google-site-verification: google61fe8ba583a51912.html
MACRO NEPAL
Signal Sciences WAF in Java
awiskar acharya
November 12, 2025
10:17 am

1. Core Signal Sciences Client

// SignalSciencesClient.java package com.signalsciences; import com.fasterxml.jackson.databind.ObjectMapper; import org.apache.http.HttpResponse; import org.apache.http.client.methods.HttpGet; import org.apache.http.client.methods.HttpPost; import org.apache.http.entity.StringEntity; import org.apache.http.impl.client.CloseableHttpClient; import org.apache.http.impl.client.HttpClients; import org.apache.http.util.EntityUtils; import java.io.IOException; import java.util.*; public class SignalSciencesClient { private final String baseUrl; private final String email; private final String apiToken; private final String corpName; private final CloseableHttpClient httpClient; private final ObjectMapper objectMapper; public SignalSciencesClient(String baseUrl, String email, String apiToken, String corpName) { this.baseUrl = baseUrl; this.email = email; this.apiToken = apiToken; this.corpName = corpName; this.httpClient = HttpClients.createDefault(); this.objectMapper = new ObjectMapper(); } // Corporation Management public List<Corporation> getCorporations() throws SignalSciencesException { return executeGet("/v0/corps", objectMapper.getTypeFactory().constructCollectionType(List.class, Corporation.class)); } public Corporation getCorporation(String corpName) throws SignalSciencesException { return executeGet("/v0/corps/" + corpName, Corporation.class); } // Site Management public List<Site> getSites() throws SignalSciencesException { return executeGet("/v0/corps/" + corpName + "/sites", objectMapper.getTypeFactory().constructCollectionType(List.class, Site.class)); } public Site getSite(String siteName) throws SignalSciencesException { return executeGet("/v0/corps/" + corpName + "/sites/" + siteName, Site.class); } public Site createSite(SiteRequest siteRequest) throws SignalSciencesException { return executePost("/v0/corps/" + corpName + "/sites", siteRequest, Site.class); } // Threat Intelligence public List<Threat> getRecentThreats(String siteName, Integer limit) throws SignalSciencesException { String url = "/v0/corps/" + corpName + "/sites/" + siteName + "/threats"; if (limit != null) { url += "?limit=" + limit; } return executeGet(url, objectMapper.getTypeFactory().constructCollectionType(List.class, Threat.class)); } public ThreatFeed getThreatFeed(String siteName) throws SignalSciencesException { return executeGet("/v0/corps/" + corpName + "/sites/" + siteName + "/feed/threats", ThreatFeed.class); } // Requests and Analytics public RequestAnalytics getRequestAnalytics(String siteName, AnalyticsQuery query) throws SignalSciencesException { String url = buildAnalyticsUrl("/v0/corps/" + corpName + "/sites/" + siteName + "/requests", query); return executeGet(url, RequestAnalytics.class); } public TimeseriesData getTimeseriesData(String siteName, AnalyticsQuery query) throws SignalSciencesException { String url = buildAnalyticsUrl("/v0/corps/" + corpName + "/sites/" + siteName + "/timeseries", query); return executeGet(url, TimeseriesData.class); } // Alerts and Notifications public List<Alert> getAlerts(String siteName, AlertQuery query) throws SignalSciencesException { String url = buildAlertUrl("/v0/corps/" + corpName + "/sites/" + siteName + "/alerts", query); return executeGet(url, objectMapper.getTypeFactory().constructCollectionType(List.class, Alert.class)); } // Custom Rules and Signals public List<CustomRule> getCustomRules(String siteName) throws SignalSciencesException { return executeGet("/v0/corps/" + corpName + "/sites/" + siteName + "/rules", objectMapper.getTypeFactory().constructCollectionType(List.class, CustomRule.class)); } public CustomRule createCustomRule(String siteName, CustomRule rule) throws SignalSciencesException { return executePost("/v0/corps/" + corpName + "/sites/" + siteName + "/rules", rule, CustomRule.class); } public void deleteCustomRule(String siteName, String ruleId) throws SignalSciencesException { executeDelete("/v0/corps/" + corpName + "/sites/" + siteName + "/rules/" + ruleId); } // IP Lists public List<IPList> getIPLists(String siteName) throws SignalSciencesException { return executeGet("/v0/corps/" + corpName + "/sites/" + siteName + "/ip-lists", objectMapper.getTypeFactory().constructCollectionType(List.class, IPList.class)); } public IPList createIPList(String siteName, IPList ipList) throws SignalSciencesException { return executePost("/v0/corps/" + corpName + "/sites/" + siteName + "/ip-lists", ipList, IPList.class); } // Private methods for HTTP operations private <T> T executeGet(String path, Class<T> responseType) throws SignalSciencesException { try { String url = baseUrl + path; HttpGet request = new HttpGet(url); addAuthHeaders(request); HttpResponse response = httpClient.execute(request); String responseBody = EntityUtils.toString(response.getEntity()); if (response.getStatusLine().getStatusCode() != 200) { throw new SignalSciencesException("GET request failed: " + responseBody); } return objectMapper.readValue(responseBody, responseType); } catch (IOException e) { throw new SignalSciencesException("GET request failed", e); } } private <T> T executeGet(String path, com.fasterxml.jackson.core.type.TypeReference<T> typeReference) throws SignalSciencesException { try { String url = baseUrl + path; HttpGet request = new HttpGet(url); addAuthHeaders(request); HttpResponse response = httpClient.execute(request); String responseBody = EntityUtils.toString(response.getEntity()); if (response.getStatusLine().getStatusCode() != 200) { throw new SignalSciencesException("GET request failed: " + responseBody); } return objectMapper.readValue(responseBody, typeReference); } catch (IOException e) { throw new SignalSciencesException("GET request failed", e); } } private <T> T executePost(String path, Object requestBody, Class<T> responseType) throws SignalSciencesException { try { String url = baseUrl + path; HttpPost request = new HttpPost(url); addAuthHeaders(request); String jsonBody = objectMapper.writeValueAsString(requestBody); StringEntity entity = new StringEntity(jsonBody); request.setEntity(entity); request.setHeader("Content-type", "application/json"); HttpResponse response = httpClient.execute(request); String responseBody = EntityUtils.toString(response.getEntity()); if (response.getStatusLine().getStatusCode() != 200) { throw new SignalSciencesException("POST request failed: " + responseBody); } return objectMapper.readValue(responseBody, responseType); } catch (IOException e) { throw new SignalSciencesException("POST request failed", e); } } private void executeDelete(String path) throws SignalSciencesException { try { String url = baseUrl + path; org.apache.http.client.methods.HttpDelete request = new org.apache.http.client.methods.HttpDelete(url); addAuthHeaders(request); HttpResponse response = httpClient.execute(request); if (response.getStatusLine().getStatusCode() != 204) { String responseBody = EntityUtils.toString(response.getEntity()); throw new SignalSciencesException("DELETE request failed: " + responseBody); } } catch (IOException e) { throw new SignalSciencesException("DELETE request failed", e); } } private void addAuthHeaders(org.apache.http.client.methods.HttpRequestBase request) { String auth = Base64.getEncoder().encodeToString((email + ":" + apiToken).getBytes()); request.setHeader("Authorization", "Basic " + auth); } private String buildAnalyticsUrl(String basePath, AnalyticsQuery query) { StringBuilder url = new StringBuilder(basePath); url.append("?from=").append(query.getFrom()); url.append("&until=").append(query.getUntil()); if (query.getInterval() != null) { url.append("&interval=").append(query.getInterval()); } if (query.getLimit() != null) { url.append("&limit=").append(query.getLimit()); } if (query.getFilters() != null && !query.getFilters().isEmpty()) { query.getFilters().forEach((key, value) -> url.append("&").append(key).append("=").append(value)); } return url.toString(); } private String buildAlertUrl(String basePath, AlertQuery query) { StringBuilder url = new StringBuilder(basePath); boolean hasParams = false; if (query.getSince() != null) { url.append("?since=").append(query.getSince()); hasParams = true; } if (query.getUntil() != null) { url.append(hasParams ? "&" : "?").append("until=").append(query.getUntil()); hasParams = true; } if (query.getLimit() != null) { url.append(hasParams ? "&" : "?").append("limit=").append(query.getLimit()); } return url.toString(); } public void close() throws IOException { httpClient.close(); } }

