();
- VariableResolver.resolveWordList(varMap, new HashMap>() {
- {
- put(apiInfoKey, Arrays.asList(message));
- }
- }, apiInfoKey);
- String filterExecutionLogId = UUID.randomUUID().toString();
- ValidationResult res = TestPlugin.validateFilter(apiFilter.getFilter().getNode(), rawApi,
- apiInfoKey, varMap, filterExecutionLogId);
- if (res.getIsValid()) {
- now = Context.now();
- SuspectSampleData sampleData = new SuspectSampleData(
- sourceIps, apiCollectionId, url, method,
- message, now, filterId);
- Map filterMap = new HashMap<>();
- UpdatePayload updatePayload = new UpdatePayload("obj", sampleData, "set");
- ArrayList updates = new ArrayList<>();
- updates.add(updatePayload.toString());
- bulkUpdates.add(new BulkUpdates(filterMap, updates));
- }
- } catch (Exception e) {
- loggerMaker.errorAndAddToDb(e, String.format("Error in httpCallFilter %s", e.toString()));
- }
- }
- }
- }
- sync_count = bulkUpdates.size();
- if (sync_count > 0 && (sync_count >= sync_threshold_count ||
- (Context.now() - last_synced) > sync_threshold_time)) {
- List