Track custom events

This guide will help you track custom events using the Sqreen SDK and automate security scenarios. Visit the security automation section to learn more.

The Sqreen SDK stores events locally in a queue until the next heartbeat. Every minute, it flushes tracked events to our servers. When your app exits, it flushes any remaining tracked events.

To complete this guide, you should have installed our library in your application. Follow the installation steps described here.

Tracking events

You can use the track SDK method to record your custom events.

To track a custom event, you need to name it:

const Sqreen = require('sqreen');
Sqreen.track(event.name)

Our SDK supports optional parameters, such as properties:

const Sqreen = require('sqreen');
Sqreen.track(event.name, {properties: {foo: 'bar'}})

When creating automation playbooks using this event, you can use those properties to group events and apply conditions and detections.

Default properties

Out of the box, the Sqreen library collects some properties based on the HTTP request:

• Client IP.
• User agent.
• Path requested.
• Request HTTP verb.
• HTTP parameters.

By default, the Sqreen SDK scrubs sensitive data from these properties. See PII scrubbing

Track method definition

const Sqreen = require('sqreen');
Sqreen.track(event_name, [options])

• event_name is a string. This is the name of the event you're tracking.
• options enables you to provide additional parameters. This is an object with the following fields:
  • properties: an object with arbitrary parameters to record custom event dimensions. This parameter is optional. You can provide up to 16 properties per event.
  • user_identifiers: user account which performed the event. This should be the same object provided to Sqreen.identify, Sqreen.auth_track or Sqreen.signup_track method when used. This parameter is optional.
  • timestamp: a Date object if you want to manually set the event’s timestamp. By default, the SDK used the current server time. This parameter is optional.
  • collect_body: a boolean. If true, the Sqreen SDK collects the value in req.body links it to the event. The track method does not collect the requests HTTP body by default.
  • request: a request object. Sqreen should automatically populate this field with the current request. If it cannot find it, you must add it manually

User tracking

If you want to associate the event tracked with a user account, you can decide to either pass it to every track call or rely on the identify method to set it in the context of the current HTTP request.

Providing track with user identifiers overrides the identify value for the context of this event.

Block users

To block users you must implement the identify method.

Track events from the past

When getting started with Sqreen, it can be useful to import past events. This lets you start with an existing dataset and automate scenarios right away.

When tracking an event, using the optional timestamp parameter overrides the current server time.

const Sqreen = require('sqreen');

const event_date = new Date(2018, 3, 15, 14, 42, 0)
Sqreen.track(event.name, {
    properties: {foo: 'bar'},
    timestamp: event_date
})

Integration with Express

Sqreen provides middleware to simplify the integration with Express. Here is an example:

const Sqreen = require('sqreen');

// Register the Sqreen Express middleware in the app
app.use(Sqreen.middleware)

app.get('/path/:parameter', (req, res, next) => {
    req.sqreen.track('foobar', {
        properties: {
            prop1: 'value1',
            prop2: 'value2'
        }
    });
    // rest of the code goes here
});

Monitor events

Congratulations! You've set up the Sqreen SDK and tracked your first custom events.

Now, go to your dashboard and visit the Event Explorer to check the events are properly recorded by Sqreen.

Next, depending on your traffic and the frequency of the tracked events, you may want to wait a few hours or days to collect enough events to craft a playbook.

Create a security automation playbook

Once you are ready to automate a scenario, go to your dashboard and visit the Playbooks section to start building an automation playbook.

Error handling

Things can sometimes go wrong. This section features the most frequent issues when using our SDK.

Events recording

If the Sqreen agent does not manage to flush events collected in the past minute to our servers, it keeps retrying. After some time, it drops the events to prevent Sqreen memory overhead growing and impacting your application's performance.