2. Data Models

// Signal Sciences Data Models package com.signalsciences; import java.util.*; public class Corporation { private String name; private String displayName; private Date createdAt; private Date updatedAt; private List<Site> sites; // Constructors, getters, and setters public Corporation() {} public String getName() { return name; } public void setName(String name) { this.name = name; } public String getDisplayName() { return displayName; } public void setDisplayName(String displayName) { this.displayName = displayName; } public Date getCreatedAt() { return createdAt; } public void setCreatedAt(Date createdAt) { this.createdAt = createdAt; } public Date getUpdatedAt() { return updatedAt; } public void setUpdatedAt(Date updatedAt) { this.updatedAt = updatedAt; } public List<Site> getSites() { return sites; } public void setSites(List<Site> sites) { this.sites = sites; } } public class Site { private String name; private String displayName; private String agentCode; private String agentKey; private Date createdAt; private Date updatedAt; private Map<String, Object> config; private List<CustomRule> rules; private List<IPList> ipLists; // Constructors, getters, and setters public Site() {} public String getName() { return name; } public void setName(String name) { this.name = name; } public String getDisplayName() { return displayName; } public void setDisplayName(String displayName) { this.displayName = displayName; } public String getAgentCode() { return agentCode; } public void setAgentCode(String agentCode) { this.agentCode = agentCode; } public String getAgentKey() { return agentKey; } public void setAgentKey(String agentKey) { this.agentKey = agentKey; } public Date getCreatedAt() { return createdAt; } public void setCreatedAt(Date createdAt) { this.createdAt = createdAt; } public Date getUpdatedAt() { return updatedAt; } public void setUpdatedAt(Date updatedAt) { this.updatedAt = updatedAt; } public Map<String, Object> getConfig() { return config; } public void setConfig(Map<String, Object> config) { this.config = config; } public List<CustomRule> getRules() { return rules; } public void setRules(List<CustomRule> rules) { this.rules = rules; } public List<IPList> getIpLists() { return ipLists; } public void setIpLists(List<IPList> ipLists) { this.ipLists = ipLists; } } public class SiteRequest { private String name; private String displayName; private Map<String, Object> config; public SiteRequest(String name, String displayName) { this.name = name; this.displayName = displayName; this.config = new HashMap<>(); } // Getters and setters public String getName() { return name; } public void setName(String name) { this.name = name; } public String getDisplayName() { return displayName; } public void setDisplayName(String displayName) { this.displayName = displayName; } public Map<String, Object> getConfig() { return config; } public void setConfig(Map<String, Object> config) { this.config = config; } } public class Threat { private String id; private String source; private String type; private String severity; private String description; private Date timestamp; private String clientIP; private String country; private String userAgent; private String path; private String method; private Map<String, String> tags; private List<String> indicators; // Constructors, getters, and setters public Threat() {} public String getId() { return id; } public void setId(String id) { this.id = id; } public String getSource() { return source; } public void setSource(String source) { this.source = source; } public String getType() { return type; } public void setType(String type) { this.type = type; } public String getSeverity() { return severity; } public void setSeverity(String severity) { this.severity = severity; } public String getDescription() { return description; } public void setDescription(String description) { this.description = description; } public Date getTimestamp() { return timestamp; } public void setTimestamp(Date timestamp) { this.timestamp = timestamp; } public String getClientIP() { return clientIP; } public void setClientIP(String clientIP) { this.clientIP = clientIP; } public String getCountry() { return country; } public void setCountry(String country) { this.country = country; } public String getUserAgent() { return userAgent; } public void setUserAgent(String userAgent) { this.userAgent = userAgent; } public String getPath() { return path; } public void setPath(String path) { this.path = path; } public String getMethod() { return method; } public void setMethod(String method) { this.method = method; } public Map<String, String> getTags() { return tags; } public void setTags(Map<String, String> tags) { this.tags = tags; } public List<String> getIndicators() { return indicators; } public void setIndicators(List<String> indicators) { this.indicators = indicators; } } public class ThreatFeed { private List<Threat> threats; private Date generatedAt; private int totalCount; private Map<String, Integer> severityBreakdown; // Constructors, getters, and setters public ThreatFeed() {} public List<Threat> getThreats() { return threats; } public void setThreats(List<Threat> threats) { this.threats = threats; } public Date getGeneratedAt() { return generatedAt; } public void setGeneratedAt(Date generatedAt) { this.generatedAt = generatedAt; } public int getTotalCount() { return totalCount; } public void setTotalCount(int totalCount) { this.totalCount = totalCount; } public Map<String, Integer> getSeverityBreakdown() { return severityBreakdown; } public void setSeverityBreakdown(Map<String, Integer> severityBreakdown) { this.severityBreakdown = severityBreakdown; } } public class RequestAnalytics { private Date from; private Date until; private int totalRequests; private int blockedRequests; private int allowedRequests; private Map<String, Integer> attackTypes; private Map<String, Integer> topIPs; private Map<String, Integer> topPaths; private List<RequestDetail> recentRequests; // Constructors, getters, and setters public RequestAnalytics() {} public Date getFrom() { return from; } public void setFrom(Date from) { this.from = from; } public Date getUntil() { return until; } public void setUntil(Date until) { this.until = until; } public int getTotalRequests() { return totalRequests; } public void setTotalRequests(int totalRequests) { this.totalRequests = totalRequests; } public int getBlockedRequests() { return blockedRequests; } public void setBlockedRequests(int blockedRequests) { this.blockedRequests = blockedRequests; } public int getAllowedRequests() { return allowedRequests; } public void setAllowedRequests(int allowedRequests) { this.allowedRequests = allowedRequests; } public Map<String, Integer> getAttackTypes() { return attackTypes; } public void setAttackTypes(Map<String, Integer> attackTypes) { this.attackTypes = attackTypes; } public Map<String, Integer> getTopIPs() { return topIPs; } public void setTopIPs(Map<String, Integer> topIPs) { this.topIPs = topIPs; } public Map<String, Integer> getTopPaths() { return topPaths; } public void setTopPaths(Map<String, Integer> topPaths) { this.topPaths = topPaths; } public List<RequestDetail> getRecentRequests() { return recentRequests; } public void setRecentRequests(List<RequestDetail> recentRequests) { this.recentRequests = recentRequests; } } public class RequestDetail { private String id; private Date timestamp; private String clientIP; private String country; private String method; private String path; private String userAgent; private String action; // ALLOW, BLOCK, RATE_LIMIT private List<String> tags; private Map<String, String> headers; // Constructors, getters, and setters public RequestDetail() {} public String getId() { return id; } public void setId(String id) { this.id = id; } public Date getTimestamp() { return timestamp; } public void setTimestamp(Date timestamp) { this.timestamp = timestamp; } public String