Contrast Security Agent in Java

Introduction to Contrast Security

Contrast Security provides runtime application self-protection (RASP) and interactive application security testing (IAST) capabilities through its Java agent. The agent instruments application code to provide real-time security protection and vulnerability detection without requiring code changes.

Contrast Agent Architecture
Agent Installation & Configuration
Vulnerability Detection
Attack Protection
Custom Security Rules
Integration with Applications
Monitoring & Management

Contrast Agent Architecture

Core Components

package com.contrast.security.agent;
public class ContrastAgentArchitecture {
/*
* Contrast Agent Components:
* 
* 1. Class Transformer - Instruments bytecode at class loading
* 2. Security Sensor - Monitors security-sensitive operations
* 3. Policy Engine - Applies security policies
* 4. Event Collector - Gathers security events
* 5. Communication Module - Sends data to Contrast Platform
* 6. Configuration Manager - Manages agent settings
*/
}

Agent Installation & Configuration

Maven Dependency Setup

<!-- Contrast Security Agent -->
<dependency>
<groupId>com.contrastsecurity</groupId>
<artifactId>contrast-agent</artifactId>
<version>4.7.0</version>
</dependency>
<!-- Contrast SDK for programmatic integration -->
<dependency>
<groupId>com.contrastsecurity</groupId>
<artifactId>contrast-sdk-java</artifactId>
<version>2.7</version>
</dependency>

Agent Configuration

# contrast.properties - Main configuration file
# Contrast Platform Connection
contrast.server=
contrast.api.key=
contrast.service.key=
contrast.username=
# Application Configuration
contrast.application.name=MyEnterpriseApp
contrast.application.version=1.0.0
contrast.application.tags=production,financial
# Agent Behavior
contrast.agent.java.standalone_app_name=MyEnterpriseApp
contrast.agent.logger.stdout=true
contrast.agent.logger.level=INFO
# Security Configuration
contrast.protection.enable=true
contrast.protection.sql.injection=true
contrast.protection.command.injection=true
contrast.protection.path-traversal=true
contrast.protection.xss=true
contrast.protection.xxe=true
# Assessment Configuration
contrast.assess.enable=true
contrast.assess.vulnerabilities.enable=true
contrast.assess.libraries.enable=true
# Performance Configuration
contrast.agent.perf.enable=true
contrast.agent.perf.session_analysis=true
# Advanced Configuration
contrast.agent.instrumentation.include=com.mycompany.**
contrast.agent.instrumentation.exclude=com.mycompany.internal.**
contrast.agent.session_metadata.enable=true

Programmatic Configuration

package com.contrast.security.config;
import com.contrastsecurity.agents.contrast_agent;
import com.contrastsecurity.config.AgentConfig;
import com.contrastsecurity.config.SecurityConfig;
import java.util.Properties;
public class ContrastAgentConfigurator {
public static void configureAgent() {
Properties props = new Properties();
// Connection settings
props.setProperty("contrast.server", "https://app.contrastsecurity.com");
props.setProperty("contrast.api.key", "your-api-key");
props.setProperty("contrast.service.key", "your-service-key");
props.setProperty("contrast.username", "your-username");
// Application settings
props.setProperty("contrast.application.name", "EnterpriseWebApp");
props.setProperty("contrast.application.version", "2.1.0");
props.setProperty("contrast.application.group", "Financial Services");
// Security settings
props.setProperty("contrast.protection.enable", "true");
props.setProperty("contrast.assess.enable", "true");
props.setProperty("contrast.agent.auto_analysis", "true");
// Initialize agent with configuration
try {
contrast_agent.initialize(props);
System.out.println("Contrast Agent initialized successfully");
} catch (Exception e) {
System.err.println("Failed to initialize Contrast Agent: " + e.getMessage());
}
}
public static AgentConfig createAdvancedConfig() {
return AgentConfig.builder()
.serverUrl("https://app.contrastsecurity.com")
.apiKey("your-api-key")
.serviceKey("your-service-key")
.userName("agent-user")
.applicationName("Microservices-Platform")
.applicationVersion("3.0.0")
.applicationTags("production,api,rest")
.enableProtection(true)
.enableAssessment(true)
.enableLibraryAssessment(true)
.enablePerformanceMonitoring(true)
.logLevel("INFO")
.build();
}
}

