Event Handlers
Event Handlers
Event handlers run custom JavaScript for security policies and integrations.
Click Server Settings
Click Event Handlers
Grid and row actions
| Action | Description |
|---|---|
| Edit | Open the handler editor |
| Create Like | Duplicate a handler |
| Validate | Validate the script |
| Schedule As Job | Create a scheduled job from a Triggered Event handler |
| Delete | Remove the handler |
Create or edit
Click Add (or Edit an existing handler)
Tabs: Script | Permissions
Script tab
| Field | Description |
|---|---|
| Name | Handler reference (identifier) |
| Event Type | See types below |
| Script body | JavaScript editor (API help is available in the UI) |
Event types
| UI label | Value | Script arguments (headers) |
|---|---|---|
| Triggered Event | trigger | args |
| HTTP Request | http_request | session, request, response |
| HTTP Response | http_response | session, response |
| Websocket Text Frame | text_frame | frame, isServerFrame, response |
| Rule | rule | facts |
| Policy Request | request | request |
| Policy Data Processing | policy_data | context |
Permissions tab
Capability checkboxes. Unchecked permissions are denied at runtime. Legacy handlers with no stored list appear fully checked until you save.
| Permission | Description |
|---|---|
| EVENT HANDLER HTTP | Call outbound HTTP (mamori.httpGet / mamori.httpPost) |
| ALERT | Fire alerts (mamori.alert) |
| SET SYSTEM PROPERTY | Read server properties (mamori.getServerProperty) |
| MAMORI SECURITY CATALOG | List duplicate portal sessions (mamori.getDuplicateSessions) |
| KILL SESSION | Terminate sessions (mamori.killSession) |
| REVEAL SECRET | Call mamori.getSecret (secret-level REVEAL SECRET still required) |
Click Create / save to store the handler
Examples
Row Limit Event Handler
var alert_name = mamori.getServerProperty("row_limit_alert", "default_row_limit_violation");
var rs = mamori.query("select username, system_name, database_name, schema_name, table_name, row_limit, row_count, limit_period, description from sys.row_access_limit_violations a join sys.row_access_limits b on a.row_limit_id=b.id");
try {
while(rs.next()) {
var facts = mamori.makeFacts(rs, ["username", "system_name", "database_name", "schema_name", "table_name"]);
LOGGER.info("Row limit violation found: " + facts.toJSON());
mamori.alert(alert_name, facts);
}
} finally {
rs.close();
}
Unmasked PII Columns
var rs = mamori.query("select t.systemname, t.schemaname, c.databasename as database_name, t.tablename as table_name, c.columnname as column_name, c.columndatatype as data_type from (select * from SYS.MAMORICOLUMNS a join mamori.mamorisys.rms.syssearchexpressions b on lower(a.columnname) like b.rule where SYSTEMID = 16 and columndatatype like '%char%' ) c join (select * from SYS.MAMORITABLES where SYSTEMID =16) t on c.referenceid=t.tableid and c.systemname = t.systemname where not exists (select 'x' from SYS.MASKING_EXCLUSIONS e where e.objectid = t.tablename) and not exists (select 'x' from SYS.COLUMN_MASKING_RULES m where m.systemid=c.systemid and m.databasename = c.databasename and t.schemaname = m.schemaid and m.tableid = t.tablename and m.columnname = c.columnname and m.operation in ('MASKED','TRANSFORMED'))");
try {
out.write("**** Unmasked PII Column check start.");
while(rs.next()) {
var facts = mamori.makeFacts(rs, ["systemname", "schemaname", "database_name", "table_name", "column_name","data_type"]);
LOGGER.info("Unmasked PII Column violation found: " + facts.toJSON());
out.write("Unmasked PII Column violation found: " + facts.toJSON());
mamori.alert('unmasked_pii_columns', facts);
}
} finally {
rs.close();
}