airbnb / airbnb/streamalert

Improvement - support for output configuration validation

Open
#199 0 comments 0 reactions 1 assignee Claimed by @ryandeivert View on GitHub
improvement
Dominant language
Python
Stars
2.9k
Forks
324
PR merge metrics
No merged PRs in 30d

Description

## Background ##
StreamAlert supports a handful of output services (Slack, AWS S3, AWS Lambda, PagerDuty, Phantom...), each which may require different properties for their configuration. For instance, Phantom requires a url for the running Phantom instance, while Lambda requires a function name & optional qualifier/alias.

## The Problem ##
The output classes are designed to 'prompt' the user the input values for these arbitrary properties. The current implementation allows us to restrict certain _characters_ from user input (ie - spaces cannot be entered when asking for a URL).. This logic falls apart when you need to restrict the user to entering a value that contains, say, 1 colon character, but not 2. In the instance of Lambda as an output, we want the user to provide a `function_name:optional_qualifier` string. If they enter a **full arn value** instead (`arn:aws:lambda:us-west-2:account-id:function:func_name:qualifier`), we would like to detect this and stop it. This might not be a real-world example, but gives you an idea of the type of advanced input checking we need to be able to perform.

## Proposed Solution ##
We should build upon the concept of input restrictions, and allow each `OutputProperty` that requires user input to contain an actual function address (class?) that could be used for input validation. We could either have the output classes contain their own validation functions, or build a class within the alert processor package that would be designed to house all the input validation functions (initializer accepts 'enum' sort of value that could decide which validation function to run on input). Some of the simpler ones could even just use Python lambda functions for this.. These 'functions' would just return `True` if the input passed validation, or `False` if it failed.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.