Vulnerability Detection

SQL Injection Detection

package com.contrast.security.detection;
import java.sql.*;
import javax.sql.DataSource;
public class SQLInjectionDetection {
// Vulnerable method - will be detected by Contrast
public String vulnerableGetUser(String userId) throws SQLException {
String query = "SELECT * FROM users WHERE id = '" + userId + "'";
try (Connection conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/mydb");
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(query)) {
if (rs.next()) {
return rs.getString("username");
}
}
return null;
}
// Secure method - using prepared statements
public String secureGetUser(String userId) throws SQLException {
String query = "SELECT username FROM users WHERE id = ?";
try (Connection conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/mydb");
PreparedStatement stmt = conn.prepareStatement(query)) {
stmt.setString(1, userId);
try (ResultSet rs = stmt.executeQuery()) {
if (rs.next()) {
return rs.getString("username");
}
}
}
return null;
}
// JPA/Hibernate example
@PersistenceContext
private EntityManager entityManager;
// Vulnerable JPA
public User vulnerableJpaGetUser(String userId) {
String jpql = "SELECT u FROM User u WHERE u.id = '" + userId + "'";
TypedQuery<User> query = entityManager.createQuery(jpql, User.class);
return query.getSingleResult();
}
// Secure JPA
public User secureJpaGetUser(String userId) {
String jpql = "SELECT u FROM User u WHERE u.id = :userId";
TypedQuery<User> query = entityManager.createQuery(jpql, User.class);
query.setParameter("userId", userId);
return query.getSingleResult();
}
}

Command Injection Detection

package com.contrast.security.detection;
import java.io.*;
public class CommandInjectionDetection {
// Vulnerable command execution
public void vulnerableExecuteCommand(String filename) throws IOException {
String command = "ls -la " + filename;
Process process = Runtime.getRuntime().exec(command);
try (BufferedReader reader = new BufferedReader(
new InputStreamReader(process.getInputStream()))) {
String line;
while ((line = reader.readLine()) != null) {
System.out.println(line);
}
}
}
// Secure command execution with validation
public void secureExecuteCommand(String filename) throws IOException {
// Validate filename
if (!isValidFilename(filename)) {
throw new SecurityException("Invalid filename: " + filename);
}
// Use ProcessBuilder with command array
ProcessBuilder pb = new ProcessBuilder("ls", "-la", filename);
Process process = pb.start();
try (BufferedReader reader = new BufferedReader(
new InputStreamReader(process.getInputStream()))) {
String line;
while ((line = reader.readLine()) != null) {
System.out.println(line);
}
}
}
private boolean isValidFilename(String filename) {
// Simple validation - in production, use more robust validation
return filename != null && 
filename.matches("[a-zA-Z0-9._-]+") &&
!filename.contains("..") &&
!filename.contains("/") &&
!filename.contains("\\");
}
}

Path Traversal Detection

package com.contrast.security.detection;
import java.io.*;
import java.nio.file.*;
public class PathTraversalDetection {
// Vulnerable file access
public String vulnerableReadFile(String filename) throws IOException {
String basePath = "/var/www/files/";
String fullPath = basePath + filename;
return new String(Files.readAllBytes(Paths.get(fullPath)));
}
// Secure file access with path normalization and validation
public String secureReadFile(String filename) throws IOException {
String basePath = "/var/www/files/";
// Normalize path and check for traversal attempts
Path baseDir = Paths.get(basePath).normalize().toAbsolutePath();
Path requestedFile = baseDir.resolve(filename).normalize().toAbsolutePath();
// Ensure the resolved path is still within the base directory
if (!requestedFile.startsWith(baseDir)) {
throw new SecurityException("Path traversal attempt detected: " + filename);
}
// Validate file exists and is readable
if (!Files.exists(requestedFile) || !Files.isReadable(requestedFile)) {
throw new FileNotFoundException("File not found or not readable: " + filename);
}
return new String(Files.readAllBytes(requestedFile));
}
}