getClientIP() { return clientIP; } public void setClientIP(String clientIP) { this.clientIP = clientIP; } public String getCountry() { return country; } public void setCountry(String country) { this.country = country; } public String getMethod() { return method; } public void setMethod(String method) { this.method = method; } public String getPath() { return path; } public void setPath(String path) { this.path = path; } public String getUserAgent() { return userAgent; } public void setUserAgent(String userAgent) { this.userAgent = userAgent; } public String getAction() { return action; } public void setAction(String action) { this.action = action; } public List<String> getTags() { return tags; } public void setTags(List<String> tags) { this.tags = tags; } public Map<String, String> getHeaders() { return headers; } public void setHeaders(Map<String, String> headers) { this.headers = headers; } } public class TimeseriesData { private Date from; private Date until; private String interval; private List<DataPoint> data; // Constructors, getters, and setters public TimeseriesData() {} public Date getFrom() { return from; } public void setFrom(Date from) { this.from = from; } public Date getUntil() { return until; } public void setUntil(Date until) { this.until = until; } public String getInterval() { return interval; } public void setInterval(String interval) { this.interval = interval; } public List<DataPoint> getData() { return data; } public void setData(List<DataPoint> data) { this.data = data; } } public class DataPoint { private Date timestamp; private int totalRequests; private int blockedRequests; private int attackRequests; private Map<String, Integer> attackBreakdown; // Constructors, getters, and setters public DataPoint() {} public Date getTimestamp() { return timestamp; } public void setTimestamp(Date timestamp) { this.timestamp = timestamp; } public int getTotalRequests() { return totalRequests; } public void setTotalRequests(int totalRequests) { this.totalRequests = totalRequests; } public int getBlockedRequests() { return blockedRequests; } public void setBlockedRequests(int blockedRequests) { this.blockedRequests = blockedRequests; } public int getAttackRequests() { return attackRequests; } public void setAttackRequests(int attackRequests) { this.attackRequests = attackRequests; } public Map<String, Integer> getAttackBreakdown() { return attackBreakdown; } public void setAttackBreakdown(Map<String, Integer> attackBreakdown) { this.attackBreakdown = attackBreakdown; } } public class Alert { private String id; private String type; private String severity; private String description; private Date createdAt; private Date resolvedAt; private String status; private Map<String, Object> metadata; private List<String> affectedSites; // Constructors, getters, and setters public Alert() {} public String getId() { return id; } public void setId(String id) { this.id = id; } public String getType() { return type; } public void setType(String type) { this.type = type; } public String getSeverity() { return severity; } public void setSeverity(String severity) { this.severity = severity; } public String getDescription() { return description; } public void setDescription(String description) { this.description = description; } public Date getCreatedAt() { return createdAt; } public void setCreatedAt(Date createdAt) { this.createdAt = createdAt; } public Date getResolvedAt() { return resolvedAt; } public void setResolvedAt(Date resolvedAt) { this.resolvedAt = resolvedAt; } public String getStatus() { return status; } public void setStatus(String status) { this.status = status; } public Map<String, Object> getMetadata() { return metadata; } public void setMetadata(Map<String, Object> metadata) { this.metadata = metadata; } public List<String> getAffectedSites() { return affectedSites; } public void setAffectedSites(List<String> affectedSites) { this.affectedSites = affectedSites; } } public class CustomRule { private String id; private String name; private String description; private String condition; private List<String> actions; private List<String> tags; private boolean enabled; private Date createdAt; private Date updatedAt; // Constructors, getters, and setters public CustomRule() {} public String getId() { return id; } public void setId(String id) { this.id = id; } public String getName() { return name; } public void setName(String name) { this.name = name; } public String getDescription() { return description; } public void setDescription(String description) { this.description = description; } public String getCondition() { return condition; } public void setCondition(String condition) { this.condition = condition; } public List<String> getActions() { return actions; } public void setActions(List<String> actions) { this.actions = actions; } public List<String> getTags() { return tags; } public void setTags(List<String> tags) { this.tags = tags; } public boolean isEnabled() { return enabled; } public void setEnabled(boolean enabled) { this.enabled = enabled; } public Date getCreatedAt() { return createdAt; } public void setCreatedAt(Date createdAt) { this.createdAt = createdAt; } public Date getUpdatedAt() { return updatedAt; } public void setUpdatedAt(Date updatedAt) { this.updatedAt = updatedAt; } } public class IPList { private String id; private String name; private String description; private List<String> entries; private String type; // WHITELIST, BLACKLIST private Date createdAt; private Date updatedAt; // Constructors, getters, and setters public IPList() {} public String getId() { return id; } public void setId(String id) { this.id = id; } public String getName() { return name; } public void setName(String name) { this.name = name; } public String getDescription() { return description; } public void setDescription(String description) { this.description = description; } public List<String> getEntries() { return entries; } public void setEntries(List<String> entries) { this.entries = entries; } public String getType() { return type; } public void setType(String type) { this.type = type; } public Date getCreatedAt() { return createdAt; } public void setCreatedAt(Date createdAt) { this.createdAt = createdAt; } public Date getUpdatedAt() { return updatedAt; } public void setUpdatedAt(Date updatedAt) { this.updatedAt = updatedAt; } } // Query Models public class AnalyticsQuery { private Date from; private Date until; private String interval; private Integer limit; private Map<String, String> filters; public AnalyticsQuery(Date from, Date until) { this.from = from; this.until = until; this.filters = new HashMap<>(); } // Getters and setters public Date getFrom() { return from; } public void setFrom(Date from) { this.from = from; } public Date getUntil() { return until; } public void setUntil(Date until) { this.until = until; } public String getInterval() { return interval; } public void setInterval(String interval) { this.interval = interval; } public Integer getLimit() { return limit; } public void setLimit(Integer limit) { this.limit = limit; } public Map<String, String> getFilters() { return filters; } public void setFilters(Map<String, String> filters) { this.filters = filters; } public void addFilter(String key, String value) { filters.put(key, value); } } public class AlertQuery { private Date since; private Date until; private Integer limit; // Getters and setters public Date getSince() { return since; } public void setSince(Date since) { this.since = since; } public Date getUntil() { return until; } public void setUntil(Date until) { this.until = until; } public Integer getLimit() { return limit; } public void setLimit(Integer limit) { this.limit = limit; } } public class SignalSciencesException extends Exception { public SignalSciencesException(String message) { super(message); } public SignalSciencesException(String message, Throwable cause) { super(message, cause); } }

