airbnb / airbnb/streamalert

[publishers] Reduce redundancy of "output=" and "publishers=" on @rule

Open
#906 0 comments 0 reactions 0 assignees View on GitHub
alert publishers
Dominant language
Python
Stars
2.9k
Forks
324
PR merge metrics
No merged PRs in 30d

Description

## Background

With the advent of #900, we now have redundant information being provided to `@rule` constructors:

```
@Rule(
logs=['cloudtrail:misc'],
outputs=['slack:infra', 'pagerduty:high'],
publishers={
'slack:infra': [publisher_1, publisher_2],
'pagerduty:high': [publisher_3, publisher4],
}
)
```

Notably, the values in `outputs=` are duplicated in the keys of `publishers=` (when the requested publishers are in dict format). This increases the chance of accidentally registering a publisher to a nonexistent output, or vice versa.

## Desired Change

Refer to this comment: https://github.com/airbnb/streamalert/pull/900#discussion_r259464165

Contributor guide

Open the contributing guide

Research direction

Start with the discussion linked from the issue, then trace the @Rule constructor and how its outputs= and publishers= arguments are consumed. Done means removing the duplicated output names while preserving publisher registration and preventing publishers from targeting nonexistent outputs.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.