Attack Protection

Real-time Attack Blocking

package com.contrast.security.protection;
import com.contrastsecurity.SecurityEvent;
import com.contrastsecurity.SecurityResponse;
import com.contrastsecurity.agents.runtime.ProtectionEngine;
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.IOException;
public class SecurityFilter implements Filter {
private ProtectionEngine protectionEngine;
@Override
public void init(FilterConfig filterConfig) throws ServletException {
this.protectionEngine = ProtectionEngine.getInstance();
}
@Override
public void doFilter(ServletRequest request, ServletResponse response, 
FilterChain chain) throws IOException, ServletException {
HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpResponse = (HttpServletResponse) response;
// Check for attacks before processing the request
SecurityResponse securityResponse = protectionEngine.analyzeRequest(httpRequest);
if (securityResponse.isBlocked()) {
// Block the request and log the security event
handleBlockedRequest(httpResponse, securityResponse);
return;
}
// Continue with request processing
chain.doFilter(request, response);
// Analyze response for potential data leakage
protectionEngine.analyzeResponse(httpRequest, httpResponse);
}
private void handleBlockedRequest(HttpServletResponse response, 
SecurityResponse securityResponse) throws IOException {
response.setStatus(403);
response.setContentType("application/json");
String errorJson = String.format(
"{\"error\": \"Request blocked\", \"reason\": \"%s\", \"rule\": \"%s\"}",
securityResponse.getReason(),
securityResponse.getRuleName()
);
response.getWriter().write(errorJson);
// Log the security event
SecurityEvent event = securityResponse.getSecurityEvent();
System.err.println("Security block: " + event.toString());
}
@Override
public void destroy() {
// Cleanup resources
}
}

Custom Security Headers

package com.contrast.security.protection;
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.IOException;
public class SecurityHeadersFilter implements Filter {
@Override
public void doFilter(ServletRequest request, ServletResponse response, 
FilterChain chain) throws IOException, ServletException {
HttpServletResponse httpResponse = (HttpServletResponse) response;
// Add security headers
httpResponse.setHeader("X-Content-Type-Options", "nosniff");
httpResponse.setHeader("X-Frame-Options", "DENY");
httpResponse.setHeader("X-XSS-Protection", "1; mode=block");
httpResponse.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains");
httpResponse.setHeader("Content-Security-Policy", 
"default-src 'self'; script-src 'self' 'unsafe-inline'");
chain.doFilter(request, response);
}
}