3. Real-time Threat Monitoring

// ThreatMonitor.java package com.signalsciences.monitoring; import com.signalsciences.*; import java.util.*; import java.util.concurrent.*; public class ThreatMonitor { private final SignalSciencesClient client; private final String siteName; private final ScheduledExecutorService scheduler; private final List<ThreatListener> listeners; private final Map<String, Threat> recentThreats; private final int maxRecentThreats; private ScheduledFuture<?> monitoringTask; public ThreatMonitor(SignalSciencesClient client, String siteName) { this.client = client; this.siteName = siteName; this.scheduler = Executors.newScheduledThreadPool(2); this.listeners = new CopyOnWriteArrayList<>(); this.recentThreats = new ConcurrentHashMap<>(); this.maxRecentThreats = 1000; } public void startMonitoring(long intervalSeconds) { if (monitoringTask != null && !monitoringTask.isCancelled()) { throw new IllegalStateException("Monitor is already running"); } monitoringTask = scheduler.scheduleAtFixedRate(() -> { try { checkForNewThreats(); } catch (Exception e) { notifyListenersOfError(e); } }, 0, intervalSeconds, TimeUnit.SECONDS); System.out.println("Started threat monitoring for site: " + siteName); } public void stopMonitoring() { if (monitoringTask != null) { monitoringTask.cancel(true); monitoringTask = null; } System.out.println("Stopped threat monitoring for site: " + siteName); } public void addListener(ThreatListener listener) { listeners.add(listener); } public void removeListener(ThreatListener listener) { listeners.remove(listener); } private void checkForNewThreats() throws SignalSciencesException { List<Threat> threats = client.getRecentThreats(siteName, 50); for (Threat threat : threats) { if (!recentThreats.containsKey(threat.getId())) { recentThreats.put(threat.getId(), threat); notifyListeners(threat); // Maintain recent threats size if (recentThreats.size() > maxRecentThreats) { String oldestKey = recentThreats.keySet().iterator().next(); recentThreats.remove(oldestKey); } } } } private void notifyListeners(Threat threat) { for (ThreatListener listener : listeners) { try { listener.onThreatDetected(threat); } catch (Exception e) { System.err.println("Error notifying threat listener: " + e.getMessage()); } } } private void notifyListenersOfError(Exception error) { for (ThreatListener listener : listeners) { try { listener.onMonitoringError(error); } catch (Exception e) { System.err.println("Error notifying error listener: " + e.getMessage()); } } } public ThreatStatistics getStatistics() { Map<String, Integer> severityCount = new HashMap<>(); Map<String, Integer> typeCount = new HashMap<>(); Map<String, Integer> countryCount = new HashMap<>(); for (Threat threat : recentThreats.values()) { severityCount.merge(threat.getSeverity(), 1, Integer::sum); typeCount.merge(threat.getType(), 1, Integer::sum); countryCount.merge(threat.getCountry(), 1, Integer::sum); } return new ThreatStatistics( recentThreats.size(), severityCount, typeCount, countryCount, new Date() ); } public List<Threat> getRecentThreats(int limit) { return recentThreats.values().stream() .sorted((t1, t2) -> t2.getTimestamp().compareTo(t1.getTimestamp())) .limit(limit) .toList(); } public void shutdown() { stopMonitoring(); scheduler.shutdown(); try { if (!scheduler.awaitTermination(5, TimeUnit.SECONDS)) { scheduler.shutdownNow(); } } catch (InterruptedException e) { scheduler.shutdownNow(); Thread.currentThread().interrupt(); } } } // Threat Listener Interface package com.signalsciences.monitoring; import com.signalsciences.Threat; public interface ThreatListener { void onThreatDetected(Threat threat); void onMonitoringError(Exception error); } // Threat Statistics package com.signalsciences.monitoring; import java.util.Date; import java.util.Map; public class ThreatStatistics { private final int totalThreats; private final Map<String, Integer> severityBreakdown; private final Map<String, Integer> typeBreakdown; private final Map<String, Integer> countryBreakdown; private final Date generatedAt; public ThreatStatistics(int totalThreats, Map<String, Integer> severityBreakdown, Map<String, Integer> typeBreakdown, Map<String, Integer> countryBreakdown, Date generatedAt) { this.totalThreats = totalThreats; this.severityBreakdown = severityBreakdown; this.typeBreakdown = typeBreakdown; this.countryBreakdown = countryBreakdown; this.generatedAt = generatedAt; } // Getters public int getTotalThreats() { return totalThreats; } public Map<String, Integer> getSeverityBreakdown() { return severityBreakdown; } public Map<String, Integer> getTypeBreakdown() { return typeBreakdown; } public Map<String, Integer> getCountryBreakdown() { return countryBreakdown; } public Date getGeneratedAt() { return generatedAt; } public int getCriticalThreats() { return severityBreakdown.getOrDefault("CRITICAL", 0) + severityBreakdown.getOrDefault("HIGH", 0); } public String getTopThreatType() { return typeBreakdown.entrySet().stream() .max(Map.Entry.comparingByValue()) .map(Map.Entry::getKey) .orElse("NONE"); } public String getTopCountry() { return countryBreakdown.entrySet().stream() .max(Map.Entry.comparingByValue()) .map(Map.Entry::getKey) .orElse("UNKNOWN"); } }

