Sherlocked Security – Runtime Application Self-Protection (RASP)

Integrate Real-Time Threat Detection and Mitigation Directly into Your Application Stack

1. Statement of Work (SOW)

Service Name: Runtime Application Self-Protection (RASP) Assessment & Advisory
Client Type: Enterprises, FinTechs, Cloud-Native Apps, DevSecOps Teams
Service Model: Implementation Advisory, Configuration Hardening, Threat Simulation
Compliance Coverage: NIST 800-53, PCI-DSS, OWASP ASVS, ISO 27001, SOC 2

Assessment Types:

RASP Agent Evaluation and Integration Guidance
Runtime Threat Detection Accuracy Testing
Bypass Simulation and Defense Validation
Configuration Hardening and Alert Review
Integration with SIEM, APM, and DevSecOps Pipelines

2. Our Approach

[RASP Readiness Audit] → [Agent Selection & Integration] → [Runtime Threat Simulation] → [Policy Hardening] → [Alert & Telemetry Validation] → [Remediation Support] → [Post-Tuning Verification]

3. Methodology

[Environment Review] → [Agent Instrumentation] → [Exploit Simulation] → [Detection Review] → [False Positive Analysis] → [Alerting Workflow Review] → [Remediation Advisory] → [Hardening Guide]

4. Deliverables to the Client

RASP Readiness & Integration Report
Simulated Attack Results with Detection Efficacy
RASP Configuration Hardening Guidelines
False Positive and Alert Noise Analysis
SIEM and DevSecOps Integration Checklist
Runtime Exploit Detection Coverage Matrix
Tuning Recommendations for Rules & Policies
Post-Tuning Verification Report
Optional: SOC Dashboard Integration Template

5. What We Need from You (Client Requirements)

Application architecture and language/runtime details
Access to staging/test environment with RASP agent installed
Application logs, APM tools, or SIEM integration details
Sample attack payloads or known business logic flows
Admin access to RASP console/management UI
NDA and scope sign-off before kickoff

6. Tools & Technology Stack

RASP Solutions (Contrast Security, Dynatrace AppSec, Signal Sciences, Sqreen)
Custom Threat Simulation Toolkit
Burp Suite Pro + In-app exploit payloads
OWASP Threat Simulators (e.g., Juice Shop, WebGoat RASP mode)
Runtime Fuzzers & Injection Modules
Log Analysis & Alert Correlation Tools
Python/Java/.NET Hook Test Suites
Integration with SIEMs (Splunk, ELK, Sumo Logic) and CI/CD pipelines

7. Engagement Lifecycle

1. Kickoff & Architecture Mapping → 2. Agent Deployment → 3. Exploit Simulation Phase → 4. Alert & Detection Review → 5. False Positive Filtering → 6. Policy Hardening → 7. Final Tuning & Report

8. Why Sherlocked Security?

Feature	Sherlocked Advantage
Framework-Specific Simulation	Tailored tests for Java, .NET, Node.js, Python, etc.
Real-World Bypass Testing	Mimics attacker patterns to test actual protection logic
False Positive Mitigation	Focus on actionable alerts, not noisy logs
RASP Hardening Expertise	In-depth config guidance for rules, agents, and exceptions
SIEM/DevSecOps Compatibility	Pipeline-ready recommendations and integrations
Exploit Coverage Reports	Map detections to OWASP, CVE, and CWE standards

9. Real-World Case Studies

SaaS Product: Runtime SQL Injection Detection Failure

Issue: RASP agent failed to detect non-standard SQLi payloads.
Solution: Payload encodings and polymorphic queries were added to detection rules.
Outcome: Alert fidelity improved, detection rate increased to 98%.

Enterprise App: High Alert Noise in Production

Client: Fortune 500 Company
Findings: Excessive false positives from dynamic template engines and benign scripts.
Fix: Whitelisted known functions, added context-aware rules, integrated alerts into Splunk.
Outcome: Reduced alert fatigue and focused SOC on critical incidents.

10. SOP – Standard Operating Procedure

Application Architecture & Language Audit
RASP Agent Evaluation (Compatibility, Performance)
Agent Deployment & Hook Validation
Simulated Threat Injection (RCE, SQLi, XSS, Deserialization)
Detection & Alert Review
Rule Tuning & Whitelisting of Legitimate Flows
Integration with SIEM/APM for Alert Correlation
Verification of Hardening and Runtime Performance
Developer Training or Knowledge Transfer
Post-Deployment Monitoring & Final Report

11. RASP Testing & Tuning Checklist

1. RASP Deployment Validation

Confirm RASP agent instrumentation for all application components
Verify correct language and framework hooks (Java, .NET, Node.js, Python)
Validate agent injection on application boot/init phase
Check runtime resource overhead introduced by agent
Assess impact on logging, error handling, and normal operations

2. Runtime Exploit Simulation

SQL Injection (classic, time-based, blind) in input fields and headers
Command Injection payloads via headers, forms, or file names
Deserialization attacks in API payloads (Java, .NET, Python pickles)
File inclusion and path traversal attempts in download/upload handlers
XSS vectors (reflected, stored, DOM-based)
Insecure object references and ID tampering
Business logic abuse via parameter and workflow manipulation

3. Detection Accuracy & Alert Review

Capture alert logs for all exploit attempts
Categorize detections by severity, category, and confidence level
Validate alerts with actual exploit success/failure
Identify false negatives (missed exploits) and false positives (benign actions flagged)
Check for redundant or overly verbose alerts

4. Rule Tuning & Noise Reduction

Whitelist benign inputs or paths frequently flagged
Adjust sensitivity thresholds on specific rules (e.g., XSS or SQLi heuristics)
Disable or reconfigure noisy modules in low-risk paths
Define trusted sources to suppress irrelevant alerts from known IPs
Regularly audit and refine rule sets based on new violations

5. Business Logic & App-Specific Testing

Abuse valid business actions (e.g., cancel order, change price)
Simulate token reuse, replay attacks, and race conditions
Manipulate object ownership and resource isolation logic
Inject payloads in serialized objects or signed URLs
Confirm RASP tracks and blocks abnormal execution paths

6. Integration & Alerting Workflows

Integrate RASP alerts into existing SIEM or log pipeline
Configure alerts with structured metadata (source, payload, stack trace)
Add alert filtering rules to avoid alert fatigue in SOC tools
Link alert IDs to CVE/CWE/OWASP mappings where applicable
Implement alert suppression for known/acknowledged conditions

7. Policy & Configuration Hardening

Enable blocking mode on validated rules (SQLi, RCE, deserialization)
Configure rule exception logic for trusted code paths
Use application-specific whitelists for files, parameters, endpoints
Apply least-privilege model on RASP configuration (admin vs. viewer roles)
Log all blocked attacks for auditing, even if user-facing impact is mitigated

8. Post-Deployment Validation

Monitor application logs for performance or stability degradation
Simulate safe replays of earlier payloads to ensure RASP triggers properly
Reassess rules quarterly or after major feature changes
Establish internal documentation for dev teams on maintaining RASP hygiene

Real Time Application Self-Protection (RASP)