Custom Security Rules

Custom Vulnerability Detection

package com.contrast.security.rules;
import com.contrastsecurity.CustomRule;
import com.contrastsecurity.SecurityEvent;
import com.contrastsecurity.agents.runtime.RuleEngine;
import com.contrastsecurity.agents.runtime.RuleContext;
public class CustomSecurityRules {
// Custom rule for detecting specific business logic vulnerabilities
@CustomRule(
id = "CUSTOM-001",
name = "Sensitive Data Exposure in Logs",
description = "Detects logging of sensitive information",
category = "CUSTOM",
severity = "MEDIUM"
)
public static class SensitiveDataLoggingRule implements RuleEngine {
private static final String[] SENSITIVE_PATTERNS = {
"password", "credit_card", "ssn", "api_key", "secret"
};
@Override
public SecurityEvent evaluate(RuleContext context) {
Object[] parameters = context.getParameters();
for (Object param : parameters) {
if (param instanceof String) {
String paramValue = (String) param;
for (String pattern : SENSITIVE_PATTERNS) {
if (paramValue.toLowerCase().contains(pattern)) {
return SecurityEvent.builder()
.ruleId("CUSTOM-001")
.description("Potential sensitive data in logs: " + pattern)
.parameterValue(paramValue)
.stackTrace(Thread.currentThread().getStackTrace())
.build();
}
}
}
}
return null; // No vulnerability detected
}
}
// Custom rule for API rate limiting
@CustomRule(
id = "CUSTOM-002",
name = "API Rate Limit Violation",
description = "Detects potential API abuse through rate limiting",
category = "CUSTOM",
severity = "LOW"
)
public static class ApiRateLimitRule implements RuleEngine {
private final Map<String, RequestCounter> requestCounters = new ConcurrentHashMap<>();
private static final int MAX_REQUESTS_PER_MINUTE = 100;
@Override
public SecurityEvent evaluate(RuleContext context) {
String clientIp = context.getClientIp();
String endpoint = context.getEndpoint();
String key = clientIp + ":" + endpoint;
RequestCounter counter = requestCounters.computeIfAbsent(
key, k -> new RequestCounter());
if (counter.incrementAndCheck(MAX_REQUESTS_PER_MINUTE)) {
return SecurityEvent.builder()
.ruleId("CUSTOM-002")
.description("API rate limit exceeded for client: " + clientIp)
.parameterValue("Endpoint: " + endpoint + ", Count: " + counter.getCount())
.build();
}
return null;
}
private static class RequestCounter {
private final AtomicInteger count = new AtomicInteger(0);
private long lastResetTime = System.currentTimeMillis();
public boolean incrementAndCheck(int maxRequests) {
synchronized (this) {
long currentTime = System.currentTimeMillis();
// Reset counter every minute
if (currentTime - lastResetTime > 60000) {
count.set(0);
lastResetTime = currentTime;
}
int currentCount = count.incrementAndGet();
return currentCount > maxRequests;
}
}
public int getCount() {
return count.get();
}
}
}
}

Custom Data Classification

package com.contrast.security.rules;
import com.contrastsecurity.DataClassifier;
import com.contrastsecurity.SensitiveData;
public class CustomDataClassifier implements DataClassifier {
@Override
public SensitiveData classify(String data) {
if (data == null) {
return SensitiveData.NONE;
}
// Check for credit card numbers
if (data.matches(".*\\b(?:\\d[ -]*?){13,16}\\b.*")) {
return SensitiveData.CREDIT_CARD;
}
// Check for social security numbers
if (data.matches(".*\\b\\d{3}-\\d{2}-\\d{4}\\b.*")) {
return SensitiveData.SSN;
}
// Check for API keys
if (data.matches(".*[a-zA-Z0-9]{32,64}.*")) {
return SensitiveData.API_KEY;
}
// Check for email addresses
if (data.matches(".*\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b.*")) {
return SensitiveData.EMAIL;
}
// Custom business-specific sensitive data
if (data.contains("employee_id") || data.contains("salary") || 
data.contains("confidential")) {
return SensitiveData.CUSTOM;
}
return SensitiveData.NONE;
}
}

Integration with Applications

Spring Boot Integration

package com.contrast.security.integration;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import javax.servlet.*;
import java.util.Properties;
@SpringBootApplication
public class SecureSpringBootApplication {
public static void main(String[] args) {
// Initialize Contrast Agent before Spring Boot starts
initializeContrastAgent();
SpringApplication.run(SecureSpringBootApplication.class, args);
}
private static void initializeContrastAgent() {
try {
Properties props = new Properties();
props.setProperty("contrast.application.name", "SpringBoot-Enterprise-App");
props.setProperty("contrast.application.version", "2.0.0");
props.setProperty("contrast.protection.enable", "true");
props.setProperty("contrast.assess.enable", "true");
com.contrastsecurity.agents.contrast_agent.initialize(props);
System.out.println("Contrast Agent initialized for Spring Boot application");
} catch (Exception e) {
System.err.println("Failed to initialize Contrast Agent: " + e.getMessage());
}
}
@Configuration
public static class SecurityConfig implements WebMvcConfigurer {
@Bean
public Filter contrastSecurityFilter() {
return new ContrastSecurityFilter();
}
@Bean
public Filter securityHeadersFilter() {
return new SecurityHeadersFilter();
}
@Override
public void addInterceptors(InterceptorRegistry registry) {
registry.addInterceptor(new ContrastSecurityInterceptor());
}
}
}

