Review firewall activity
Monitor and analyze Package Firewall activity to understand which packages are blocked, which policies are violated, and how your development team uses open-source components.
Review firewall analysis activity
Use this tab to view a summary of recent firewall traffic. To review analysis results for a specific package version installed through the firewall, select the package name from the dropdown list. The results for that package appear after you make a selection and show why the package version failed analysis and was blocked by the firewall.
By default, Package Firewall treats unprocessed packages as failures to prevent running code that has not been analyzed. Any unprocessed package is automatically staged for processing, so the safest option is to wait until processing completes.
You can add exceptions to bypass this behavior.
A package version can fail analysis for one of the following reasons:
- It violates one or more policies. The violated policies are listed in the results.
- It’s incomplete, and the firewall isn’t configured to accept incomplete packages. This can happen when the analysis of the package hasn’t completed yet and the firewall policy specifies that incomplete packages shouldn’t be accepted.
Before you begin:
- You must have a Veracode account in the Commercial region with the Administrator, Reviewer, Submitter, Mitigation Approver, Policy Administrator, or Security Lead role for Package Firewall. Package Firewall currently doesn't support accounts in the United States Federal region.
To complete this task:
- Sign in to the Veracode Platform.
- Select Policies > Firewall.
- Select the firewall you want to monitor.
- Select the Activity tab to review version discovery activity. For details on how Package Firewall protects your systems during this phase, see Review version discovery activity.
- Select the Downloads tab to review package downloads. For details on how Package Firewall protects your systems during this phase, see Review package downloads.
How package installation works
Package Firewall protects your systems by enforcing policies during two distinct phases of the installation process. In the first phase, when your system queries available package versions, Package Firewall applies your policy to block risky packages from entering your lockfile. In the second phase, when your system downloads the selected package, Package Firewall enforces your policy again to provide a second layer of protection before the package reaches your systems.
When you install packages from open-source package management ecosystems like npm or Maven, your system performs these steps:
- Request available versions: your system queries the package ecosystem for available versions of a package. This step typically occurs only when you need to update a lockfile or create a new one.
- Download a specific version: your system selects an appropriate version, adds it to your lockfile, and requests that specific version from the package ecosystem.
Review version discovery activity
The Activity tab logs when your system queries available package versions. During this phase, Package Firewall applies your policy to block risky or malicious packages from being selected and entering your lockfile.
Review package downloads
The Downloads tab logs when your system downloads specific package versions. During this phase, Package Firewall applies your policy again to block or warn about suspicious or malicious packages, providing a second layer of protection before packages reach your systems.
Review downloads through firewall
View a list of downloaded packages.
Before you begin:
- You must have a Veracode account in the Commercial region with the Administrator, Reviewer, Submitter, Mitigation Approver, Policy Administrator, or Security Lead role. Package Firewall currently doesn't support accounts in the United States Federal region.
To complete this task:
- Sign in to the Veracode Platform.
- Select Policies > Firewall.
- Select the firewall for which you want to view package downloads.
- To view download activity, navigate to the Downloads tab.