def setup(self): """Alert Merger - Alert Table - Add mock alerts to the table""" # pylint: disable=attribute-defined-outside-init self.dynamo_mock = mock_dynamodb2() self.dynamo_mock.start() setup_mock_alerts_table(_ALERTS_TABLE) self.alert_table = main.AlertTable(_ALERTS_TABLE) with self.alert_table.table.batch_writer() as batch: for i in range(3): batch.put_item( Item={ 'RuleName': 'even' if i % 2 == 0 else 'odd', 'AlertID': 'alert-{}'.format(str(i)), 'Created': '2018-03-14', 'Cluster': 'test-cluster', 'LogSource': 'test-log-source', 'LogType': 'json', 'RuleDescription': 'even' if i % 2 == 0 else 'odd', 'SourceEntity': 'test-source-entity', 'SourceService': 'test-source-service', 'Outputs': {'aws-s3:test-bucket', 'slack:test-channel'}, 'Record': json.dumps({ 'key1': 'value1', 'key2': 'value2' }) })
def setup(self): """Alert Merger - Setup""" self.dynamo_mock = mock_dynamodb2() self.lambda_mock = mock_lambda() self.dynamo_mock.start() self.lambda_mock.start() create_lambda_function(_ALERT_PROCESSOR, 'us-east-1') setup_mock_alerts_table(_ALERTS_TABLE) self.merger = main.AlertMerger.get_instance()
def setup(self): """Alert Table - Create mock table and alerts""" # pylint: disable=attribute-defined-outside-init self.dynamo_mock = mock_dynamodb2() self.dynamo_mock.start() setup_mock_alerts_table(_ALERTS_TABLE) self.alert_table = alert_table.AlertTable(_ALERTS_TABLE) self.alerts = [ alert_module.Alert( 'even' if i % 2 == 0 else 'odd', {'key1': 'value1', 'key2': 'value2'}, {'aws-firehose:alerts', 'aws-s3:test-bucket', 'slack:test-channel'}, ) for i in range(3) ] self.alert_table.add_alerts(self.alerts)
def run_tests(options, context): """Actual protected function for running tests Args: options (namedtuple): CLI options (debug, processor, etc) context (namedtuple): A constructed aws context object """ # The Rule Processor and Alert Processor need environment variables for many things prefix = config['global']['account']['prefix'] alerts_table = '{}_streamalert_alerts'.format(prefix) os.environ[ 'ALERT_PROCESSOR'] = '{}_streamalert_alert_processor'.format( prefix) os.environ['ALERTS_TABLE'] = alerts_table os.environ['AWS_DEFAULT_REGION'] = config['global']['account'][ 'region'] os.environ['CLUSTER'] = run_options.get('cluster') or '' if not options.debug: # Add a filter to suppress a few noisy log messages LOGGER_SA.addFilter(SuppressNoise()) # Create an in memory logging buffer to be used to caching all error messages log_mem_handler = get_log_memory_handler() # Check if the rule processor should be run for these tests # Using NOT set.isdisjoint will check to see if there are commonalities between # the options in 'processor' and {'rule', 'all'} test_rules = (not run_options.get('processor').isdisjoint( {'rule', 'all'}) if run_options.get('processor') else run_options.get('command') == 'live-test' or run_options.get('command') == 'validate-schemas') # Check if the alert processor should be run for these tests # Using NOT set.isdisjoint will check to see if there are commonalities between # the options in 'processor' and {'alert', 'all'} test_alerts = (not run_options.get('processor').isdisjoint( {'alert', 'all'}) if run_options.get('processor') else run_options.get('command') == 'live-test') validate_schemas = options.command == 'validate-schemas' rules_filter = run_options.get('rules', {}) files_filter = run_options.get('files', {}) # Run the rule processor for all rules or designated rule set if context.mocked: helpers.setup_mock_alerts_table(alerts_table) # Mock S3 bucket for lookup tables testing helpers.mock_s3_bucket(config) rule_proc_tester = RuleProcessorTester(context, config, test_rules) alert_proc_tester = AlertProcessorTester(config, context) for _ in range(run_options.get('repeat', 1)): for alerts in rule_proc_tester.test_processor( rules_filter, files_filter, validate_schemas): # If the alert processor should be tested, process any alerts if test_alerts: alert_proc_tester.test_processor(alerts) # Report summary information for the alert processor if it was ran if test_alerts: AlertProcessorTester.report_output_summary() all_test_rules = None if rules_filter: all_test_rules = helpers.get_rules_from_test_events( TEST_EVENTS_DIR) check_invalid_rules_filters(rules_filter, all_test_rules) # If this is not just a validation run, and rule/file filters are not in place # then warn the user if there are test files without corresponding rules # Also check all of the rule files to make sure they have tests configured if not (validate_schemas or rules_filter or files_filter): all_test_rules = all_test_rules or helpers.get_rules_from_test_events( TEST_EVENTS_DIR) check_untested_files(all_test_rules) check_untested_rules(all_test_rules) if not (rule_proc_tester.all_tests_passed and alert_proc_tester.all_tests_passed): return 1 # will exit with error # If there are any log records in the memory buffer, then errors occurred somewhere if log_mem_handler.buffer: # Release the MemoryHandler so we can do some other logging now logging.getLogger().removeHandler(log_mem_handler) LOGGER_CLI.error( '%sSee %d miscellaneous error(s) below ' 'that were encountered and may need to be addressed%s', COLOR_RED, len(log_mem_handler.buffer), COLOR_RESET) log_mem_handler.setTarget(LOGGER_CLI) log_mem_handler.flush() return 1 # will exit with error return 0 # will exit without error
