
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
botbuilder-instrumentation
Advanced tools
This module is used to add instrumentation to bots built with [Microsoft Bot Framework](https://dev.botframework.com/). You can leverage the events from this module using [Ibex Dashboard](https://github.com/CatalystCode/ibex-dashboard).
This module is used to add instrumentation to bots built with Microsoft Bot Framework. You can leverage the events from this module using Ibex Dashboard.
Instrumentation Key
inside your bot registration page under Instrumentation key.This is an optional step in case you want user messages to be analised for setiments. Create a new Sentiment Analisys Service under Cognitive Services. When creating the service, make sure to mark Text Analytics - Preview.
You can use the following option for running locally.
APPINSIGHTS_INSTRUMENTATIONKEY={App Insights Instrumentation Key}
CG_SENTIMENT_KEY={Cognitive Services Text Analytics Key}
CG_SENTIMENT_KEY
is optional.
var instrumentation = require('botbuilder-instrumentation');
// Setting up advanced instrumentation
let logging = new instrumentation.BotFrameworkInstrumentation({
instrumentationKey: process.env.APPINSIGHTS_INSTRUMENTATIONKEY,
sentimentKey: process.env.CG_SENTIMENT_KEY,
});
let recognizaer = new builder.LuisRecognizer('...');
logging.monitor(bot, recognizer);
If you're not using a `LuisRecognizer', use the following code in addition:
var instrumentation = require('botbuilder-instrumentation');
// Setting up advanced instrumentation
let logging = new instrumentation.BotFrameworkInstrumentation({
instrumentationKey: process.env.APPINSIGHTS_INSTRUMENTATIONKEY,
sentimentKey: process.env.CG_SENTIMENT_KEY,
});
logging.monitor(bot);
Although CG_SENTIMENT_KEY
is optional, it is recommended if you're using Ibex Dashboard, in which case, adding sentiment analytsis will add sentiments overview to the dashboard along with a sentiment icon next to all conversations.
// Hook into the result function of QNA to extract relevant data for logging.
loggins.trackQNAEvent(context, userQuery, kbQuestion, kbAnswer, score);
You can see how to implement a QnA service here.
let logger = new instrumentation.BotFrameworkInstrumentation({
instrumentationKey: process.env.APPINSIGHTS_INSTRUMENTATIONKEY,
sentimentKey: process.env.CG_SENTIMENT_KEY,
// Will omit the user name from the logs for anonimization
omitUserName: true,
// Application insights options, all set to false by default
autoLogOptions: {
autoCollectConsole: true,
autoCollectExceptions: true,
autoCollectRequests: true,
autoCollectPerf: true // (auto collect performance)
}
customFields: {
userData: [ "CUSTOM_PROPERTY_1" ],
dialogData: [ "CUSTOM_PROPERTY_2" ],
conversationData: [ "CUSTOM_PROPERTY_3" ],
privateConversationData: [ "CUSTOM_PROPERTY_4" ]
}
});
The CUSTOM_PROPERTY
will be searched for in the session/context object of each event, and will be added automatically under customDimentions in Application Insights.
If it does not exist, it will not be added to the logged events.
You can use any, all or none of the property bags under session: userData
, conversationData
, privateConversationData
, dialogData
.
// This will show up as the event name in Application Insights.
let customEventName = 'myCustomEventName';
// Custom key-value data. It will be avaiable under the customDimentions column in Application Insights.
let customEventData = { customeDataA: 'customValueA', customDataB: 3 };
// You can log using context, in which case, session variables like timespan, userId etc will also be logged
logging.trackCustomEvent(customEventName, customEventData, context);
// You can log without a session/context
logging.trackCustomEvent(customEventName, customEventData);
// And you can log without an event name, in which case the event name will be 'MBFEvent.CustomEvent'
logging.trackEvent(customEventData);
You can see a working sample in morsh/bot-with-instrumentation
This project is licensed under the MIT License.
FAQs
This module is used to add instrumentation to bots built with [Microsoft Bot Framework](https://dev.botframework.com/). You can leverage the events from this module using [Ibex Dashboard](https://github.com/CatalystCode/ibex-dashboard).
The npm package botbuilder-instrumentation receives a total of 2 weekly downloads. As such, botbuilder-instrumentation popularity was classified as not popular.
We found that botbuilder-instrumentation demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.