Airlock Anomaly Shield cookies

Cookie name

Description

Example values

ML_ANOMALY

The cookie contains the same session tagging as the respective log message.

  • normal
  • anomalous
  • exception
  • redeemed

ENV_PREFIX_ML_ANOMALY=normal

ML_DATA

The payload is in JSON format and %-encoded.

Pretty printed example:

{
  "val": {
    "grm": 0.1,
    "ifo": 0.2,
    "scm": 0.3,
    "tcs": 0.4,
    "qpm": 0.5,
    "cba": 0.6
  },
  "thr": {
    "grm": 0.11,
    "ifo": 0.22,
    "scm": 0.33,
    "tcs": 0.44,
    "qpm": 0.55,
    "cba": 0.66
  }
}

There are two different JSON top-keys: "val" (= values) and "thr" (= thresholds).

  • For every top-key, the full set of machine learning models with their current raw values is included:
  • "grm" – graph metrics cluster
  • "ifo" – isolation forest
  • "scm" – status code meta
  • "tcs" – timing cluster
  • "qpm" – query parameters
  • "cba" – client behavior

ENV_PREFIX_ML_DATA=%7B%22val%22%3A%7B[...]%22tcs%22%3A0.66%7D%7D