Fix cloudtrail alerts with camelcase keys

alerts/cloudtrail_logging_disabled.py

@@ -18,10 +18,10 @@ class AlertCloudtrailLoggingDisabled(AlertTask):
 
         search_query.add_must([
             TermMatch('_type', 'cloudtrail'),
-            TermMatch('details.eventName', 'StopLogging'),
+            TermMatch('details.eventname', 'StopLogging'),
         ])
 
-        search_query.add_must_not(TermMatch('details.errorCode', 'AccessDenied'))
+        search_query.add_must_not(TermMatch('details.errorcode', 'AccessDenied'))
 
         self.filtersManual(search_query)
         self.searchEventsSimple()
@@ -32,6 +32,6 @@ class AlertCloudtrailLoggingDisabled(AlertTask):
         tags = ['cloudtrail', 'aws', 'cloudtrailpagerduty']
         severity = 'CRITICAL'
 
-        summary = 'Cloudtrail Logging Disabled: ' + event['_source']['details']['requestParameters']['name']
+        summary = 'Cloudtrail Logging Disabled: ' + event['_source']['details']['requestparameters']['name']
 
         return self.createAlertDict(summary, category, tags, [event], severity)

tests/alerts/test_cloudtrail_deadman.py

@@ -14,7 +14,7 @@ class TestAlertCloudtrailDeadman(AlertTestSuite):
         "_type": "cloudtrail",
         "_source": {
             "details": {
-                "eventName": "somename"
+                "eventname": "somename"
             }
         }
     }

tests/alerts/test_cloudtrail_logging_disabled.py

@@ -13,8 +13,8 @@ class TestAlertCloudtrailLoggingDisabled(AlertTestSuite):
         "_type": "cloudtrail",
         "_source": {
             "details": {
-               "eventName": "StopLogging",
-                "requestParameters": {
+               "eventname": "StopLogging",
+                "requestparameters": {
                     "name": "cloudtrail_example_name"
                 }
             }
@@ -61,7 +61,7 @@ class TestAlertCloudtrailLoggingDisabled(AlertTestSuite):
     )
 
     event = AlertTestSuite.create_event(default_event)
-    event['_source']['details']['eventName'] = 'Badeventname'
+    event['_source']['details']['eventname'] = 'Badeventname'
     test_cases.append(
         NegativeAlertTestCase(
             description="Negative test case with bad eventName",
@@ -80,7 +80,7 @@ class TestAlertCloudtrailLoggingDisabled(AlertTestSuite):
     )
 
     event = AlertTestSuite.create_event(default_event)
-    event['_source']['details']['errorCode'] = 'AccessDenied'
+    event['_source']['details']['errorcode'] = 'AccessDenied'
     test_cases.append(
         NegativeAlertTestCase(
             description="Negative test case with excluding errorCode",