def setup(self):
"""Alert Merger - Alert Table - Add mock alerts to the table"""
# pylint: disable=attribute-defined-outside-init
self.dynamo_mock = mock_dynamodb2()
self.dynamo_mock.start()
setup_mock_alerts_table(_ALERTS_TABLE)
self.alert_table = main.AlertTable(_ALERTS_TABLE)
with self.alert_table.table.batch_writer() as batch:
for i in range(3):
batch.put_item(
Item={
'RuleName': 'even' if i % 2 == 0 else 'odd',
'AlertID': 'alert-{}'.format(str(i)),
'Created': '2018-03-14',
'Cluster': 'test-cluster',
'LogSource': 'test-log-source',
'LogType': 'json',
'RuleDescription': 'even' if i % 2 == 0 else 'odd',
'SourceEntity': 'test-source-entity',
'SourceService': 'test-source-service',
'Outputs':
{'aws-s3:test-bucket', 'slack:test-channel'},
'Record': json.dumps({
'key1': 'value1',
'key2': 'value2'
})
})
def setup(self):
"""Alert Merger - Setup"""
self.dynamo_mock = mock_dynamodb2()
self.lambda_mock = mock_lambda()
self.dynamo_mock.start()
self.lambda_mock.start()
create_lambda_function(_ALERT_PROCESSOR, 'us-east-1')
setup_mock_alerts_table(_ALERTS_TABLE)
self.merger = main.AlertMerger.get_instance()
def setup(self):
"""Alert Table - Create mock table and alerts"""
# pylint: disable=attribute-defined-outside-init
self.dynamo_mock = mock_dynamodb2()
self.dynamo_mock.start()
setup_mock_alerts_table(_ALERTS_TABLE)
self.alert_table = alert_table.AlertTable(_ALERTS_TABLE)
self.alerts = [
alert_module.Alert(
'even' if i % 2 == 0 else 'odd',
{'key1': 'value1', 'key2': 'value2'},
{'aws-firehose:alerts', 'aws-s3:test-bucket', 'slack:test-channel'},
)
for i in range(3)
]
self.alert_table.add_alerts(self.alerts)
def run_tests(options, context):
"""Actual protected function for running tests
Args:
options (namedtuple): CLI options (debug, processor, etc)
context (namedtuple): A constructed aws context object
"""
# The Rule Processor and Alert Processor need environment variables for many things
prefix = config['global']['account']['prefix']
alerts_table = '{}_streamalert_alerts'.format(prefix)
os.environ[
'ALERT_PROCESSOR'] = '{}_streamalert_alert_processor'.format(
prefix)
os.environ['ALERTS_TABLE'] = alerts_table
os.environ['AWS_DEFAULT_REGION'] = config['global']['account'][
'region']
os.environ['CLUSTER'] = run_options.get('cluster') or ''
if not options.debug:
# Add a filter to suppress a few noisy log messages
LOGGER_SA.addFilter(SuppressNoise())
# Create an in memory logging buffer to be used to caching all error messages
log_mem_handler = get_log_memory_handler()
# Check if the rule processor should be run for these tests
# Using NOT set.isdisjoint will check to see if there are commonalities between
# the options in 'processor' and {'rule', 'all'}
test_rules = (not run_options.get('processor').isdisjoint(
{'rule', 'all'}) if run_options.get('processor') else
run_options.get('command') == 'live-test'
or run_options.get('command') == 'validate-schemas')
# Check if the alert processor should be run for these tests
# Using NOT set.isdisjoint will check to see if there are commonalities between
# the options in 'processor' and {'alert', 'all'}
test_alerts = (not run_options.get('processor').isdisjoint(
{'alert', 'all'}) if run_options.get('processor') else
run_options.get('command') == 'live-test')
validate_schemas = options.command == 'validate-schemas'
rules_filter = run_options.get('rules', {})
files_filter = run_options.get('files', {})
# Run the rule processor for all rules or designated rule set
if context.mocked:
helpers.setup_mock_alerts_table(alerts_table)
# Mock S3 bucket for lookup tables testing
helpers.mock_s3_bucket(config)
rule_proc_tester = RuleProcessorTester(context, config, test_rules)
alert_proc_tester = AlertProcessorTester(config, context)
for _ in range(run_options.get('repeat', 1)):
for alerts in rule_proc_tester.test_processor(
rules_filter, files_filter, validate_schemas):
# If the alert processor should be tested, process any alerts
if test_alerts:
alert_proc_tester.test_processor(alerts)
# Report summary information for the alert processor if it was ran
if test_alerts:
AlertProcessorTester.report_output_summary()
all_test_rules = None
if rules_filter:
all_test_rules = helpers.get_rules_from_test_events(
TEST_EVENTS_DIR)
check_invalid_rules_filters(rules_filter, all_test_rules)
# If this is not just a validation run, and rule/file filters are not in place
# then warn the user if there are test files without corresponding rules
# Also check all of the rule files to make sure they have tests configured
if not (validate_schemas or rules_filter or files_filter):
all_test_rules = all_test_rules or helpers.get_rules_from_test_events(
TEST_EVENTS_DIR)
check_untested_files(all_test_rules)
check_untested_rules(all_test_rules)
if not (rule_proc_tester.all_tests_passed
