streamalert
streamalert copied to clipboard
Feature: Designate which 'outputs' to live test
Background
The live-test
CLI command supports sending to defined outputs for a rule being tested. By default, this command will not mock out any of the outputs and will try to send the test alert to each one (aws/slack/pagerduty/etc).
Desired Change
Make it easier to send to only one type of service when invoking the live-test
command. This would allow testing services like Slack without having to test AWS services. This would have to perform some selective mocking of outputs (see here and here).
Note as mentioned in the Slack https://streamalert.slack.com/archives/C3BHE2Z0S/p1508539616000067 HTTPS requests are converted to HTTP due to moto
using httpretty
, which has this issue: https://github.com/gabrielfalcao/HTTPretty/issues/35
The workaround I've personally used is before making my HTTPS requests, I call:
from httpretty import HTTPretty
HTTPretty.disable()
Some other things I did to test this:
- Set
required=False
at https://github.com/airbnb/streamalert/blob/6a52f6a7950d51f85411e70f7e84f18de5320449/manage.py#L155 - Set
pass # self.setup_outputs(alert)
at https://github.com/airbnb/streamalert/blob/a9e7d3c2724a86970576bde3db3e7f2e64ec22bc/stream_alert_cli/test.py#L621 - Comment out https://github.com/airbnb/streamalert/blob/0b1ad9f689b8d045eb1a079d5ec5c88c4a64c68a/stream_alert/alert_processor/outputs.py#L470 and set
creds
to my Slack webhook.