4. Spring Boot Integration

// SignalSciencesConfig.java package com.signalsciences.config; import com.signalsciences.SignalSciencesClient; import com.signalsciences.monitoring.ThreatMonitor; import org.springframework.beans.factory.annotation.Value; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; @Configuration public class SignalSciencesConfig { @Value("${signalsciences.baseUrl:https://dashboard.signalsciences.net}") private String baseUrl; @Value("${signalsciences.email}") private String email; @Value("${signalsciences.apiToken}") private String apiToken; @Value("${signalsciences.corpName}") private String corpName; @Value("${signalsciences.siteName}") private String siteName; @Value("${signalsciences.monitoring.enabled:true}") private boolean monitoringEnabled; @Value("${signalsciences.monitoring.interval:60}") private long monitoringInterval; @Bean public SignalSciencesClient signalSciencesClient() { return new SignalSciencesClient(baseUrl, email, apiToken, corpName); } @Bean public ThreatMonitor threatMonitor(SignalSciencesClient client) { ThreatMonitor monitor = new ThreatMonitor(client, siteName); if (monitoringEnabled) { monitor.startMonitoring(monitoringInterval); // Add default listener for logging monitor.addListener(new LoggingThreatListener()); } return monitor; } } // LoggingThreatListener.java package com.signalsciences.config; import com.signalsciences.Threat; import com.signalsciences.monitoring.ThreatListener; import org.slf4j.Logger; import org.slf4j.LoggerFactory; public class LoggingThreatListener implements ThreatListener { private static final Logger logger = LoggerFactory.getLogger(LoggingThreatListener.class); @Override public void onThreatDetected(Threat threat) { logger.warn("THREAT DETECTED - Type: {}, Severity: {}, IP: {}, Path: {}", threat.getType(), threat.getSeverity(), threat.getClientIP(), threat.getPath()); if ("CRITICAL".equals(threat.getSeverity()) || "HIGH".equals(threat.getSeverity())) { logger.error("CRITICAL THREAT - Immediate attention required: {}", threat.getDescription()); } } @Override public void onMonitoringError(Exception error) { logger.error("Threat monitoring error: {}", error.getMessage(), error); } } // SignalSciencesController.java package com.signalsciences.web; import com.signalsciences.*; import com.signalsciences.monitoring.ThreatMonitor; import com.signalsciences.monitoring.ThreatStatistics; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.http.ResponseEntity; import org.springframework.web.bind.annotation.*; import java.util.Date; import java.util.List; import java.util.Map; @RestController @RequestMapping("/api/security") public class SignalSciencesController { @Autowired private SignalSciencesClient client; @Autowired private ThreatMonitor threatMonitor; @GetMapping("/threats/recent") public ResponseEntity<List<Threat>> getRecentThreats(@RequestParam(defaultValue = "50") int limit) { try { List<Threat> threats = client.getRecentThreats("default", limit); return ResponseEntity.ok(threats); } catch (SignalSciencesException e) { return ResponseEntity.internalServerError().build(); } } @GetMapping("/analytics/requests") public ResponseEntity<RequestAnalytics> getRequestAnalytics( @RequestParam Long from, @RequestParam Long until, @RequestParam(required = false) String interval) { try { AnalyticsQuery query = new AnalyticsQuery(new Date(from), new Date(until)); if (interval != null) { query.setInterval(interval); } RequestAnalytics analytics = client.getRequestAnalytics("default", query); return ResponseEntity.ok(analytics); } catch (SignalSciencesException e) { return ResponseEntity.internalServerError().build(); } } @GetMapping("/monitoring/stats") public ResponseEntity<ThreatStatistics> getMonitoringStats() { ThreatStatistics stats = threatMonitor.getStatistics(); return ResponseEntity.ok(stats); } @GetMapping("/alerts") public ResponseEntity<List<Alert>> getAlerts( @RequestParam(required = false) Long since, @RequestParam(required = false) Long until, @RequestParam(defaultValue = "50") int limit) { try { AlertQuery query = new AlertQuery(); if (since != null) query.setSince(new Date(since)); if (until != null) query.setUntil(new Date(until)); query.setLimit(limit); List<Alert> alerts = client.getAlerts("default", query); return ResponseEntity.ok(alerts); } catch (SignalSciencesException e) { return ResponseEntity.internalServerError().build(); } } @PostMapping("/rules") public ResponseEntity<CustomRule> createCustomRule(@RequestBody CustomRule rule) { try { CustomRule created = client.createCustomRule("default", rule); return ResponseEntity.ok(created); } catch (SignalSciencesException e) { return ResponseEntity.internalServerError().build(); } } @GetMapping("/health") public ResponseEntity<Map<String, Object>> health() { try { List<Site> sites = client.getSites(); boolean healthy = !sites.isEmpty(); return ResponseEntity.ok(Map.of( "status", healthy ? "healthy" : "degraded", "sitesCount", sites.size(), "timestamp", System.currentTimeMillis() )); } catch (SignalSciencesException e) { return ResponseEntity.ok(Map.of( "status", "unhealthy", "error", e.getMessage(), "timestamp", System.currentTimeMillis() )); } } }