REST API Security Integration

package com.contrast.security.integration;
import com.contrastsecurity.SecurityMonitor;
import com.contrastsecurity.agents.runtime.ProtectionEngine;
import org.springframework.web.bind.annotation.*;
import javax.servlet.http.HttpServletRequest;
import java.util.Map;
@RestController
@RequestMapping("/api")
public class SecureApiController {
private final ProtectionEngine protectionEngine;
private final SecurityMonitor securityMonitor;
public SecureApiController() {
this.protectionEngine = ProtectionEngine.getInstance();
this.securityMonitor = SecurityMonitor.getInstance();
}
@PostMapping("/users")
public User createUser(@RequestBody User user, HttpServletRequest request) {
// Validate input against security policies
if (!isValidUserInput(user)) {
throw new SecurityException("Invalid user input detected");
}
// Monitor for security events during processing
securityMonitor.startMonitoring("user-creation");
try {
// Business logic
User createdUser = userService.createUser(user);
// Log security event for successful creation
securityMonitor.logEvent("USER_CREATED", 
Map.of("userId", createdUser.getId(), "username", createdUser.getUsername()));
return createdUser;
} catch (Exception e) {
// Log security event for failed creation attempt
securityMonitor.logEvent("USER_CREATION_FAILED", 
Map.of("error", e.getMessage(), "username", user.getUsername()));
throw e;
} finally {
securityMonitor.stopMonitoring("user-creation");
}
}
@GetMapping("/sensitive-data/{id}")
public SensitiveData getSensitiveData(@PathVariable String id, 
HttpServletRequest request) {
// Check if request should be blocked
if (protectionEngine.shouldBlockRequest(request)) {
throw new SecurityException("Request blocked by security policy");
}
// Monitor data access
securityMonitor.startMonitoring("sensitive-data-access");
try {
SensitiveData data = dataService.getSensitiveData(id);
// Classify and protect sensitive data
return maskSensitiveData(data);
} finally {
securityMonitor.stopMonitoring("sensitive-data-access");
}
}
private boolean isValidUserInput(User user) {
// Input validation logic
return user != null && 
user.getUsername() != null &&
user.getUsername().matches("[a-zA-Z0-9]{3,20}") &&
user.getEmail() != null &&
user.getEmail().contains("@");
}
private SensitiveData maskSensitiveData(SensitiveData data) {
// Mask sensitive fields before returning
if (data.getSsn() != null) {
data.setSsn(maskString(data.getSsn()));
}
if (data.getCreditCard() != null) {
data.setCreditCard(maskString(data.getCreditCard()));
}
return data;
}
private String maskString(String value) {
if (value == null || value.length() <= 4) {
return "****";
}
return "****" + value.substring(value.length() - 4);
}
}

