--- title: APM agent security: Java source: https://docs.newrelic.com/docs/apm/agents/java-agent/getting-started/apm-agent-security-java --- The New Relic Java agent default security settings automatically provide [security for your APM data](https://docs.newrelic.com/docs/using-new-relic/new-relic-security/security/apm-agent-data-security) to ensure data privacy and to limit the kind of information New Relic receives. You may have business reasons to change these settings. If you want to restrict the information that New Relic receives, you can enable [high-security mode](#restricted). If high-security mode or the default settings do not work for your business needs, you can apply [custom](#custom) settings. For more information about New Relic's security measures, see our [security and privacy documentation](https://docs.newrelic.com/docs/using-new-relic/new-relic-security/security/security-matters-data-privacy-new-relic), or visit the [New Relic security website](https://newrelic.com/security). ## Default security settings [#default] > #### ⚠️ CAUTION > > Stack traces cannot be obfuscated and may contain sensitive information, including SQL queries. For more information about ignoring errors, see [Java agent error configuration](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-error-configuration). By default, here is how the New Relic Java agent handles the following potentially sensitive data:: - Request parameters: The agent does not capture HTTP request parameters. - [HTTPS](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#cfg-ssl): The agent communicates with New Relic using HTTPS. - [SQL](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#tt-record_sql): The agent sets SQL recording to `obfuscated`, which removes the potentially sensitive numeric and string literal values. ## High-security mode settings [#restricted] When you [enable high-security mode](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#cfg-enable_high_security), the [default settings](#default) are locked so that users cannot change them. In addition: - The agent does not collect message queue parameters. - You cannot create [custom events](https://docs.newrelic.com/docs/insights/insights-data-sources/custom-data/insert-custom-events-new-relic-apm-agents#java-att). - You cannot implement [custom instrumentation using the Custom Instrumentation Editor](https://docs.newrelic.com/docs/agents/java-agent/custom-instrumentation/custom-instrumentation-editor-instrument-ui). - You cannot collect [user attributes](https://docs.newrelic.com/docs/insights/insights-data-sources/custom-attributes/collect-user-attributes-java). ## Custom security settings [#custom] > #### ⚠️ CAUTION > > If you customize security settings, it may impact the security of your application. If you need different security settings than default or high-security mode, you can customize these settings: - [Java agent configuration file](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file) - [Custom attributes](https://docs.newrelic.com/docs/agents/java-agent/attributes/enabling-disabling-attributes-java#NRaddCustomParameter) - [Java agent API](https://docs.newrelic.com/docs/agents/java-agent/custom-instrumentation/java-agent-api) | **Setting** | **Effects on data security** | | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | [`audit_mode`](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#cfg-audit_mode) _boolean_ | Default: `false` By default, the Java agent does not log all data sent to New Relic in the agent log file. If you set this to `true`, the agent logs data sent to the New Relic collector in the agent log file. You can then evaluate the information that the agent sends by reviewing the agent log file to see if it includes sensitive information. | | [`high_security`](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#cfg-enable_high_security) _boolean_ | Default: `false` To enable [high-security mode](#restricted), set this to `true` and [enable high security in New Relic](https://docs.newrelic.com/docs/agents/manage-apm-agents/configuration/high-security-mode#version2enabled). This restricts the information you can send to New Relic. | | [`proxy_host`](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#cfg-proxy_user) _string_ | Default: (none) Some proxies default to using HTTP, which is a less secure protocol. | | [`attributes.enabled`](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#cfg-attributes-enabled) _boolean_ | Default: `true` Default for the [Custom Instrumentation Editor](https://docs.newrelic.com/docs/agents/java-agent/custom-instrumentation/custom-instrumentation-editor-instrument-ui#options): `false` By default, you are sending [attributes](https://docs.newrelic.com/docs/agents/java-agent/attributes/enabling-disabling-attributes-java) to New Relic, except for methods instrumented using the Custom Instrumentation Editor. If you do not want to send attributes to New Relic, set this to `false`. | | [`attributes.exclude`](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#cfg-attributes-exclude) _string_ | Default: (none) If there are specific attribute keys that you do **not** want to send to New Relic in transaction traces, identify them using `attributes.exclude`. This restricts the information sent to New Relic. Consider if you want to exclude these potentially sensitive attributes using `attributes.exclude` or if you need the information sent to New Relic: - `request.headers.*`: Removes all request headers. (Note that HTTP headers that contain sensitive data such as `cookie` and `authorization` are never collected.) - `response.headers.*`: Removes all response headers. - `request_uri`: Removes the path for the transaction's incoming request. | | [`log_sql`](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#tt-log_sql) _boolean_ | Default: `false` By default, you are sending queries to New Relic using `record_sql`. If you want to log queries in the agent log file as well as send them to New Relic, set this to `true`. | | [`record_sql`](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#tt-record_sql) _string_ | Default: `obfuscated` By default, `record_sql` is set to `obfuscated`, which strips out the numeric and string literals. - If you do not want the agent to capture query information, set this to `off`. - If you want the agent to capture all query information in its original form, set this to `raw`. - When you enable [high-security mode](#restricted), this is automatically set to `obfuscated`. | | [`strip_exception_messages`](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#strip_exception_messages) _boolean_ | Default: `false` By default, this is set to `false`, which means that the agent sends messages from all exceptions to the New Relic collector. If you enable [high-security mode](#restricted), this is automatically changed to `true`, and the agent strips the messages from exceptions. If you are not using high-security mode but still want to strip messages from all exceptions except those in your [allow list](https://docs.newrelic.com/docs/agents/java-agent/configuration/java-agent-configuration-config-file#strip_exception_messages_whitelist), set this to `true`. | | [`custom_insights_events.enabled`](https://docs.newrelic.com/docs/insights/insights-data-sources/custom-data/insert-custom-events-new-relic-apm-agents#java-att) _boolean_ | Default: `true` By default, the agent records events sent to the Event API via `recordCustomEvent()`. If you enable [high-security mode](#restricted), this is automatically set to `false`. |