streamalert icon indicating copy to clipboard operation
streamalert copied to clipboard

Improvement: validate arguments passed to the `@rule` decorator

Open ryandeivert opened this issue 6 years ago • 2 comments

Background

Currently, a @rule decorator can have numerous keyword arguments passed to it, such as logs=, datatypes=, outputs=, context=, etc...

Description

There are cases where these keyword arguments could have either invalid value, or misconfigured values. For instance, outputs can be something like:

{'aws-sns:test'}

And then a context keyword argument could be defined as:

{'pagerduty-v2:foo': {'bar': 'baz'}}

This will not resolve in any major 'issues', but is a misconfiguration. The outputs should contains any output defined in a context object (or vice versa). We do some simple validation right now to ensure that logs or datatypes are defined, but that could be extended significantly.

Desired Change

Validate the args to the best of our capability.

ryandeivert avatar Jan 18 '19 18:01 ryandeivert

The misconfigure of outputs would result the alert processor failed to dispatch alerts with error message The output 'pagerduty-wrong-version:bar' does not exist!

chunyong-lin avatar Jan 18 '19 22:01 chunyong-lin

Another common error:

When passing context= to the @rule annotation, the rule function needs to have a 2nd argument. If it's not provided, it will error out.

Another error:

You can now provide publishers=..., but it's possible to provide publishers for outputs that have not been added. When doing so, the publishers= code will do nothing.

Ryxias avatar Apr 01 '19 22:04 Ryxias