streamalert
streamalert copied to clipboard
Improvement: validate arguments passed to the `@rule` decorator
Background
Currently, a @rule decorator can have numerous keyword arguments passed to it, such as logs=, datatypes=, outputs=, context=, etc...
Description
There are cases where these keyword arguments could have either invalid value, or misconfigured values. For instance, outputs can be something like:
{'aws-sns:test'}
And then a context keyword argument could be defined as:
{'pagerduty-v2:foo': {'bar': 'baz'}}
This will not resolve in any major 'issues', but is a misconfiguration. The outputs should contains any output defined in a context object (or vice versa). We do some simple validation right now to ensure that logs or datatypes are defined, but that could be extended significantly.
Desired Change
Validate the args to the best of our capability.
The misconfigure of outputs would result the alert processor failed to dispatch alerts with error message The output 'pagerduty-wrong-version:bar' does not exist!
Another common error:
When passing context= to the @rule annotation, the rule function needs to have a 2nd argument. If it's not provided, it will error out.
Another error:
You can now provide publishers=..., but it's possible to provide publishers for outputs that have not been added. When doing so, the publishers= code will do nothing.