5. Web Application Firewall Filter

// WAFRequestFilter.java package com.signalsciences.filter; import com.signalsciences.SignalSciencesClient; import com.signalsciences.Threat; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Component; import javax.servlet.*; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; import java.util.*; @Component public class WAFRequestFilter implements Filter { private static final Logger logger = LoggerFactory.getLogger(WAFRequestFilter.class); @Autowired private SignalSciencesClient client; private final Set<String> suspiciousUserAgents = Set.of( "sqlmap", "nikto", "metasploit", "nmap", "burpsuite", "w3af" ); private final Set<String> blockedIPs = Collections.synchronizedSet(new HashSet<>()); @Override public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { HttpServletRequest httpRequest = (HttpServletRequest) request; HttpServletResponse httpResponse = (HttpServletResponse) response; String clientIP = getClientIP(httpRequest); String userAgent = httpRequest.getHeader("User-Agent"); String path = httpRequest.getRequestURI(); String method = httpRequest.getMethod(); // Check if IP is blocked if (blockedIPs.contains(clientIP)) { logger.warn("Blocked request from blacklisted IP: {}", clientIP); httpResponse.setStatus(403); httpResponse.getWriter().write("Access denied"); return; } // Analyze request for threats ThreatAnalysis analysis = analyzeRequest(httpRequest); if (analysis.isSuspicious()) { logger.warn("Suspicious request detected from {}: {}", clientIP, analysis.getReason()); // Log threat for monitoring logThreat(clientIP, userAgent, path, method, analysis); // Block critical threats if (analysis.isCritical()) { blockedIPs.add(clientIP); httpResponse.setStatus(403); httpResponse.getWriter().write("Request blocked by WAF"); return; } } chain.doFilter(request, response); } private String getClientIP(HttpServletRequest request) { String xForwardedFor = request.getHeader("X-Forwarded-For"); if (xForwardedFor != null && !xForwardedFor.isEmpty()) { return xForwardedFor.split(",")[0].trim(); } return request.getRemoteAddr(); } private ThreatAnalysis analyzeRequest(HttpServletRequest request) { ThreatAnalysis analysis = new ThreatAnalysis(); String clientIP = getClientIP(request); String userAgent = request.getHeader("User-Agent"); String path = request.getRequestURI(); String queryString = request.getQueryString(); // Check for suspicious user agents if (userAgent != null) { String lowerUserAgent = userAgent.toLowerCase(); for (String suspicious : suspiciousUserAgents) { if (lowerUserAgent.contains(suspicious)) { analysis.addSuspicion("Suspicious User-Agent: " + userAgent); analysis.setCritical(true); } } } // Check for SQL injection patterns if (containsSQLInjection(path) || (queryString != null && containsSQLInjection(queryString))) { analysis.addSuspicion("SQL injection attempt detected"); analysis.setCritical(true); } // Check for path traversal if (containsPathTraversal(path)) { analysis.addSuspicion("Path traversal attempt detected"); analysis.setCritical(true); } // Check for XSS attempts if (containsXSS(path) || (queryString != null && containsXSS(queryString))) { analysis.addSuspicion("XSS attempt detected"); analysis.setCritical(true); } // Rate limiting (simplified) if (isRateLimited(clientIP)) { analysis.addSuspicion("Rate limit exceeded"); analysis.setCritical(true); } return analysis; } private boolean containsSQLInjection(String input) { if (input == null) return false; String[] sqlPatterns = { "union.*select", "select.*from", "insert.*into", "update.*set", "delete.*from", "drop.*table", "1=1", "or.*1=1", "';", "--" }; String lowerInput = input.toLowerCase(); return Arrays.stream(sqlPatterns) .anyMatch(pattern -> lowerInput.matches(".*" + pattern + ".*")); } private boolean containsPathTraversal(String input) { if (input == null) return false; return input.contains("../") || input.contains("..\\") || input.contains("/etc/passwd"); } private boolean containsXSS(String input) { if (input == null) return false; String[] xssPatterns = { "<script>", "javascript:", "onload=", "onerror=", "onclick=", "alert\\(", "document\\.cookie", "<iframe>" }; String lowerInput = input.toLowerCase(); return Arrays.stream(xssPatterns) .anyMatch(pattern -> lowerInput.contains(pattern)); } private boolean isRateLimited(String clientIP) { // Simplified rate limiting - in production, use Redis or similar // This is just a basic example return false; } private void logThreat(String clientIP, String userAgent, String path, String method, ThreatAnalysis analysis) { // In production, this would send data to Signal Sciences logger.warn("THREAT: IP={}, Method={}, Path={}, UserAgent={}, Reason={}", clientIP, method, path, userAgent, analysis.getReason()); } @Override public void init(FilterConfig filterConfig) throws ServletException { logger.info("WAF Request Filter initialized"); } @Override public void destroy() { logger.info("WAF Request Filter destroyed"); } } // ThreatAnalysis.java package com.signalsciences.filter; import java.util.ArrayList; import java.util.List; public class ThreatAnalysis { private List<String> suspicions; private boolean critical; public ThreatAnalysis() { this.suspicions = new ArrayList<>(); this.critical = false; } public void addSuspicion(String suspicion) { suspicions.add(suspicion); } public boolean isSuspicious() { return !suspicions.isEmpty(); } public boolean isCritical() { return critical; } public void setCritical(boolean critical) { this.critical = critical; } public String getReason() { return String.join("; ", suspicions); } public List<String> getSuspicions() { return new ArrayList<>(suspicions); } }

