airbnb / airbnb/streamalert

Improvement: validate arguments passed to the `@rule` decorator

Open
#879 2 comments 0 reactions 0 assignees View on GitHub
improvement rules
Dominant language
Python
Stars
2.9k
Forks
324
PR merge metrics
No merged PRs in 30d

Description

### Background

Currently, a `@rule` decorator can have numerous keyword arguments passed to it, such as `logs=`, `datatypes=`, `outputs=`, `context=`, etc...

### Description

There are cases where these keyword arguments could have either invalid value, or misconfigured values. For instance, `outputs` can be something like:

`{'aws-sns:test'}`

And then a `context` keyword argument could be defined as:

`{'pagerduty-v2:foo': {'bar': 'baz'}}`

This will not resolve in any major 'issues', but is a misconfiguration. The `outputs` should contains any output defined in a context object (or vice versa). We do some simple validation right now to ensure that [`logs` or `datatypes` are defined](https://github.com/airbnb/streamalert/blob/cb7e09100081799a944cb0ea29676526123bfda2/stream_alert/shared/rule.py#L115-L119), but that could be extended significantly.

## Desired Change

Validate the args to the best of our capability.

Contributor guide

Open the contributing guide

Research direction

Start in stream_alert/shared/rule.py around the existing logs and datatypes validation at lines 115-119. Review how the @rule decorator receives logs, datatypes, outputs, and context, then define validation coverage for invalid values and mismatches such as outputs not represented in context. Done means the decorator rejects or clearly reports the misconfigurations that the project can validate.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, python
Domain
security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.