SC07-TC02: Application Security with Tanzu Service Mesh (TSM) - Threat Detection Using TSM

This scenario captures how to detect hacking attempts to an application running on TSM.

Test Case Summary

This scenario walks through how to create a Threat Detection Policy to capture hacking attempts to the ACME Fitness Application via the TSM UI.

Completion of TSM Console access SC01-TC01
For Kubernetes Cluster ${KUBERNETES_CLUSTER1} completion of TSM Onboarding SC02-TC01 or SC02-TC02 or SC02-TC03
Completion of ACME Fitness Application Deployment SC03-TC01
Completion of GNS Creation SC03-TC02 or SC03-TC03

This test procedure assumes that the full ACME Fitness Application was deployed to the Kubernetes Cluster ${KUBERNETES_CLUSTER1}.

On the TSM UI from the left menu select Policy > Threat Detection and click NEW POLICY to create a new Threat Detection Policy.

Expected:
On the New Attack Detection Policy dialog enter a policy name and select the previously created Global Namespace (GNS). Make sure the SQL INJECTION request attack is selected and click NEXT.

Expected:
Use the default selection Level 1 (Low) for the advanced settings and select NEXT.

Expected:
For policy targets keep the default All Services in the GNS and select NEXT.

Expected:
Validate the data entered for the Threat Detection Policy and click SAVE to create it.

Expected:
Confirm the Threat Detection Policy was created.

Expected:
From a browser go to your deployed ACME Fitness Application and paste the following SQL Injection script that will attack the catalog service product page.
```
http://${ACME_FITNESS_FQDN}/products?id=productId%22%20UNION%[%E2%80%A6]20database(),2,3,4,5,6,7%20--+
```
Expected:
Back in the TSM UI navigate back to the GNS Topology Inventory > Global Namespace and toggle the Attacks button to display the SQL Inejection attack.

Expected:
Validate that the SQL Injection attack was also captured under the Security > Security Events dashboards and that details of the event are accessible.

Expected: