tirreno

https://docs.tirreno.com
Admin
tirreno is an open-source security analytics platform that detects cyber threats, account takeovers,...
Tokens:14,978
Snippets:171
Trust Score:7.2
Update:4 months ago
Show doc for...
Tokens:
Raw
### event-data.py

Source: https://docs.tirreno.com/api-integration.html

Python code example for constructing a dictionary with event details, including required and optional fields.

```python
data = {
    ########### Required fields ###########
    # Unique value that allows identification of a user. Ex: alice54 (string)
    'userName': 'tirreno42',

    # User email (string)
    'emailAddress': 'team@tirreno.com',

    # User IP address (string)
    'ipAddress': '217.70.184.38',

    # URL path of visited page (string)
    'url': '/home/account?ref=1',

    # User-agent of user request (string)
    'userAgent': 'Mozilla/5.0 (Windows NT 6.1; rv:109.0) Gecko/20100101 Firefox/115.0 ',

    # Event UTC timestamp ('Y-m-d H:i:s.v' string)
    'eventTime': '2024-06-06 14:20:01.283',

    ########### Optional fields ###########
    # User first name (string)
    'firstName': 'John',

    # User last name (string)
    'lastName': 'Fox',

    # User full name (string)
    'fullName': '',

    # Title of visited page (string)
    'pageTitle': 'Home page',

    # User phone number (string)
    'phoneNumber': '+41000000000',

    # Referer of visited page (string)
    'httpReferer': 'https://tirreno.com/signup',

    # Status code for page visit (string)
    'httpCode': '200',

    # User browser language (string)
    'browserLanguage': 'en-GB,en;q=0.9',

    # Type of user action from event types list (string)
    'eventType': 'account_registration',

    # Type of HTTP request from list (string)
    'httpMethod': 'POST',

    # User created UTC timestamp ('Y-m-d H:i:s' string)
    'userCreated': ''
}


```

--------------------------------

### Send Event

Source: https://docs.tirreno.com/api-integration.html

Code example for sending an event via HTTP POST request.

```Ruby
http.use_ssl = true if url.scheme == 'https'
request = Net::HTTP::Post.new(url, headers)
request.body = URI.encode_www_form(data)
response = http.request(request)
```

--------------------------------

### Event Data Structure

Source: https://docs.tirreno.com/api-integration.html

Example structure for event data, including required and optional fields.

```ruby
data = {

    ########### Required fields ###########

    # Unique value that allows identification of a user. Ex: alice54 (string)
    'userName': 'tirreno42',

    # User email (string)
    'emailAddress': 'team@tirreno.com',

    # User IP address (string)
    'ipAddress': '217.70.184.38',

    # URL path of visited page (string)
    'url': '/home/account?ref=1',

    # User-agent of user request (string)
    'userAgent': 'Mozilla/5.0 (Windows NT 6.1; rv:109.0) Gecko/20100101 Firefox/115.0 ',

    # Event UTC timestamp ('Y-m-d H:i:s.v' string)
    'eventTime': '2024-06-06 14:20:01.283',

    ########### Optional fields ###########

    # User first name (string)
    'firstName': 'John',

    # User last name (string)
    'lastName': 'Fox',

    # User full name (string)
    'fullName': '',

    # Title of visited page (string)
    'pageTitle': 'Home page',

    # User phone number (string)
    'phoneNumber': '+41000000000',

    # Referer of visited page (string)
    'httpReferer': 'https://tirreno.com/signup',

    # Status code for page visit (string)
    'httpCode': '200',

    # User browser language (string)
    'browserLanguage': 'en-GB,en;q=0.9',

    # Type of user action from event types list (string)
    'eventType': 'account_registration',

    # Type of HTTP request from list (string)
    'httpMethod': 'POST',

    # User created UTC timestamp ('Y-m-d H:i:s' string)
    'userCreated': ''
}
```

--------------------------------

### Cron Job Schedule

Source: https://docs.tirreno.com/installation.html

This cron job schedule is used to set up cron jobs for Tirreno, running every 10 minutes.

```bash
*/10 * * * * cd /path/to/tirreno && /usr/bin/php /path/to/tirreno/index.php /cron >> /path/to/tirreno/logs/error.log 2>&1

