def test_get_rule_stats(self):
"""Stats - Get Rule Stats"""
self._timed_func_helper()
result = stats.get_rule_stats()
assert_equal(
result,
'Rule statistics:\n\ntest_rule 10.00000000 ms 1 calls 10.00000000 avg'
)
def run(self, records):
"""Run rules against the records sent from the Classifier function
Args:
records (list): Dictionaries of records sent from the classifier function
Record Format:
{
'cluster': 'prod',
'log_schema_type': 'cloudwatch:cloudtrail',
'record': {
'key': 'value'
},
'service': 'kinesis',
'resource': 'kinesis_stream_name'
'data_type': 'json'
}
Returns:
list: Alerts that have been triggered by this data
"""
LOGGER.info('Processing %d records', len(records))
# Extract any threat intelligence matches from the records
self._extract_threat_intel(records)
alerts = []
for payload in records:
rules = Rule.rules_for_log_type(payload['log_schema_type'])
if not rules:
LOGGER.debug('No rules to process for %s', payload)
continue
for rule in rules:
# subkey check
if not self._process_subkeys(payload['record'], rule):
continue
# matcher check
if not rule.check_matchers(payload['record']):
continue
alert = self._rule_analysis(payload, rule)
if alert:
alerts.append(alert)
self._alert_forwarder.send_alerts(alerts)
# Only log rule info here if this is deployed in Lambda
# During testing, this gets logged at the end and printing here could be confusing
# since stress testing calls this method multiple times
if self._in_lambda:
LOGGER.info(get_rule_stats(True))
MetricLogger.log_metric(FUNCTION_NAME, MetricLogger.TRIGGERED_ALERTS,
len(alerts))
return alerts
def test_handler(options, config):
"""Handler for starting the test framework
Args:
options (argparse.Namespace): Parsed arguments
config (CLIConfig): Loaded StreamAlert config
Returns:
bool: False if errors occurred, True otherwise
"""
result = True
opts = vars(options)
repeat = opts.get('repeat', 1)
for i in range(repeat):
if repeat != 1:
print('\nRepetition #', i + 1)
result = result and TestRunner(options, config).run()
if opts.get('stats'):
print(get_rule_stats())
return result
def test_get_rule_stats_reset(self, ):
"""Stats - Get Rule Stats, Reset"""
self._timed_func_helper()
_ = stats.get_rule_stats(True)
assert_equal(len(stats.RULE_STATS), 0)
def test_get_rule_stats_empty(self, log_mock):
"""Stats - Get Rule Stats, None"""
stats.get_rule_stats()
log_mock.assert_called_with('No rule statistics to return')