Run IAST with non-production deployments only to avoid exposing vulnerabilities on your production software.
You can set the New Relic Security agent configuration in the security section. These settings can be overridden with a newrelic.config.security prefixed system property. Options include:
Type
Boolean
Default
false
To completely disable all security functionality, set this flag to false. This property is read only once at application start. Default is false.
Type
Boolean
Default
false
Determines whether the security data is sent to New Relic or not. When this is disabled and agent.enabled is true, the security module will run but data will not be sent. Default is false.
Type
String
Default
IAST
New Relic Security provide mode: IAST. Default is IAST. Due to the invasive nature of IAST scanning, DO NOT enable this mode in either a production environment or an environment where production data is processed.
Type
String
Default
wss://csec.nr-data.net
New Relic Security's SaaS connection URL. This is the endpoint that the security agent sends data to, it should match that environment that you have set for the APM Java agent.
US Production: wss://csec.nr-data.net
Type
Boolean
Default
true
Enable RCI security event detection. Default is true.
Type
Boolean
Default
true
Enable RXSS security event detection. Default is true.
Type
Boolean
Default
true
Enable deserialization security event detection. Default is true.