```

--------------------------------

### event-data.php

Source: https://docs.tirreno.com/api-integration.html

PHP code example for constructing an associative array with event details, including required and optional fields.

```php
<?php

$data = array(

    /////////// Required fields ///////////

    // Unique value that allows identification of a user. Ex: alice54 (string)
    'userName'        => 'tirreno42',

    // User email (string)
    'emailAddress'    => 'team@tirreno.com',

    // User IP address (string)
    'ipAddress'       => '217.70.184.38',

    // URL path of visited page (string)
    'url'             => '/home/account?ref=1',

    // User-agent of user request (string)
    'userAgent'       => 'Mozilla/5.0 (Windows NT 6.1; rv:109.0) Gecko/20100101 Firefox/115.0',

    // Event UTC timestamp ('Y-m-d H:i:s.v' string)
    'eventTime'       => '2024-06-06 14:20:01.283',

    /////////// Optional fields ///////////

    // User first name (string)
    'firstName'       => 'John',

    // User last name (string)
    'lastName'        => 'Fox',

    // User full name (string)
    'fullName'        => '',

    // Title of visited page (string)
    'pageTitle'       => 'Home page',

    // User phone number (string)
    'phoneNumber'     => '+41000000000',

    // Referer of visited page (string)
    'httpReferer'     => 'https://tirreno.com/signup',

    // Status code for page visit (string)
    'httpCode'        => '200',

    // User browser language (string)
    'browserLanguage' => 'en-GB,en;q=0.9',

    // Type of user action from event types list (string)
    'eventType'       => 'account_registration',

    // Type of HTTP request from list (string)
    'httpMethod'      => 'POST',

    // User created UTC timestamp ('Y-m-d H:i:s' string)
    'userCreated'     => ''
);


```

--------------------------------

### event-data.js

Source: https://docs.tirreno.com/api-integration.html

JavaScript code example for constructing an object with event details, including required and optional fields.

```javascript
const data = {

    /////////// Required fields ///////////

    // Unique value that allows identification of a user. Ex: alice54 (string)
    userName: 'tirreno42',

    // User email (string)
    emailAddress: 'team@tirreno.com',

    // User IP address (string)
    ipAddress: '217.70.184.38',

    // URL path of visited page (string)
    url: '/home/account?ref=1',

    // User-agent of user request (string)
    userAgent: 'Mozilla/5.0 (Windows NT 6.1; rv:109.0) Gecko/20100101 Firefox/115.0 ',

    // Event UTC timestamp ('Y-m-d H:i:s.v' string)
    eventTime: '2024-06-06 14:20:01.283',

    /////////// Optional fields ///////////

    // User first name (string)
    firstName: 'John',

    // User last name (string)
    lastName: 'Fox',

    // User full name (string)
    fullName: '',

    // Title of visited page (string)
    pageTitle: 'Home page',

    // User phone number (string)
    phoneNumber: '+41000000000',

    // Referer of visited page (string)
    httpReferer: 'https://tirreno.com/signup',

    // Status code for page visit (string)
    httpCode: '200',

    // User browser language (string)
    browserLanguage: 'en-GB,en;q=0.9',

    // Type of user action from event types list (string)
    eventType: 'account_registration',

    // Type of HTTP request from list (string)
    httpMethod: 'POST',