6. Security Dashboard Service

// SecurityDashboardService.java package com.signalsciences.dashboard; import com.signalsciences.*; import com.signalsciences.monitoring.ThreatMonitor; import com.signalsciences.monitoring.ThreatStatistics; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.scheduling.annotation.Scheduled; import org.springframework.stereotype.Service; import java.util.*; import java.util.concurrent.ConcurrentHashMap; @Service public class SecurityDashboardService { @Autowired private SignalSciencesClient client; @Autowired private ThreatMonitor threatMonitor; private final Map<String, DashboardMetrics> metricsCache = new ConcurrentHashMap<>(); private final int CACHE_TTL_MINUTES = 5; public SecurityDashboard getDashboard() throws SignalSciencesException { SecurityDashboard dashboard = new SecurityDashboard(); dashboard.setGeneratedAt(new Date()); // Get real-time threats ThreatStatistics threatStats = threatMonitor.getStatistics(); dashboard.setThreatStatistics(threatStats); // Get request analytics for last 24 hours Date now = new Date(); Date yesterday = new Date(now.getTime() - (24 * 60 * 60 * 1000)); AnalyticsQuery query = new AnalyticsQuery(yesterday, now); RequestAnalytics requestAnalytics = client.getRequestAnalytics("default", query); dashboard.setRequestAnalytics(requestAnalytics); // Get recent alerts AlertQuery alertQuery = new AlertQuery(); alertQuery.setSince(yesterday); alertQuery.setLimit(20); List<Alert> alerts = client.getAlerts("default", alertQuery); dashboard.setRecentAlerts(alerts); // Get top threats List<Threat> topThreats = threatMonitor.getRecentThreats(10); dashboard.setTopThreats(topThreats); // Calculate security score double securityScore = calculateSecurityScore(threatStats, requestAnalytics); dashboard.setSecurityScore(securityScore); dashboard.setSecurityLevel(getSecurityLevel(securityScore)); return dashboard; } public ThreatReport generateThreatReport(Date from, Date until) throws SignalSciencesException { ThreatReport report = new ThreatReport(); report.setFrom(from); report.setUntil(until); // Get threats in time range AnalyticsQuery query = new AnalyticsQuery(from, until); RequestAnalytics analytics = client.getRequestAnalytics("default", query); // Analyze threat patterns Map<String, ThreatPattern> patterns = analyzeThreatPatterns(analytics); report.setThreatPatterns(patterns); // Generate recommendations List<SecurityRecommendation> recommendations = generateRecommendations(analytics, patterns); report.setRecommendations(recommendations); // Calculate metrics ThreatMetrics metrics = calculateThreatMetrics(analytics); report.setMetrics(metrics); return report; } @Scheduled(fixedRate = 300000) // Update every 5 minutes public void updateMetricsCache() { try { SecurityDashboard dashboard = getDashboard(); DashboardMetrics metrics = new DashboardMetrics(dashboard); metricsCache.put("current", metrics); } catch (SignalSciencesException e) { System.err.println("Failed to update metrics cache: " + e.getMessage()); } } private double calculateSecurityScore(ThreatStatistics threatStats, RequestAnalytics analytics) { double score = 100.0; // Deduct for critical threats score -= threatStats.getCriticalThreats() * 5; // Deduct for high blocked request rate if (analytics.getTotalRequests() > 0) { double blockRate = (double) analytics.getBlockedRequests() / analytics.getTotalRequests(); if (blockRate > 0.1) { // More than 10% blocked score -= 20; } } // Deduct for high attack rate if (analytics.getTotalRequests() > 0) { double attackRate = analytics.getAttackTypes().values().stream() .mapToInt(Integer::intValue).sum() / (double) analytics.getTotalRequests(); if (attackRate > 0.05) { // More than 5% attacks score -= 15; } } return Math.max(score, 0); } private String getSecurityLevel(double score) { if (score >= 90) return "EXCELLENT"; if (score >= 80) return "GOOD"; if (score >= 70) return "FAIR"; if (score >= 60) return "POOR"; return "CRITICAL"; } private Map<String, ThreatPattern> analyzeThreatPatterns(RequestAnalytics analytics) { Map<String, ThreatPattern> patterns = new HashMap<>(); // Analyze by attack type analytics.getAttackTypes().forEach((type, count) -> { ThreatPattern pattern = new ThreatPattern(); pattern.setType("ATTACK_TYPE"); pattern.setValue(type); pattern.setCount(count); pattern.setSeverity(calculateAttackSeverity(type, count)); patterns.put("ATTACK_" + type, pattern); }); // Analyze by IP analytics.getTopIPs().forEach((ip, count) -> { if (count > 10) { // Only consider IPs with significant activity ThreatPattern pattern = new ThreatPattern(); pattern.setType("SUSPICIOUS_IP"); pattern.setValue(ip); pattern.setCount(count); pattern.setSeverity(count > 50 ? "HIGH" : "MEDIUM"); patterns.put("IP_" + ip, pattern); } }); return patterns; } private String calculateAttackSeverity(String attackType, int count) { if (count > 100) return "CRITICAL"; if (count > 50) return "HIGH"; if (count > 20) return "MEDIUM"; return "LOW"; } private List<SecurityRecommendation> generateRecommendations( RequestAnalytics analytics, Map<String, ThreatPattern> patterns) { List<SecurityRecommendation> recommendations = new ArrayList<>(); // Check for SQL injection patterns if (patterns.containsKey("ATTACK_sql_injection")) { recommendations.add(new SecurityRecommendation( "SQL_INJECTION_PROTECTION", "Implement additional SQL injection protection rules", "HIGH", "Add custom rules to block common SQL injection patterns" )); } // Check for XSS patterns if (patterns.containsKey("ATTACK_xss")) { recommendations.add(new SecurityRecommendation( "XSS_PROTECTION", "Enhance XSS protection", "HIGH", "Update WAF rules to detect advanced XSS attempts" )); } // Check for high block rate if (analytics.getTotalRequests() > 0) { double blockRate = (double) analytics.getBlockedRequests() / analytics.getTotalRequests(); if (blockRate > 0.15) { recommendations.add(new SecurityRecommendation( "FALSE_POSITIVES", "Review false positives", "MEDIUM", "High block rate may indicate false positives. Review blocked requests." )); } } return recommendations; } private ThreatMetrics calculateThreatMetrics(RequestAnalytics analytics) { ThreatMetrics metrics = new ThreatMetrics(); metrics.setTotalRequests(analytics.getTotalRequests()); metrics.setBlockedRequests(analytics.getBlockedRequests()); metrics.setAttackRequests(analytics.getAttackTypes().values().stream() .mapToInt(Integer::intValue).sum()); // Calculate rates if (analytics.getTotalRequests() > 0) { metrics.setBlockRate((double) analytics.getBlockedRequests() / analytics.getTotalRequests()); metrics.setAttackRate((double) metrics.getAttackRequests() / analytics.getTotalRequests()); } return metrics; } } // Dashboard Models package com.signalsciences.dashboard; import com.signalsciences.*; import com.signalsciences.monitoring.ThreatStatistics; import java.util.*; public class SecurityDashboard { private Date generatedAt; private double securityScore; private String securityLevel; private ThreatStatistics threatStatistics; private RequestAnalytics requestAnalytics; private List<Alert> recentAlerts; private List<Threat> topThreats; // Constructors, getters, and setters public SecurityDashboard() {} public Date getGeneratedAt() { return generatedAt; } public void setGeneratedAt(Date generatedAt) { this.generatedAt = generatedAt; } public double getSecurityScore() { return securityScore; } public void setSecurityScore(double securityScore) { this.securityScore = securityScore; } public String getSecurityLevel() { return securityLevel; } public void setSecurityLevel(String securityLevel) { this.securityLevel = securityLevel; } public ThreatStatistics getThreatStatistics() { return threatStatistics; } public void setThreatStatistics(ThreatStatistics threatStatistics) { this.threatStatistics = threatStatistics; } public RequestAnalytics getRequestAnalytics() { return requestAnalytics; } public void setRequestAnalytics(RequestAnalytics requestAnalytics) { this.requestAnalytics = requestAnalytics; } public List<Alert> getRecentAlerts() { return recentAlerts; } public void setRecentAlerts(List<Alert> recentAlerts) { this.recentAlerts = recentAlerts; } public List<Threat> getTopThreats() { return topThreats; } public void setTopThreats(List<Threat> topThreats) { this.topThreats = topThreats; } } public class ThreatReport { private Date from; private Date until; private Map<String, ThreatPattern> threatPatterns; private List<SecurityRecommendation> recommendations; private ThreatMetrics metrics; // Constructors, getters, and setters public ThreatReport() {} public Date getFrom() { return from; } public void setFrom(Date from) { this.from = from; } public Date getUntil() { return until; } public void setUntil(Date until) { this.until = until; } public Map<String, ThreatPattern> getThreatPatterns() { return threatPatterns; } public void setThreatPatterns(Map<String, ThreatPattern> threatPatterns) { this.threatPatterns = threatPatterns; } public List<SecurityRecommendation> getRecommendations() { return recommendations; } public void setRecommendations(List<SecurityRecommendation> recommendations) { this.recommendations = recommendations; } public ThreatMetrics getMetrics() { return metrics; } public void setMetrics(ThreatMetrics metrics) { this.metrics = metrics; } } public class ThreatPattern { private String type; private String value; private int count; private String severity; // Constructors, getters, and setters public ThreatPattern() {} public String getType() { return type; } public void setType(String type) { this.type = type; } public String getValue() { return value; } public void setValue(String value) { this.value = value; } public int getCount() { return count; } public void setCount(int count) { this.count = count; } public String getSeverity() { return severity; } public void setSeverity(String severity) { this.severity = severity; } } public class SecurityRecommendation { private String id; private String title; private String severity; private String description; private String action; public SecurityRecommendation(String id, String title, String severity, String description) { this.id = id; this.title = title; this.severity = severity; this.description = description; } // Getters and setters public String getId() { return id; } public void setId(String id) { this.id = id; } public String getTitle() { return title; } public void setTitle(String title) { this.title = title; } public String getSeverity() { return severity; } public void setSeverity(String severity) { this.severity = severity; } public String getDescription() { return description; } public void setDescription(String description) { this.description = description; } public String getAction() { return action; } public void setAction(String action) { this.action = action; } } public class ThreatMetrics { private int totalRequests; private int blockedRequests; private int attackRequests; private double blockRate; private double attackRate; // Constructors, getters, and setters public ThreatMetrics() {} public int getTotalRequests() { return totalRequests; } public void setTotalRequests(int totalRequests) { this.totalRequests = totalRequests; } public int getBlockedRequests() { return blockedRequests; } public void setBlockedRequests(int blockedRequests) { this.blockedRequests = blockedRequests; } public int getAttackRequests() { return attackRequests; } public void setAttackRequests(int attackRequests) { this.attackRequests = attackRequests; } public double getBlockRate() { return blockRate; } public void setBlockRate(double blockRate) { this.blockRate = blockRate; } public double getAttackRate() { return attackRate; } public void setAttackRate(double attackRate) { this.attackRate = attackRate; } } public class DashboardMetrics { private SecurityDashboard dashboard; private Date cachedAt; public DashboardMetrics(SecurityDashboard dashboard) { this.dashboard = dashboard; this.cachedAt = new Date(); } // Getters and setters public SecurityDashboard getDashboard() { return dashboard; } public void setDashboard(SecurityDashboard dashboard) { this.dashboard = dashboard; } public Date getCachedAt() { return cachedAt; } public void setCachedAt(Date cachedAt) { this.cachedAt = cachedAt; } }

