---
title: Java agent security settings
source: https://docs.newrelic.com/docs/apm/agents/java-agent/configuration/java-agent-configuration-security-settings
---

Security settings configure the New Relic security agent for vulnerability detection and real-time application security monitoring (IAST).

> #### 💡 TIP
>
> Back to the full settings index: [Java agent configuration](https://docs.newrelic.com/docs/apm/agents/java-agent/configuration/java-agent-configuration-config-file)

## Security Agent [#sec-agent]

[New Relic Security agent interactive applications security testing](https://docs.newrelic.com/docs/iast/introduction/) (IAST) tests your applications for any exploitable vulnerability by replaying the generated HTTP request with vulnerable payloads.

> #### ⚠️ IMPORTANT
>
> Run IAST with non-production deployments only to avoid exposing vulnerabilities on your production software.

You can set the New Relic Security agent configuration in the `security` section. These settings can be [overridden](https://docs.newrelic.com/docs/apm/agents/java-agent/configuration/java-agent-configuration-config-file#System_Properties) with a `newrelic.config.security` prefixed system property. Options include:

**agent.enabled**

| Type    | Boolean |
| ------- | ------- |
| Default | `false` |

To completely disable all security functionality, set this flag to false. This property is read only once at application start. Default is false.

**enabled**

| Type    | Boolean |
| ------- | ------- |
| Default | `false` |

Determines whether the security data is sent to New Relic or not. When this is disabled and agent.enabled is true, the security module will run but data will not be sent. Default is false.

**mode**

| Type    | String |
| ------- | ------ |
| Default | `IAST` |

New Relic Security provide mode: IAST. Default is IAST. Due to the invasive nature of IAST scanning, DO NOT enable this mode in either a production environment or an environment where production data is processed.

**validator_service_url**

| Type    | String                   |
| ------- | ------------------------ |
| Default | `wss://csec.nr-data.net` |

New Relic Security's SaaS connection URL. This is the endpoint that the security agent sends data to, it should match that environment that you have set for the APM Java agent.

US Production: wss://csec.nr-data.net

**detection.rci.enabled**

| Type    | Boolean |
| ------- | ------- |
| Default | `true`  |

Enable RCI security event detection. Default is true.

**detection.rxss.enabled**

| Type    | Boolean |
| ------- | ------- |
| Default | `true`  |

Enable RXSS security event detection. Default is true.

**detection.deserialization.enabled**

| Type    | Boolean |
| ------- | ------- |
| Default | `true`  |

Enable deserialization security event detection. Default is true.

> #### ⚠️ IMPORTANT
>
> New Relic Security agent interactive applications security testing (IAST) mode requires [Java agent version 8.4.0 or higher](https://docs.newrelic.com/docs/agents/java-agent/installation/upgrade-java-agent).