```

--------------------------------

### Send Event (Ruby)

Source: https://docs.tirreno.com/api-integration.html

Example of sending an event using Ruby with the Net::HTTP library. It includes required and optional fields for event tracking.

```ruby
require 'net/http'
require 'uri'
require 'cgi'

url = URI.parse('//localhost/tirreno/sensor')
headers = {
    'Content-Type' => 'application/x-www-form-urlencoded',
    'Api-Key' => '<Tracking ID>',
}
# Replace each key value with actual info
data = {

    ########### Required fields ###########

    # Unique value that allows identification of a user. Ex: alice54 (string)
    'userName': '',

    # User email (string)
    'emailAddress': '',

    # User IP address (string)
    'ipAddress': '',

    # URL path of visited page (string)
    'url': '',

    # User-agent of user request (string)
    'userAgent': '',

    # Event UTC timestamp ('Y-m-d H:i:s.v' string)
    'eventTime': '',

    ########### Optional fields ###########

    # User first name (string)
    'firstName': '',

    # User last name (string)
    'lastName': '',

    # User full name (string)
    'fullName': '',

    # Title of visited page (string)
    'pageTitle': '',

    # User phone number (string)
    'phoneNumber': '',

    # Referer of visited page (string)
    'httpReferer': '',

    # Status code for page visit (string)
    'httpCode': '',

    # User browser language (string)
    'browserLanguage': '',

    # Type of user action from event types list (string)
    'eventType': '',

    # Type of HTTP request from list (string)
    'httpMethod': '',

    # User created UTC timestamp ('Y-m-d H:i:s' string)
    'userCreated': '',

    # Payload, must have `page_search` or `account_email_change` event type (array)
    'payload': [],

    # Field history, must have `field_edit` event type (array)
    'fieldHistory': [
        {
            'field_name': '',   # Name of the field
            'field_id': '',     # ID of the field
            'new_value': '',    # Field new value
            'old_value': '',    # Field old value
            'parent_id': ''     # ID of the field parent
        }
    ]
}

http = Net::HTTP.new(url.host, url.port)

```

--------------------------------

### Page Search Event Payload

Source: https://docs.tirreno.com/api-integration.html

Example payload structure for the 'page_search' event type.

```json
{
    "eventType": "page_search",
    "payload": {
        "value": "Great Br",
        "field_id": 179280,
        "field_name": "Country"
    }
}
```

--------------------------------

### Blacklist API response

Source: https://docs.tirreno.com/api-integration.html

This snippet shows an example of a successful HTTP 200 response from the /api/v1/blacklist/search endpoint.

```http
1HTTP/2 200
2Content-Type: application/json
3
4{
5  "value": "tirreno42",
6  "blacklisted": false
7}
```

--------------------------------

### Send Event (Node.js)

Source: https://docs.tirreno.com/api-integration.html

Example of sending an event using Node.js with the axios library. It includes required and optional fields for event tracking.

```javascript
const axios = require('axios');
const qs = require('qs');       // You might need to install 'qs'

const url = '//localhost/tirreno/sensor';
const headers = {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Api-Key': '<Tracking ID>',
};

// Replace each key value with actual info
const data = {

    /////////// Required fields ///////////

    // Unique value that allows identification of a user. Ex: alice54 (string)
    userName: '',

    // User email (string)
    emailAddress: '',

    // User IP address (string)
    ipAddress: '',

    // URL path of visited page (string)
    url: '',

    // User-agent of user request (string)
    userAgent: '',

    // Event UTC timestamp ('Y-m-d H:i:s.v' string)
    eventTime: '',

    /////////// Optional fields ///////////

    // User first name (string)
    firstName: '',

    // User last name (string)
    lastName: '',

    // User full name (string)
    fullName: '',

    // Title of visited page (string)
    pageTitle: '',

    // User phone number (string)
    phoneNumber: '',

    // Referer of visited page (string)
    httpReferer: '',

    // Status code for page visit (string)
    httpCode: '',

    // User browser language (string)
    browserLanguage: '',

    // Type of user action from event types list (string)
    eventType: '',

    // Type of HTTP request from list (string)
    httpMethod: '',

    // User created UTC timestamp ('Y-m-d H:i:s' string)
    userCreated: '',

    // Payload, must have `page_search` or `account_email_change` event type (array)
    payload: [],

    // Field history, must have `field_edit` event type (array)
    fieldHistory: [
        {
            field_name: '',     // Name of the field
            field_id: '',       // ID of the field
            new_value: '',      // Field new value
            old_value: '',      // Field old value
            parent_id: ''       // ID of the field parent
        }
    ],
};

axios.post(url, qs.stringify(data), { headers: headers });

