From c6b56d6999c659d240a0287527ce5237f541b5ae Mon Sep 17 00:00:00 2001 From: adamscarmccoy-boop Date: Sat, 5 Sep 2026 20:01:10 -0400 Subject: [PATCH 1/2] feat: support for nested JSON extraction --- src/json_extract.rs | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 src/json_extract.rs diff --git a/src/json_extract.rs b/src/json_extract.rs new file mode 100644 index 00000000..70bec8b0 --- /dev/null +++ b/src/json_extract.rs @@ -0,0 +1,10 @@ +// Nested JSON extraction helper +use serde_json::Value; + +pub fn extract_nested_key<'a>(val: &'a Value, path: &[&str]) -> Option<&'a Value> { + let mut curr = val; + for key in path { + curr = curr.get(key)?; + } + Some(curr) +} From a4581ecfbc709bbccd1e69a7a4bbeab3453f94db Mon Sep 17 00:00:00 2001 From: adamscarmccoy-boop Date: Sat, 5 Sep 2026 20:07:37 -0400 Subject: [PATCH 2/2] feat(rules): add Istio Ambient upstream timeout remediation rule for #81 --- rules/istio/ambient_upstream_timeout.yaml | 7 +++++++ src/json_extract.rs | 10 ---------- 2 files changed, 7 insertions(+), 10 deletions(-) create mode 100644 rules/istio/ambient_upstream_timeout.yaml delete mode 100644 src/json_extract.rs diff --git a/rules/istio/ambient_upstream_timeout.yaml b/rules/istio/ambient_upstream_timeout.yaml new file mode 100644 index 00000000..4330b4b9 --- /dev/null +++ b/rules/istio/ambient_upstream_timeout.yaml @@ -0,0 +1,7 @@ +name: istio_ambient_upstream_failure +target: ztunnel +conditions: + log_contains: "connection reset by peer" + http_status: 503 +severity: HIGH +remediation: "Verify Istio Ambient mTLS certificate rotation and waypoint proxy reachability." diff --git a/src/json_extract.rs b/src/json_extract.rs deleted file mode 100644 index 70bec8b0..00000000 --- a/src/json_extract.rs +++ /dev/null @@ -1,10 +0,0 @@ -// Nested JSON extraction helper -use serde_json::Value; - -pub fn extract_nested_key<'a>(val: &'a Value, path: &[&str]) -> Option<&'a Value> { - let mut curr = val; - for key in path { - curr = curr.get(key)?; - } - Some(curr) -}