and alert_proc_tester.all_tests_passed):
return 1 # will exit with error
# If there are any log records in the memory buffer, then errors occurred somewhere
if log_mem_handler.buffer:
# Release the MemoryHandler so we can do some other logging now
logging.getLogger().removeHandler(log_mem_handler)
LOGGER_CLI.error(
'%sSee %d miscellaneous error(s) below '
'that were encountered and may need to be addressed%s',
COLOR_RED, len(log_mem_handler.buffer), COLOR_RESET)
log_mem_handler.setTarget(LOGGER_CLI)
log_mem_handler.flush()
return 1 # will exit with error
return 0 # will exit without error
def run_tests(options, context):
"""Actual protected function for running tests
Args:
options (namedtuple): CLI options (debug, processor, etc)
context (namedtuple): A constructed aws context object
"""
# The Rule Processor and Alert Processor need environment variables for many things
prefix = config['global']['account']['prefix']
alerts_table = '{}_streamalert_alerts'.format(prefix)
os.environ['ALERT_PROCESSOR'] = '{}_streamalert_alert_processor'.format(prefix)
os.environ['ALERTS_TABLE'] = alerts_table
os.environ['AWS_DEFAULT_REGION'] = config['global']['account']['region']
os.environ['CLUSTER'] = run_options.get('cluster') or ''
if options.debug:
# TODO(jack): Currently there is no (clean) way to set
# the logger formatter to provide more verbose
# output in debug mode. Running basicConfig twice
# does not actually change the formatter on the logger object.
# This functionality can be added during the logging refactor
# Example Steps:
# call .shutdown() on the existing logger
# debug_formatter = logging.Formatter(
# '%(name)s [%(levelname)s]: [%(module)s.%(funcName)s] %(message)s')
# set the new logger to the formatter above
for streamalert_logger in (LOGGER_SA, LOGGER_SH, LOGGER_SO, LOGGER_CLI):
streamalert_logger.setLevel(logging.DEBUG)
else:
# Add a filter to suppress a few noisy log messages
LOGGER_SA.addFilter(SuppressNoise())
# Create an in memory logging buffer to be used to caching all error messages
log_mem_handler = get_log_memory_handler()
# Check if the rule processor should be run for these tests
# Using NOT set.isdisjoint will check to see if there are commonalities between
# the options in 'processor' and {'rule', 'all'}
test_rules = (not run_options.get('processor').isdisjoint({'rule', 'all'})
if run_options.get('processor') else
run_options.get('command') == 'live-test' or
run_options.get('command') == 'validate-schemas')
# Check if the alert processor should be run for these tests
# Using NOT set.isdisjoint will check to see if there are commonalities between
# the options in 'processor' and {'alert', 'all'}
test_alerts = (not run_options.get('processor').isdisjoint({'alert', 'all'})
if run_options.get('processor') else
run_options.get('command') == 'live-test')
rule_proc_tester = RuleProcessorTester(context, config, test_rules)
alert_proc_tester = AlertProcessorTester(config, context)
validate_schemas = options.command == 'validate-schemas'
rules_filter = run_options.get('rules', {})
files_filter = run_options.get('files', {})
# Run the rule processor for all rules or designated rule set
if context.mocked:
helpers.setup_mock_alerts_table(alerts_table)
for alerts in rule_proc_tester.test_processor(rules_filter,
files_filter,
validate_schemas):
# If the alert processor should be tested, process any alerts
if test_alerts:
alert_proc_tester.test_processor(alerts)
# Report summary information for the alert processor if it was ran
if test_alerts:
AlertProcessorTester.report_output_summary()
all_test_rules = None
if rules_filter:
all_test_rules = helpers.get_rules_from_test_events(TEST_EVENTS_DIR)
check_invalid_rules_filters(rules_filter, all_test_rules)
# If this is not just a validation run, and rule/file filters are not in place
# then warn the user if there are test files without corresponding rules
# Also check all of the rule files to make sure they have tests configured
if not (validate_schemas or rules_filter or files_filter):
all_test_rules = all_test_rules or helpers.get_rules_from_test_events(TEST_EVENTS_DIR)
check_untested_files(all_test_rules)
check_untested_rules(all_test_rules)
if not (rule_proc_tester.all_tests_passed and
alert_proc_tester.all_tests_passed):
sys.exit(1)
# If there are any log records in the memory buffer, then errors occurred somewhere
if log_mem_handler.buffer:
# Release the MemoryHandler so we can do some other logging now
logging.getLogger().removeHandler(log_mem_handler)
LOGGER_CLI.error('%sSee %d miscellaneous error(s) below '
'that were encountered and may need to be addressed%s',
COLOR_RED, len(log_mem_handler.buffer), COLOR_RESET)
log_mem_handler.setTarget(LOGGER_CLI)
log_mem_handler.flush()
sys.exit(1)
