streamalert
streamalert copied to clipboard
airbnb
StreamAlert is a serverless, realtime data analysis framework which empowers you to ingest, analyze, and alert on data from any environment, using datasources and alerting logic you define.
Hi all I seen a previous fixed bug of Classifier throwing a "TypeError: unhashable type: 'dict'" for AWS Security Hub events. However this fix does not seem to have fixed...
## Background We have invested a lot of time in our current terraform implementation, but I'd like to open up the discussion of potentially moving to AWS SAM for stack...
### Description See the discussion in [this comment thread](https://github.com/airbnb/streamalert/pull/1295#discussion_r499799015).
## Background Having integration tests that designate more than one `trigger_rules` can make adding new integration tests annoyingly complicated. For instance, if a new test file is added that inadvertently...
## Background One issue we've encountered by using Normalization v2 internally is that we have rules that listen on normalized fields that are not interesting to extract into Artifacts, so...
## Background Based on the #1250, in order to cross join search original record between `artifacts` and original tables by `record_id`, it requires the original record to have `streamalert_normalization` field...
## Background PR #1250 refactored normalization feature and it moves the normalization configuration along with log schemas. That being said, `normalized_types.json` file is no long relevant. We will delete this...
## Background The `cloudwatch_monitoring` module is absolute 🗑️. Right now there is a janky dependency between the `kinesis` module and this one and it's easy to mess up. Also, the...
## Background Test events currently support `classify_only` type tests, but these still require having a `source` and `service` also set in the test event. ## Desired Change Make it possible...
## Background If you have historical search enabled and the `file_format` is set to `parquet`, bad news, we will be screwed if we change the type(s) in a log schema...