Monitoring & Management

Security Event Monitoring

package com.contrast.security.monitoring;
import com.contrastsecurity.SecurityEvent;
import com.contrastsecurity.SecurityEventListener;
import com.contrastsecurity.agents.runtime.EventCollector;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.atomic.AtomicLong;
public class SecurityEventMonitor implements SecurityEventListener {
private final EventCollector eventCollector;
private final ConcurrentHashMap<String, AtomicLong> eventCounts;
private final AtomicLong totalEvents;
public SecurityEventMonitor() {
this.eventCollector = EventCollector.getInstance();
this.eventCounts = new ConcurrentHashMap<>();
this.totalEvents = new AtomicLong(0);
// Register as event listener
eventCollector.registerListener(this);
}
@Override
public void onSecurityEvent(SecurityEvent event) {
String ruleId = event.getRuleId();
eventCounts.computeIfAbsent(ruleId, k -> new AtomicLong(0)).incrementAndGet();
totalEvents.incrementAndGet();
// Log event details
logSecurityEvent(event);
// Take action based on event severity
handleSecurityEvent(event);
}
private void logSecurityEvent(SecurityEvent event) {
System.err.printf(
"SECURITY EVENT: Rule=%s, Severity=%s, Description=%s, Timestamp=%s%n",
event.getRuleId(),
event.getSeverity(),
event.getDescription(),
event.getTimestamp()
);
// Log stack trace for debugging
if (event.getStackTrace() != null) {
System.err.println("Stack trace:");
for (StackTraceElement element : event.getStackTrace()) {
System.err.println("  " + element.toString());
}
}
}
private void handleSecurityEvent(SecurityEvent event) {
switch (event.getSeverity()) {
case "CRITICAL":
handleCriticalEvent(event);
break;
case "HIGH":
handleHighEvent(event);
break;
case "MEDIUM":
handleMediumEvent(event);
break;
case "LOW":
handleLowEvent(event);
break;
default:
// Ignore or log unknown severity
break;
}
}
private void handleCriticalEvent(SecurityEvent event) {
// Immediate action required
System.err.println("CRITICAL SECURITY EVENT - IMMEDIATE ACTION REQUIRED");
// Send alert to security team
sendSecurityAlert(event);
// Optionally block the request source
blockSourceIfNecessary(event);
}
private void handleHighEvent(SecurityEvent event) {
// High priority - log and alert
System.err.println("HIGH PRIORITY SECURITY EVENT DETECTED");
sendSecurityAlert(event);
}
private void handleMediumEvent(SecurityEvent event) {
// Medium priority - log for review
System.err.println("MEDIUM PRIORITY SECURITY EVENT DETECTED");
}
private void handleLowEvent(SecurityEvent event) {
// Low priority - log for informational purposes
System.err.println("LOW PRIORITY SECURITY EVENT DETECTED");
}
private void sendSecurityAlert(SecurityEvent event) {
// Implementation for sending alerts (email, Slack, PagerDuty, etc.)
// This would integrate with your alerting system
}
private void blockSourceIfNecessary(SecurityEvent event) {
// Implementation for blocking malicious sources
// This could involve updating firewall rules or application-level blocking
}
public SecurityMetrics getMetrics() {
return new SecurityMetrics(
totalEvents.get(),
new HashMap<>(eventCounts)
);
}
public static class SecurityMetrics {
private final long totalEvents;
private final Map<String, Long> eventsByRule;
public SecurityMetrics(long totalEvents, Map<String, Long> eventsByRule) {
this.totalEvents = totalEvents;
this.eventsByRule = eventsByRule;
}
// Getters
public long getTotalEvents() { return totalEvents; }
public Map<String, Long> getEventsByRule() { return eventsByRule; }
}
}