```

--------------------------------

### Account Email Change Event Payload

Source: https://docs.tirreno.com/api-integration.html

Example payload structure for the 'account_email_change' event type.

```json
{
    "eventType": "account_email_change",
    "payload": {
        "new_value": "team@tirreno.com",
        "old_value": "ping@tirreno.com"
    }
}
```

--------------------------------

### Blacklist API request

Source: https://docs.tirreno.com/api-integration.html

This snippet shows an example of a POST request to the /api/v1/blacklist/search endpoint with a JSON payload.

```http
1POST /api/v1/blacklist/search HTTP/2
2Host: localhost:8585
3Content-Type: application/json
4Api-Key: <Tracking ID>
5
6{
7    "value": "tirreno42"
8}
```

--------------------------------

### Field Edit Event Payload

Source: https://docs.tirreno.com/api-integration.html

Example payload structure for the 'field_edit' event type, demonstrating multiple field edits.

```json
{
    "eventType": "field_edit",
    "payload": [
        {
            "new_value": "Paris",
            "old_value": "London",
            "field_id": 179283,
            "field_name": "User city"
        },
        {
            "new_value": "France",
            "old_value": "Great Britain",
            "field_id": 943577,
            "field_name": "User country"
        }
    ]
}
```

--------------------------------

### Clone OpenC3/cosmos-project repository

Source: https://docs.tirreno.com/tutorials/openc3-security-layer.html

This command clones the OpenC3/cosmos-project repository.

```bash
git clone https://github.com/OpenC3/cosmos-project
```

--------------------------------

### Clone OpenC3/cosmos repository

Source: https://docs.tirreno.com/tutorials/openc3-security-layer.html

This command clones the OpenC3/cosmos repository to your local machine.

```bash
git clone https://github.com/OpenC3/cosmos
```

--------------------------------

### Nginx Reverse Proxy Configuration

Source: https://docs.tirreno.com/tutorials/nginx-reverse-proxy.html

This is a complete Nginx configuration file that sets up a reverse proxy. It includes SSL termination, HTTP/2 support, WebSocket proxying, and a mirror location for sending request details to a Tirreno tracking endpoint.

```nginx
server {
    listen 80;
    server_name app.yourcompany.com;  # Replace with your app host

    return 301 https://$server_name$request_uri;
}

map $time_iso8601 $formatted_datetime {
    "~^(?<date>\d{4}-\d{2}-\d{2})T(?<time>\d{2}:\d{2}:\d{2})" "$date $time";
}

map $msec $milliseconds {
    '~^\d+\.(?<millis>\d+)$' $millis;
}

map $formatted_datetime $php_timestamp {
    "~^(.+)$" "$formatted_datetime.$milliseconds";
}

server {
    listen 443 ssl http2;
    server_name app.yourcompany.com; # Replace with your app host

    ssl_certificate /etc/letsencrypt/live/app.yourcompany.com/fullchain.pem; # Replace with your certificate path
    ssl_certificate_key /etc/letsencrypt/live/app.yourcompany.com/privkey.pem; # Replace with your certificate path
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;

    add_header Strict-Transport-Security "max-age=63072000" always;

    location / {
        proxy_pass http://backend; # Replace with IP and port if you use container deployment
        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Frame-Options SAMEORIGIN;

        # Websocket support
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        mirror /mirror;
    }

    location = /mirror {
        internal;

        set $args "";
        set $new_query_string "userName=$APPUSERID&ipAddress=$remote_addr&userAgent=$http_user_agent&httpReferer=$http_referer&httpMethod=$request_method&url=$request_uri&eventTime=$php_timestamp&browserLanguage=$http_accept_language";

        proxy_pass https://tirreno.yourcompany.com; # Replace with your tirreno URL
        proxy_method POST;
        rewrite ^ /sensor/ break;

        proxy_set_body $new_query_string;
        proxy_set_header Content-Type "application/x-www-form-urlencoded";
        proxy_set_header Api-Key "XXXXXXXXXXXXXXXXXXXXXXXXX"; # Replace with your tirreno tracking code
        proxy_pass_request_body off;
    }
}
```