def run_tests(options, context): """Actual protected function for running tests Args: options (namedtuple): CLI options (debug, processor, etc) context (namedtuple): A constructed aws context object """ # The Rule Processor and Alert Processor need environment variables for many things prefix = config['global']['account']['prefix'] alerts_table = '{}_streamalert_alerts'.format(prefix) os.environ['ALERT_PROCESSOR'] = '{}_streamalert_alert_processor'.format(prefix) os.environ['ALERTS_TABLE'] = alerts_table os.environ['AWS_DEFAULT_REGION'] = config['global']['account']['region'] os.environ['CLUSTER'] = run_options.get('cluster') or '' if options.debug: # TODO(jack): Currently there is no (clean) way to set # the logger formatter to provide more verbose # output in debug mode. Running basicConfig twice # does not actually change the formatter on the logger object. # This functionality can be added during the logging refactor # Example Steps: # call .shutdown() on the existing logger # debug_formatter = logging.Formatter( # '%(name)s [%(levelname)s]: [%(module)s.%(funcName)s] %(message)s') # set the new logger to the formatter above for streamalert_logger in (LOGGER_SA, LOGGER_SH, LOGGER_SO, LOGGER_CLI): streamalert_logger.setLevel(logging.DEBUG) else: # Add a filter to suppress a few noisy log messages LOGGER_SA.addFilter(SuppressNoise()) # Create an in memory logging buffer to be used to caching all error messages log_mem_handler = get_log_memory_handler() # Check if the rule processor should be run for these tests # Using NOT set.isdisjoint will check to see if there are commonalities between # the options in 'processor' and {'rule', 'all'} test_rules = (not run_options.get('processor').isdisjoint({'rule', 'all'}) if run_options.get('processor') else run_options.get('command') == 'live-test' or run_options.get('command') == 'validate-schemas') # Check if the alert processor should be run for these tests # Using NOT set.isdisjoint will check to see if there are commonalities between # the options in 'processor' and {'alert', 'all'} test_alerts = (not run_options.get('processor').isdisjoint({'alert', 'all'}) if run_options.get('processor') else run_options.get('command') == 'live-test') rule_proc_tester = RuleProcessorTester(context, config, test_rules) alert_proc_tester = AlertProcessorTester(config, context) validate_schemas = options.command == 'validate-schemas' rules_filter = run_options.get('rules', {}) files_filter = run_options.get('files', {}) # Run the rule processor for all rules or designated rule set if context.mocked: helpers.setup_mock_alerts_table(alerts_table) for alerts in rule_proc_tester.test_processor(rules_filter, files_filter, validate_schemas): # If the alert processor should be tested, process any alerts if test_alerts: alert_proc_tester.test_processor(alerts) # Report summary information for the alert processor if it was ran if test_alerts: AlertProcessorTester.report_output_summary() all_test_rules = None if rules_filter: all_test_rules = helpers.get_rules_from_test_events(TEST_EVENTS_DIR) check_invalid_rules_filters(rules_filter, all_test_rules) # If this is not just a validation run, and rule/file filters are not in place # then warn the user if there are test files without corresponding rules # Also check all of the rule files to make sure they have tests configured if not (validate_schemas or rules_filter or files_filter): all_test_rules = all_test_rules or helpers.get_rules_from_test_events(TEST_EVENTS_DIR) check_untested_files(all_test_rules) check_untested_rules(all_test_rules) if not (rule_proc_tester.all_tests_passed and alert_proc_tester.all_tests_passed): sys.exit(1) # If there are any log records in the memory buffer, then errors occurred somewhere if log_mem_handler.buffer: # Release the MemoryHandler so we can do some other logging now logging.getLogger().removeHandler(log_mem_handler) LOGGER_CLI.error('%sSee %d miscellaneous error(s) below ' 'that were encountered and may need to be addressed%s', COLOR_RED, len(log_mem_handler.buffer), COLOR_RESET) log_mem_handler.setTarget(LOGGER_CLI) log_mem_handler.flush() sys.exit(1)