7. Application Configuration

# application.yml spring: application: name: signal-sciences-integration signalsciences: baseUrl: https://dashboard.signalsciences.net email: ${SIGSCI_EMAIL:} apiToken: ${SIGSCI_API_TOKEN:} corpName: ${SIGSCI_CORP_NAME:} siteName: ${SIGSCI_SITE_NAME:default} monitoring: enabled: true interval: 60 server: port: 8080 management: endpoints: web: exposure: include: health,metrics,info endpoint: health: show-details: always logging: level: com.signalsciences: DEBUG

Key Features:

  1. Complete API Integration: Full Signal Sciences REST API client
  2. Real-time Threat Monitoring: Continuous monitoring with event listeners
  3. Spring Boot Integration: Seamless framework integration
  4. WAF Request Filter: In-application security filtering
  5. Security Dashboard: Comprehensive security analytics and reporting
  6. Custom Rules Management: Dynamic rule creation and management
  7. IP List Management: Whitelist/blacklist functionality
  8. Alert System: Real-time security alerts and notifications

This implementation provides enterprise-grade Signal Sciences WAF integration for Java applications, enabling comprehensive web application security monitoring, threat detection, and real-time protection.

Category : JAVA

Leave a Reply

Your email address will not be published. Required fields are marked *


Macro Nepal Helper