--------------------------------

### Full updated config.ru

Source: https://docs.tirreno.com/tutorials/openc3-security-layer.html

This is the complete updated config.ru file after adding the CollectMiddleware.

```ruby
1# This file is used by Rack-based servers to start the application. 
2
3require_relative 'config/environment'
4require 'prometheus/middleware/collector'
5require 'prometheus/middleware/exporter'
6require_relative 'lib/collect'
7
8use CollectMiddleware
9use Prometheus::Middleware::Collector
10use Prometheus::Middleware::Exporter, {:path => '/openc3-api/metrics'}
11
12run Rails.application
13Rails.application.load_server
```

--------------------------------

### Build custom Docker image

Source: https://docs.tirreno.com/tutorials/openc3-security-layer.html

This command builds a custom Docker image for the openc3-cosmos-cmd-tlm-api container.

```bash
docker build -t tirreno-custom/openc3-cosmos-cmd-tlm-api:latest .
```

--------------------------------

### Add CollectMiddleware to config.ru

Source: https://docs.tirreno.com/tutorials/openc3-security-layer.html

These lines add the CollectMiddleware to the Rack configuration file.

```ruby
1require_relative 'lib/collect'
2
3use CollectMiddleware
```

--------------------------------

### Send Event (PHP)

Source: https://docs.tirreno.com/api-integration.html

This PHP code snippet demonstrates how to send event data to the Tirreno API. It includes setting the API key, defining event data (both required and optional fields), building the query string, and making a cURL request.

```php
<?php

// Set the API key for sending events
$apiKey = '<Tracking ID>';

// Replace each key value with actual info
$data = array(

    /////////// Required fields ///////////

    // Unique value that allows identification of a user. Ex: alice54 (string)
    'userName'        => '',

    // User email (string)
    'emailAddress'    => '',

    // User IP address (string)
    'ipAddress'       => '',

    // URL path of visited page (string)
    'url'             => '',

    // User-agent of user request (string)
    'userAgent'       => '',

    // Event UTC timestamp ('Y-m-d H:i:s.v' string)
    'eventTime'       => '',

    /////////// Optional fields ///////////

    // User first name (string)
    'firstName'       => '',

    // User last name (string)
    'lastName'        => '',

    // User full name (string)
    'fullName'        => '',

    // Title of visited page (string)
    'pageTitle'       => '',

    // User phone number (string)
    'phoneNumber'     => '',

    // Referer of visited page (string)
    'httpReferer'     => '',

    // Status code for page visit (string)
    'httpCode'        => '',

    // User browser language (string)
    'browserLanguage' => '',

    // Type of user action from event types list (string)
    'eventType'       => '',

    // Type of HTTP request from list (string)
    'httpMethod'      => '',

    // User created UTC timestamp ('Y-m-d H:i:s' string)
    'userCreated'     => '',

    // Payload, must have `page_search` or `account_email_change` event type (array)
    'payload'         => [],

    // Field history, must have `field_edit` event type (array)
    'fieldHistory'    => [
        [
            'field_name'    => '',      // Name of the field
            'field_id'      => '',      // ID of the field
            'new_value'     => '',      // Field new value
            'old_value'     => '',      // Field old value
            'parent_id'     => ''       // ID of the field parent
        ]
    ],
);

// Convert the event data to a query string
$dataString = http_build_query($data);

// Set up apiKey
$headers = [
    'Api-Key: ' . $apiKey,
    'Content-Type: application/x-www-form-urlencoded',
];

// Create a curl request to send the event data to the API

$ch = curl_init();
// CURLOPT_URL value is sensor URL
curl_setopt_array($ch, array(
    CURLOPT_URL            => 'http://localhost/tirreno/sensor/',
    CURLOPT_POST           => true,
    CURLOPT_POSTFIELDS     => $dataString,
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_SSL_VERIFYPEER => false,
    CURLOPT_TIMEOUT_MS     => 1000,
    CURLOPT_HTTPHEADER     => $headers
));

// Send the curl request and capture the response
$response = curl_exec($ch);

// Close the curl request
curl_close($ch);

