Merge pull request #566 from mozilla/fix_camelcase_alert

Fix camelcase alert
This commit is contained in:
A Smith 2017-12-06 18:05:28 -06:00 коммит произвёл GitHub
Родитель 761f16423d 37c51798cc
Коммит 78fcd5b632
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4AEE18F83AFDEB23
4 изменённых файлов: 13 добавлений и 8 удалений

Просмотреть файл

@ -18,10 +18,10 @@ class AlertCloudtrailLoggingDisabled(AlertTask):
search_query.add_must([
TermMatch('_type', 'cloudtrail'),
TermMatch('details.eventName', 'StopLogging'),
TermMatch('details.eventname', 'StopLogging'),
])
search_query.add_must_not(TermMatch('details.errorCode', 'AccessDenied'))
search_query.add_must_not(TermMatch('details.errorcode', 'AccessDenied'))
self.filtersManual(search_query)
self.searchEventsSimple()
@ -32,6 +32,6 @@ class AlertCloudtrailLoggingDisabled(AlertTask):
tags = ['cloudtrail', 'aws', 'cloudtrailpagerduty']
severity = 'CRITICAL'
summary = 'Cloudtrail Logging Disabled: ' + event['_source']['details']['requestParameters']['name']
summary = 'Cloudtrail Logging Disabled: ' + event['_source']['details']['requestparameters']['name']
return self.createAlertDict(summary, category, tags, [event], severity)

Просмотреть файл

@ -14,7 +14,7 @@ class TestAlertCloudtrailDeadman(AlertTestSuite):
"_type": "cloudtrail",
"_source": {
"details": {
"eventName": "somename"
"eventname": "somename"
}
}
}

Просмотреть файл

@ -13,8 +13,8 @@ class TestAlertCloudtrailLoggingDisabled(AlertTestSuite):
"_type": "cloudtrail",
"_source": {
"details": {
"eventName": "StopLogging",
"requestParameters": {
"eventname": "StopLogging",
"requestparameters": {
"name": "cloudtrail_example_name"
}
}
@ -61,7 +61,7 @@ class TestAlertCloudtrailLoggingDisabled(AlertTestSuite):
)
event = AlertTestSuite.create_event(default_event)
event['_source']['details']['eventName'] = 'Badeventname'
event['_source']['details']['eventname'] = 'Badeventname'
test_cases.append(
NegativeAlertTestCase(
description="Negative test case with bad eventName",
@ -80,7 +80,7 @@ class TestAlertCloudtrailLoggingDisabled(AlertTestSuite):
)
event = AlertTestSuite.create_event(default_event)
event['_source']['details']['errorCode'] = 'AccessDenied'
event['_source']['details']['errorcode'] = 'AccessDenied'
test_cases.append(
NegativeAlertTestCase(
description="Negative test case with excluding errorCode",

Просмотреть файл

@ -94,5 +94,10 @@ class TestTermMatchNegativeTestSuite(NegativeTestSuite):
TermMatch('somekey', 'tag'): [
{'somekey': ['atag', 'tagging']},
],
TermMatch('CamelCaseKey', 'test'): [
{'camelcasekey': 'test'},
{'camelCaseKey': 'test'},
{'camelcaseKey': 'test'},
],
}
return tests