Performance Monitoring

package com.contrast.security.monitoring;
import com.contrastsecurity.agents.runtime.PerformanceMonitor;
import java.lang.management.ManagementFactory;
import java.lang.management.MemoryMXBean;
import java.lang.management.ThreadMXBean;
import java.util.concurrent.Executors;
import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.TimeUnit;
public class AgentPerformanceMonitor {
private final PerformanceMonitor performanceMonitor;
private final ScheduledExecutorService scheduler;
private final MemoryMXBean memoryBean;
private final ThreadMXBean threadBean;
public AgentPerformanceMonitor() {
this.performanceMonitor = PerformanceMonitor.getInstance();
this.scheduler = Executors.newScheduledThreadPool(1);
this.memoryBean = ManagementFactory.getMemoryMXBean();
this.threadBean = ManagementFactory.getThreadMXBean();
startMonitoring();
}
private void startMonitoring() {
// Schedule periodic performance checks
scheduler.scheduleAtFixedRate(this::checkPerformance, 0, 30, TimeUnit.SECONDS);
}
private void checkPerformance() {
try {
// Check memory usage
checkMemoryUsage();
// Check thread usage
checkThreadUsage();
// Check agent performance impact
checkAgentPerformance();
} catch (Exception e) {
System.err.println("Error in performance monitoring: " + e.getMessage());
}
}
private void checkMemoryUsage() {
long usedMemory = memoryBean.getHeapMemoryUsage().getUsed();
long maxMemory = memoryBean.getHeapMemoryUsage().getMax();
double memoryUsagePercent = (double) usedMemory / maxMemory * 100;
if (memoryUsagePercent > 80) {
System.err.printf("High memory usage: %.2f%%%n", memoryUsagePercent);
performanceMonitor.recordEvent("HIGH_MEMORY_USAGE", 
Map.of("usagePercent", String.valueOf(memoryUsagePercent)));
}
}
private void checkThreadUsage() {
int threadCount = threadBean.getThreadCount();
int peakThreadCount = threadBean.getPeakThreadCount();
if (threadCount > 100) { // Adjust threshold based on your application
System.err.printf("High thread count: %d (peak: %d)%n", threadCount, peakThreadCount);
performanceMonitor.recordEvent("HIGH_THREAD_COUNT",
Map.of("currentThreads", String.valueOf(threadCount),
"peakThreads", String.valueOf(peakThreadCount)));
}
}
private void checkAgentPerformance() {
// Monitor agent-specific performance metrics
long startTime = System.currentTimeMillis();
// Perform a quick agent operation to measure performance
performanceMonitor.sampleOperation();
long endTime = System.currentTimeMillis();
long duration = endTime - startTime;
if (duration > 100) { // 100ms threshold
System.err.printf("Slow agent operation: %d ms%n", duration);
performanceMonitor.recordEvent("SLOW_AGENT_OPERATION",
Map.of("durationMs", String.valueOf(duration)));
}
}
public void stop() {
scheduler.shutdown();
try {
if (!scheduler.awaitTermination(5, TimeUnit.SECONDS)) {
scheduler.shutdownNow();
}
} catch (InterruptedException e) {
scheduler.shutdownNow();
Thread.currentThread().interrupt();
}
}
}