```

--------------------------------

### Send Event (Python)

Source: https://docs.tirreno.com/api-integration.html

This Python code snippet shows how to send event data to the Tirreno API using the requests library. It defines the API endpoint, headers (including the API key), and the event data payload.

```python
import requests
from urllib.parse import urlencode


url = '//localhost/tirreno/sensor/'
headers = {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Api-Key': '<Tracking ID>',
}

# Replace each key value with actual info
data = {

    ########### Required fields ###########

    # Unique value that allows identification of a user. Ex: alice54 (string)
    'userName': '',

    # User email (string)
    'emailAddress': '',

    # User IP address (string)
    'ipAddress': '',

    # URL path of visited page (string)
    'url': '',

    # User-agent of user request (string)
    'userAgent': '',

    # Event UTC timestamp ('Y-m-d H:i:s.v' string)
    'eventTime': '',

    ########### Optional fields ###########

    # User first name (string)
    'firstName': '',

    # User last name (string)
    'lastName': '',

    # User full name (string)
    'fullName': '',

    # Title of visited page (string)
    'pageTitle': '',

    # User phone number (string)
    'phoneNumber': '',

    # Referer of visited page (string)
    'httpReferer': '',

    # Status code for page visit (string)
    'httpCode': '',

    # User browser language (string)
    'browserLanguage': '',

    # Type of user action from event types list (string)
    'eventType': '',

    # Type of HTTP request from list (string)
    'httpMethod': '',

    # User created UTC timestamp ('Y-m-d H:i:s' string)
    'userCreated': '',

    # Payload, must have `page_search` or `account_email_change` event type (array)
    'payload': [],


```

--------------------------------

### Nginx configuration for Mattermost integration

Source: https://docs.tirreno.com/tutorials/mattermost-user-security-analytics.html

This Nginx configuration block captures user request details from Mattermost and forwards them to the tirreno API.

```nginx
location = /mirror {
    internal;

    set $args "";
    set $new_query_string "userName=$cookie_MMUSERID&ipAddress=$remote_addr&userAgent=$http_user_agent&httpReferer=$http_referer&httpMethod=$request_method&url=$request_uri&eventTime=$php_timestamp&browserLanguage=$http_accept_language";

    proxy_pass https://tirreno.yourcompany.com; # Replace with your tirreno URL
    proxy_method POST;
    rewrite ^ /sensor/ break;

    proxy_set_body $new_query_string;
    proxy_set_header Content-Type "application/x-www-form-urlencoded";
    proxy_set_header Api-Key "XXXXXXXXXXXXXXXXXXXXXXXXX"; # Replace with your tirreno tracking code
    proxy_pass_request_body off;
}
```

--------------------------------

### Nginx Configuration for Mattermost and tirreno

Source: https://docs.tirreno.com/tutorials/mattermost-user-security-analytics.html

This Nginx configuration sets up a server to proxy requests to Mattermost and mirror user activity to tirreno for security analytics.

```nginx
server {
    listen 80;
    server_name mattermost.yourcompany.com;  # Replace with Mattermost host

    return 301 https://$server_name$request_uri;
}

map $time_iso8601 $formatted_datetime {
    "~^(?<date>\d{4}-\d{2}-\d{2})T(?<time>\d{2}:\d{2}:\d{2})" "$date $time";
}

map $msec $milliseconds {
    '~^\d+\.(?<millis>\d+)$' $millis;
}

map $formatted_datetime $php_timestamp {
    "~^(.+)$" "$formatted_datetime.$milliseconds";
}

server {
    listen 443 ssl http2;
    server_name mattermost.yourcompany.com; # Replace with Mattermost host

    ssl_certificate /etc/letsencrypt/live/mattermost.yourcompany.com/fullchain.pem; # Replace with your certificate path
    ssl_certificate_key /etc/letsencrypt/live/mattermost.yourcompany.com/privkey.pem; # Replace with your certificate path
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;

    add_header Strict-Transport-Security "max-age=63072000" always;

    location / {
        proxy_pass http://backend; # Replace with IP and port if you use container deployment
        proxy_http_version 1.1;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Frame-Options SAMEORIGIN;

        # Websocket support
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        mirror /mirror;
    }

    location = /mirror {
        internal;

        set $args "";
        set $new_query_string "userName=$cookie_MMUSERID&ipAddress=$remote_addr&userAgent=$http_user_agent&httpReferer=$http_referer&httpMethod=$request_method&url=$request_uri&eventTime=$php_timestamp&browserLanguage=$http_accept_language";

        proxy_pass https://tirreno.yourcompany.com; # Replace with your tirreno URL
        proxy_method POST;
        rewrite ^ /sensor/ break;

        proxy_set_body $new_query_string;
        proxy_set_header Content-Type "application/x-www-form-urlencoded";
        proxy_set_header Api-Key "XXXXXXXXXXXXXXXXXXXXXXXXX"; # Replace with your tirreno tracking code
        proxy_pass_request_body off;
    }
}
```

