Removes all publisher tests + enhances integration tests

rules/community/cloudwatch_events/cloudtrail_critical_api_calls.json

@@ -862,6 +862,63 @@
           "\"@slack.text\"",
           "is",
           "Rule triggered"
+        ],
+        [
+          "\"@slack.attachments\"[0].title",
+          "is",
+          "cloudtrail_critical_api_calls"
+        ],
+        [
+          "\"@slack.attachments\"[0].title_link",
+          "is",
+          "https://github.com/airbnb/streamalert/search?q=cloudtrail_critical_api_calls+path%3A%2Frules"
+        ],
+        [
+          "\"@slack.attachments\"[1].fields[0].title",
+          "is",
+          "Reference"
+        ],
+        [
+          "\"@slack.attachments\"[1].fields[0].value",
+          "is",
+          "https://medium.com/@robwitoff/proactive-cloud-security-w-aws-organizations-d58695bcae16#.tx2e6iju0"
+        ],
+        [
+          "\"@slack.attachments\"[2].title",
+          "is",
+          "Record"
+        ],
+        [
+          "\"@slack.attachments\"[2].text",
+          "contains",
+          "\"requestId\": \"19a19cd8-5f1b-4d5e-8af4-3e826fa03d0f\""
+        ],
+        [
+          "\"@slack.attachments\"[2].author",
+          "is",
+          "prefix.cluster.sample.bucket"
+        ],
+        [
+          "\"@slack.attachments\"[2].fields[0].title",
+          "is",
+          "Alert Id"
+        ]
+      ],
+      "pagerduty:sample-integration": [
+        [
+          "\"@pagerduty.description\"",
+          "is",
+          "cloudtrail_critical_api_calls"
+        ],
+        [
+          "\"@pagerduty.details\".eventName",
+          "contains",
+          "DisableEbsEncryptionByDefault"
+        ],
+        [
+          "\"@pagerduty.details\".eventSource",
+          "contains",
+          "ec2.amazonaws.com"
         ]
       ]
     }

rules/community/cloudwatch_events/cloudtrail_critical_api_calls.py

@@ -1,4 +1,9 @@
 """Alert on destructive AWS API calls."""
+from publishers.community.generic import add_record, populate_fields
+from publishers.community.pagerduty.pagerduty_layout import (
+    ShortenTitle, as_custom_details,
+    PrettyPrintArrays,
+)
 from publishers.community.slack.slack_layout import Summary, AttachRuleInfo, AttachFullRecord
 from streamalert.shared.rule import rule
 
@@ -56,12 +61,22 @@
 
 @rule(
     logs=['cloudtrail:events'],
-    outputs=['slack:sample-channel'],
+    outputs=['slack:sample-channel', 'pagerduty:sample-integration'],
     publishers={
-        'slack': [Summary, AttachRuleInfo, AttachFullRecord]
+        'slack': [Summary, AttachRuleInfo, AttachFullRecord],
+        'pagerduty': [
+            add_record,
+            populate_fields,
+            PrettyPrintArrays,
+            ShortenTitle,
+            as_custom_details
+        ],
+    },
+    context={
+        'populate_fields': ['eventName', 'eventSource']
     }
 )
-def cloudtrail_critical_api_calls(rec):
+def cloudtrail_critical_api_calls(rec, _):
     """
     author:           airbnb_csirt
     description:      Alert on AWS API calls that stop or delete security/infrastructure logs.

streamalert_cli/test/handler.py

@@ -499,6 +499,10 @@ class PublisherTestRunner:
         },
         'in': {
             'comparator': lambda s, p: s in p if isinstance(p, list) else p.contains(s),
+            'clause': 'should have been one of'
+        },
+        'contains': {
+            'comparator': lambda s, p: p in s,
             'clause': 'should have contained'
         }
     }