Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[streamalert][bug] Fix to allow nested structured data and normalization #339

Closed
wants to merge 3 commits into from
Closed

[streamalert][bug] Fix to allow nested structured data and normalization #339

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0f025c9
Fix to allow nested structured data and normalization
Oct 2, 2017
cd77aea
Modifying existing test to check for nested field
Oct 2, 2017
cac8827
Merge branch 'master' into normalized_nested_field_bug
Oct 3, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 8 additions & 9 deletions stream_alert/rule_processor/rules_engine.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -167,8 +167,8 @@ def match_types(cls, record, normalized_types, datatypes):
datatypes (list): defined in rule options, normalized_types users
interested in.

Returns:
(dict): A dict of normalized_types with original key names
Sets:
It sets the dict of normalized_types with original key names

Example 1:
datatypes=['defined_type1', 'defined_type2', 'not_defined_type']
Expand All @@ -183,11 +183,13 @@ def match_types(cls, record, normalized_types, datatypes):
"defined_type2": [[original_key2, sub_key2], [original_key3]]
}
"""
results = dict()
if 'normalized_types' not in record:
record['normalized_types'] = dict()

if not (datatypes and cls.validate_datatypes(normalized_types, datatypes)):
return results
return

return cls.match_types_helper(record, normalized_types, datatypes)
record['normalized_types'] = cls.match_types_helper(record, normalized_types, datatypes)

@classmethod
def match_types_helper(cls, record, normalized_types, datatypes):
Expand Down Expand Up @@ -381,10 +383,7 @@ def process(cls, input_payload):
if not matcher_result:
continue
if rule.datatypes:
types_result = cls.match_types(record,
payload.normalized_types,
rule.datatypes)
record['normalized_types'] = types_result
cls.match_types(record, payload.normalized_types, rule.datatypes)

# rule analysis
rule_result = cls.process_rule(record, rule)
Expand Down
11 changes: 8 additions & 3 deletions tests/unit/stream_alert_rule_processor/test_rules_engine.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -615,14 +615,18 @@ def test_match_types_helper(self):
'awsRegion': 'region_name',
'source': '1.1.1.2'
},
'columns': {
'cmdline': 'hostname'
},
'sourceIPAddress': '1.1.1.2'
}
normalized_types = {
'account': ['account'],
'region': ['region', 'awsRegion'],
'ipv4': ['destination', 'source', 'sourceIPAddress']
'ipv4': ['destination', 'source', 'sourceIPAddress'],
'command': ['cmdline']
}
datatypes = ['account', 'ipv4', 'region']
datatypes = ['account', 'ipv4', 'region', 'command']
results = StreamRules.match_types_helper(
record,
normalized_types,
Expand All @@ -631,7 +635,8 @@ def test_match_types_helper(self):
expected_results = {
'account': [['account']],
'ipv4': [['sourceIPAddress'], ['detail', 'source']],
'region': [['region'], ['detail', 'awsRegion']]
'region': [['region'], ['detail', 'awsRegion']],
'command': [['columns', 'cmdline']]
}
assert_equal(results, expected_results)

Expand Down