streamalert
streamalert copied to clipboard
Improvement: validate arguments passed to the `@rule` decorator
Background
Currently, a @rule
decorator can have numerous keyword arguments passed to it, such as logs=
, datatypes=
, outputs=
, context=
, etc...
Description
There are cases where these keyword arguments could have either invalid value, or misconfigured values. For instance, outputs
can be something like:
{'aws-sns:test'}
And then a context
keyword argument could be defined as:
{'pagerduty-v2:foo': {'bar': 'baz'}}
This will not resolve in any major 'issues', but is a misconfiguration. The outputs
should contains any output defined in a context object (or vice versa). We do some simple validation right now to ensure that logs
or datatypes
are defined, but that could be extended significantly.
Desired Change
Validate the args to the best of our capability.
The misconfigure of outputs would result the alert processor
failed to dispatch alerts with error message The output 'pagerduty-wrong-version:bar' does not exist!
Another common error:
When passing context=
to the @rule
annotation, the rule function needs to have a 2nd argument. If it's not provided, it will error out.
Another error:
You can now provide publishers=...
, but it's possible to provide publishers for outputs
that have not been added. When doing so, the publishers=
code will do nothing.