Advanced Configuration & Management

Dynamic Configuration Management

package com.contrast.security.management;
import com.contrastsecurity.config.DynamicConfig;
import com.contrastsecurity.config.ConfigManager;
import java.util.concurrent.Executors;
import java.util.concurrent.ScheduledExecutorService;
import java.util.concurrent.TimeUnit;
public class DynamicConfigurationManager {
private final ConfigManager configManager;
private final ScheduledExecutorService configUpdater;
public DynamicConfigurationManager() {
this.configManager = ConfigManager.getInstance();
this.configUpdater = Executors.newScheduledThreadPool(1);
startConfigurationUpdates();
}
private void startConfigurationUpdates() {
// Check for configuration updates every 5 minutes
configUpdater.scheduleAtFixedRate(this::updateConfiguration, 0, 5, TimeUnit.MINUTES);
}
private void updateConfiguration() {
try {
DynamicConfig newConfig = fetchLatestConfiguration();
if (newConfig != null && hasConfigurationChanged(newConfig)) {
applyNewConfiguration(newConfig);
System.out.println("Contrast Agent configuration updated successfully");
}
} catch (Exception e) {
System.err.println("Failed to update configuration: " + e.getMessage());
}
}
private DynamicConfig fetchLatestConfiguration() {
// Implementation to fetch configuration from:
// - Contrast Platform API
// - Configuration server
// - Database
// - File system
// Example: Fetch from Contrast Platform
return configManager.fetchConfigFromPlatform();
}
private boolean hasConfigurationChanged(DynamicConfig newConfig) {
DynamicConfig currentConfig = configManager.getCurrentConfig();
return !currentConfig.equals(newConfig);
}
private void applyNewConfiguration(DynamicConfig newConfig) {
configManager.applyConfiguration(newConfig);
// Log configuration changes
logConfigurationChange(newConfig);
}
private void logConfigurationChange(DynamicConfig config) {
System.out.println("Applied new security configuration:");
System.out.println("  Protection Enabled: " + config.isProtectionEnabled());
System.out.println("  Assessment Enabled: " + config.isAssessmentEnabled());
System.out.println("  Log Level: " + config.getLogLevel());
// Log other relevant configuration changes
}
public void updateRuleStatus(String ruleId, boolean enabled) {
try {
configManager.updateRuleStatus(ruleId, enabled);
System.out.printf("Rule %s %s%n", ruleId, enabled ? "enabled" : "disabled");
} catch (Exception e) {
System.err.println("Failed to update rule status: " + e.getMessage());
}
}
public void setProtectionMode(boolean enabled) {
try {
configManager.setProtectionEnabled(enabled);
System.out.println("Protection mode " + (enabled ? "enabled" : "disabled"));
} catch (Exception e) {
System.err.println("Failed to update protection mode: " + e.getMessage());
}
}
public void shutdown() {
configUpdater.shutdown();
try {
if (!configUpdater.awaitTermination(10, TimeUnit.SECONDS)) {
configUpdater.shutdownNow();
}
} catch (InterruptedException e) {
configUpdater.shutdownNow();
Thread.currentThread().interrupt();
}
}
}

Best Practices

1. Agent Deployment

package com.contrast.security.bestpractices;
public class AgentDeploymentGuide {
/*
* Best Practices for Contrast Agent Deployment:
* 
* 1. Environment-Specific Configuration:
*    - Use different application names for dev/staging/prod
*    - Configure appropriate log levels per environment
*    - Set up environment-specific security policies
* 
* 2. Performance Considerations:
*    - Monitor agent memory and CPU usage
*    - Use appropriate instrumentation filters
*    - Configure sampling for high-traffic applications
* 
* 3. Security Configuration:
*    - Enable protection in production
*    - Configure appropriate blocking rules
*    - Set up alerting for critical events
* 
* 4. Maintenance:
*    - Keep agent updated to latest version
*    - Regularly review security events
*    - Update custom rules as needed
* 
* 5. Integration:
*    - Integrate with existing monitoring systems
*    - Set up centralized logging
*    - Configure alert escalation procedures
*/
}

2. Troubleshooting Common Issues

package com.contrast.security.troubleshooting;
public class AgentTroubleshooter {
/*
* Common Issues and Solutions:
* 
* 1. Agent Not Starting:
*    - Check JVM arguments
*    - Verify Contrast connection settings
*    - Check network connectivity to Contrast platform
* 
* 2. High Memory Usage:
*    - Adjust instrumentation filters
*    - Increase JVM heap size if necessary
*    - Review event sampling configuration
* 
* 3. Performance Impact:
*    - Use performance monitoring
*    - Adjust protection rules
*    - Consider using assess mode only in development
* 
* 4. False Positives:
*    - Tune custom rules
*    - Use whitelisting for known safe patterns
*    - Adjust rule sensitivity
* 
* 5. Connection Issues:
*    - Verify API keys and service keys
*    - Check proxy settings if behind corporate firewall
*    - Verify Contrast platform status
*/
}

This comprehensive Contrast Security Agent implementation provides enterprise-grade application security monitoring, vulnerability detection, and real-time attack protection for Java applications. The agent integrates seamlessly with existing applications and provides detailed security insights without requiring code changes.