Data collected

tCell collects a variety of runtime information from your application. There are two types of data collected, events and metrics. Events represent discrete events or pieces of information. Metrics represent time based counts of different events.

Sanitization

All data is passed through a sanitization filter before being asynchronously sent to the tCell service. No data leaves the application agent without first passing through this sanitization process. Sanitization steps are designed to prevent private data from leaving your network.

Sanitization steps include:

Session IDs (sid): Session tokens are one-way hashed with an optional private key (hmac_key) to form the transmitted sid. This lets tCell associate multiple events from the same user session without knowing anything about the session itself.

Password IDs (passwordId): For agents that support password behavior tracking, passwords for login events are one-way hashed with an optional private key (password_hmac_key), the tcell app id, and the username, and then a small portion of the hash result is used. The net result is that the tCell service can determine if an ip address is trying a variety of passwords or usernames, or is trying the same one repeatedly. Thus, a misconfigured automated agent which always attempts the same username and password is not flagged as an an account takeover attack. However, because of the limited portion of the hash collected, the data is not useful to try to guess the actual password, especially if the private key is used.

Transaction IDs (tid): Generate UUIDs for transaction IDs using no customer or user identifiable data. URI sanitization: URIs are all sanitized by stripping parameter values. For example, the referrer URL http://localhost:8080/WebGoat/login.mvc?error=SomeErrorHere&test=SomeValue will be sanitized to http://localhost:8080/WebGoat/login.mvc?error=&test=

Violation Payload Data

The Violation Payloads options at Policies > App Firewall in the Monitor tab determine where tCell sends violation payload data.

The Send Payload Data to tCell option directs tCell to send full payloads with the event data to the tCell cloud. The payloads can help you better understand the nature of the attack on the application.

However, the payloads may contain personally identifiable information (PII) which, if displayed, could violate your GDPR or other compliance protocols. If you prefer not to send the payloads to the tCell cloud, disable the option. If disabled, all tCell features will continue to work. This feature will apply to form parameters and query parameters in the request (including header, body, and URL).

The Log Payload Data Locally option logs payload data to local logs (tcell.log). If selected, parameters listed in the Exclude sending payloads for parameters table will still be sanitized. Therefore these values will not be sent to local logs.

These options only apply to the sending of payload data ("payload" is one field of an event). With either option enabled or disabled, all other tCell event data will still be sent to the cloud and local logging.

Events

Metrics

{"event_type":
1
  "rct": {
2
    "98246921": {
3
      "c": 3,
4
      "mx": 446,
5
      "mn": 68,
6
      "t": 318
7
    },
8
    "?": {
9
      "c": 4,
10
      "mx": 9,
11
      "mn": 5,
12
      "t": 7
13
    }
14
  }
15
  ``` |
16
| sessions | Per session metrics for authenticated users | ua: A dictionary of user-agents whose value is the ip's they came from<br>uid: User ID for that session | ```
17
"event_type": "metrics",
18
  "sessions": {
19
    "hmac_of_session_id_x": [
20
      {
21
        "uid": "user_x",
22
        "track": [
23
          [
24
            "Mozilla/5.0 User Agent V1.03",
25
            [
26
              "1.1.1.1",
27
              "1.1.2.2"
28
            ]
29
          ]
30
        ]
31
      }
32
    ],
33
    "hmac_of_session_id_y": [
34
      {
35
        "uid": "user_y",
36
        "track": [
37
          [
38
            "Mozilla/3.0 User Agent V1.03",
39
            [
40
              "1.1.3.1"
41
            ],
42
            [
43
              "Chrome 30 User Agent",
44
              [
45
                "1.101.3.4"
46
              ]
47
            ]
48
          ]
49
        ]
50
      }
51
    ]
52
  }