Explain the configuration difference between ws-rest-server-boot & ws-rest-server-boot-rules

Hey,

The ws-rest-server-boot-rules sample-app contains the following extra configuration data in appsensor-server-config.xml. I was wondering if I could get some extra context on this configuration type. Besides that I’m currently trying to configure one of the REST sample apps to log a user out on 3 events by the same user. How would I do that in the sample apps?

Best

<rules>
		<rule guid="00000000-0000-0000-0000-000000000000">
			<name>Rule 1</name>
			<window unit="minutes">2</window>
			<expressions>
				<expression>
					<window unit="minutes">1</window>
					<clauses>
						<clause>
							<monitor-points>
								<monitor-point guid="00000000-0000-0000-0000-000000000001">
									<category>Input Validation</category>
									<id>IE1</id>
									<threshold>
										<count>50</count>
										<interval unit="minutes">1</interval>
									</threshold>
								</monitor-point>
								
								<monitor-point guid="00000000-0000-0000-0000-000000000002">
									<category>Input Validation</category>
									<id>IE2</id>
									<threshold>
										<count>2</count>
										<interval unit="seconds">10</interval>
									</threshold>
								</monitor-point>
							</monitor-points>
						</clause>
						<clause>
							<monitor-points>
								<monitor-point guid="00000000-0000-0000-0000-000000000003">
									<category>Input Validation</category>
									<id>RE3</id>
									<threshold>
										<count>2</count>
										<interval unit="seconds">20</interval>
									</threshold>
								</monitor-point>
							</monitor-points>
						</clause>
					</clauses>
				</expression>
				
				<expression>
					<window unit="minutes">1</window>
					<clauses>
						<clause>
							<monitor-points>
								<monitor-point guid="00000000-0000-0000-0000-000000000004">
									<category>Input Validation</category>
									<id>IE1</id>
									<threshold>
										<count>3</count>
										<interval unit="minutes">1</interval>
									</threshold>
								</monitor-point>
							</monitor-points>
						</clause>
					</clauses>
				</expression>
			</expressions>
			
			<responses>
				<response>
					<action>log</action>
				</response>
				
				<response>
					<action>logout</action>
				</response>
				
				<response>
					<action>disableUser</action>
				</response>
				
				<response>
					<action>disableComponentForSpecificUser</action>
					<interval unit="minutes">30</interval>
				</response>
				
				<response>
					<action>disableComponentForAllUsers</action>
					<interval unit="minutes">30</interval>
				</response>
			</responses>
		</rule>
		
		<rule guid="00000000-0000-0000-0000-000000000005">
			<name>Rule 2</name>
			<window unit="seconds">10</window>
			<expressions>				
				<expression>
					<window unit="seconds">5</window>
					<clauses>
						<clause>
							<monitor-points>
								<monitor-point guid="00000000-0000-0000-0000-000000000006">
									<category>Input Validation</category>
									<id>IE1</id>
									<threshold>
										<count>1</count>
										<interval unit="seconds">5</interval>
									</threshold>
								</monitor-point>
							</monitor-points>
						</clause>
					</clauses>
				</expression>
			</expressions>
			
			<responses>
				<response>
					<action>log</action>
				</response>
			</responses>
		</rule>
	</rules>

[jtmelton]

@dscrobonia check my work please!

Based on the following sentence from https://github.com/jtmelton/appsensor/tree/master/analysis-engines/appsensor-analysis-rules:

An Expression is made up of one or more Clauses, where a Clause is a a group of monitor points along with AND operators. Clauses are separated within an Expression by the OR operator. An Expression will evaluate to true and be triggered if atleast one of it's Clauses evalutes to true. A Clause must be triggered within an interval of time called the Expression's window.

My suspicion is that you would need a single rule, 1 expression, and 3 clauses. That way, your rule would say if you saw 1 RE1 AND 1 RE2 AND 1 RE3, you would fire.

If you instead did 3 expressions, it would be ORs instead of ANDs.

Hope that helps!

[StenKoning]

Thanks, for actively responding to my question, I’ll look into it!