--------------------------------

### Nginx configuration for tirreno integration

Source: https://docs.tirreno.com/tutorials/nginx-reverse-proxy.html

This Nginx configuration block enables integration with tirreno by transmitting original target app request information to the tirreno API.

```nginx
location = /mirror {
    internal;

    set $args "";
    set $new_query_string "userName=$APPUSERID&ipAddress=$remote_addr&userAgent=$http_user_agent&httpReferer=$http_referer&httpMethod=$request_method&url=$request_uri&eventTime=$php_timestamp&browserLanguage=$http_accept_language";

    proxy_pass https://tirreno.yourcompany.com; # Replace with your tirreno URL
    proxy_method POST;
    rewrite ^ /sensor/ break;

    proxy_set_body $new_query_string;
    proxy_set_header Content-Type "application/x-www-form-urlencoded";
    proxy_set_header Api-Key "XXXXXXXXXXXXXXXXXXXXXXXXX"; # Replace with your tirreno tracking code
    proxy_pass_request_body off;
}

```

--------------------------------

### CollectMiddleware Ruby code

Source: https://docs.tirreno.com/tutorials/openc3-security-layer.html

This Ruby code defines the CollectMiddleware class, which intercepts requests and sends audit information to the tirreno API.

```ruby
1require 'uri'
2require 'net/http'
3require 'json'
4
5class CollectMiddleware
6  def initialize(app)
7    @app = app
8  end
9
10  def call(env)
11    req = Rack::Request.new(env)
12
13    body = req.body.read rescue ''
14    req.body.rewind if req.body.respond_to?(:rewind)
15    rpc = JSON.parse(body, allow_nan: true) rescue {}
16
17    user                = env['HTTP_AUTHORIZATION'] || 'anonymus'
18    event_time          = Time.now.strftime("%Y-%m-%d %H:%M:%S.%L")
19    client_ip           = req.ip
20    event_type_local    = rpc['method'] || ''
21    http_method         = req.request_method
22    user_agent          = env['HTTP_USER_AGENT'] || req.user_agent
23    resource_path       = req.fullpath
24    accept_lang         = env['HTTP_ACCEPT_LANGUAGE'] || req.accept_language
25    event_type          = 'page_view'
26
27    status, headers, response = @app.call(env)
28
29    form = URI.encode_www_form(
30      userName:           user,
31      eventTime:          event_time,
32      ipAddress:          client_ip,
33      httpCode:           status,
34      httpMethod:         http_method,
35      eventType:          event_type,
36      userAgent:          user_agent,
37      url:                resource_path,
38      browserLanguage:    accept_lang,
39    )
40
41    uri  = URI.parse('http://localhost/tirreno/sensor/')
42    http = Net::HTTP.new(uri.host, uri.port)
43    http.use_ssl = (uri.scheme == 'https')
44    headers = {
45      'Content-Type'  => 'application/x-www-form-urlencoded',
46      'Api-Key'       => 'XXXXXXXXXXXXXXXXXXXXXXXXX',
47    }
48    begin
49      http.post(uri.path, form, headers)
50      Rails.logger.info("Audit sent: #{resp.code} #{resp.body}")
51    rescue => e
52      Rails.logger.error("Audit failed: #{e.class.name} #{e.message}")
53    end
54
55    [status, headers, response]
56  end
57end
```
Tokens:
Raw