Skip AppSec for non-HTTP Lambda triggers and report _dd.appsec.unsupported_event_type

[claponcet]

What Does This Do

Emits _dd.appsec.unsupported_event_type for Lambda requests that are not HTTP/HTTP-like requests.

• LambdaAppSecHandler.processRequestStart now returns early (with a debug log) for any trigger the parser does not recognise as HTTP, so no WAF request callback fires and no AppSec request context is created.
• LambdaAppSecHandler.processRequestEnd sets the numeric span metric _dd.appsec.unsupported_event_type = 1 on those invocations, so the span explicitly reports that AppSec did not process it. The metric is only emitted when AppSec is active.
• LambdaEventParser.isHttp() becomes an explicit whitelist of the five HTTP trigger types, so any trigger type added later defaults to non-HTTP until it is deliberately listed.
• LambdaEventParser.extractGenericData (~60 lines) is removed: with the skip in place, its result was never consumed. parseEvent's default branch now returns LambdaRequestData.EMPTY.

Motivation

Before this change, an unrecognised Lambda event was still fed to the WAF on whatever method / path / headers could be scraped from an arbitrary payload — best-effort scanning of data that is not an HTTP request. dd-trace-py (_processor.py, via datadog_lambda/asm.py) and datadog-lambda-js (src/appsec/index.ts) both skip AppSec entirely in that case and mark the span with _dd.appsec.unsupported_event_type. The metric is tracer-side only; the Lambda extension does not emit it.

system-tests Test_AppSecEventSpanTags::test_custom_span_tags (scenario appsec_lambda_default) treats the metric as the sanctioned opt-out: a serverless span carrying it is exempted from the _dd.appsec.enabled / _dd.runtime_family assertions.

Additional Notes

• The metric is written at request end rather than request start because processRequestStart runs before the invocation span exists, and a value carried through TagContext would land in meta as a string rather than in metrics.
• A genuinely-HTTP event whose shape detectTriggerType fails to recognise now loses best-effort coverage instead of degrading to it — matching Python and JS, and making the span state honest.
• One pre-existing test expectation changed: responseCallbacksSkipNonApiGatewayResponseForNonHttpEvent asserted appSecEnded for a non-HTTP event; with the skip there is no request context to end.

Contributor Checklist

• Format the title according to the contribution guidelines
• Assign the type: and (comp: or inst:) labels in addition to any other useful labels
• Avoid using close, fix, or any linking keywords when referencing an issue
  Use solves instead, and assign the PR milestone to the issue
• Update the CODEOWNERS file on source file addition, migration, or deletion
• Update public documentation with any new configuration flags or behaviors
• Once approved, use merge queue to merge the PR

🤖 Generated with Claude Code

[datadog-prod-us1-5]

🎯 Code Coverage (details)
• Patch Coverage: 75.00%
• Overall Coverage: 58.87% (+0.28%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 2ffcab5 | Docs | View more details | Give us feedback!}

[dd-octo-sts]

🟢 Java Benchmark SLOs — All performance SLOs passed

Suite	Status
Startup	🟢 pass

SLO thresholds are defined here based on automatically generated metrics. A warning is raised when results are within 5% of the threshold.

PR vs. master results

Scenario	Candidate	master	Δ (95% CI of mean)
startup:insecure-bank:iast:Agent	13.88 s	13.91 s	[-0.8%; +0.3%] (no difference)
startup:insecure-bank:tracing:Agent	12.94 s	12.94 s	[-0.8%; +0.8%] (no difference)
startup:petclinic:appsec:Agent	17.02 s	16.82 s	[+0.0%; +2.3%] (maybe worse)
startup:petclinic:iast:Agent	16.98 s	16.95 s	[-0.7%; +1.0%] (no difference)
startup:petclinic:profiling:Agent	16.75 s	16.77 s	[-1.2%; +1.0%] (no difference)
startup:petclinic:sca:Agent	16.66 s	16.60 s	[-0.4%; +1.1%] (no difference)
startup:petclinic:tracing:Agent	16.11 s	16.16 s	[-1.0%; +0.4%] (no difference)

Commit: 2ffcab51 · CI Pipeline · Benchmarking Platform UI

---

Load and DaCapo benchmarks can be triggered manually in the GitLab pipeline. Results will appear in the Benchmarking Platform UI after completion.

[claponcet]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ab36aee085

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[datadog-prod-us1-5]

A non-HTTP Lambda handler that throws does not run AppSec request-end processing. Its error span therefore lacks the unsupported-event metric.

_{Open Bits AI session}

_{🤖 Datadog Autotest · Commit 2ffcab5 · What is Autotest? · @DataDog review to ask questions · Any feedback? Reach out in #autotest}