Feature artifact extractor #1250
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
* rename of athena function * updating terraform generation code to use tf_lambda module * updating tf_athena module to remove lambda code * updates for packaging, rollback, and deploy * misc updates related to config path renaming, etc * removing no-longer-used method (athena is default) * addressing PR feedback * adding more granular time prefix to athena client
* fixing duplicate resource issues * fixing some other bugs in #1217
…ig files (#1224) * adding support for supplying path to config via CLI flag * misc touchups
* moving matchers outside of rules directory * updating rules for new matcher path * updating unit test for consistency * making publisher locations configurable * fixing typo
…eploys (#1222) * updating rollback functionality to include all funcs * updating tests to check for rollback of all funcs * updating docs
Normalization reboot - Artifacts inventory
Normalization reboot - Add terraform resources
Normalization reboot - Refactor normalization code
Add record id to artifacts and record
Normalization reboot - Add condition support to normalizer
Add three custom metrics
Ryxias
approved these changes
Jun 11, 2020
This was referenced Jun 12, 2020
ryandeivert
added a commit
that referenced
this pull request
Aug 5, 2020
* bumping version to 3.3.0 * Demisto playbook (#1239) * Supports dynamic parameters (#1244) * Add dynamic param support * I am caveman unga bunga smash * Oogey boogey beh * [apps][aliyun] Set EndTime in the request (#1247) * [apps][aliyun] Set EndTime in the request * github action sucks, changing comment to retrigger action Co-authored-by: Chunyong Lin <chunyong.lin@airbnb.com> * updating metavar/description for cli flag (#1252) * support for packaging user specified conf directory (#1253) * adding packaging support for user specified config path * adding test for copying directory to alternate destination * pr feedback * adding fix for omitting coverage for forks (#1256) * another attempt at coveralls BS (#1257) * Update getting-started.rst (#1254) The current Getting Started instructions don't mention that you need to add the `set` command. As it stands, this is the error I received when setting up Streamalert: ``` (.env) jordan@mac:~/src/aws/streamalert/streamalert$ python manage.py output aws-sns usage: manage.py output [-h] {set,set-from-file,generate-skeleton,get,list} ... manage.py output: error: invalid choice: 'aws-sns' (choose from 'set', 'set-from-file', 'generate-skeleton', 'get', 'list') ``` Co-authored-by: Ryxias <derek.wang@airbnb.com> Co-authored-by: ryandeivert <ryan.deivert@airbnb.com> * Feature artifact extractor (#1250) * bumping version to 3.2.0 * migrating Athena function to use tf_lambda module (#1217) * rename of athena function * updating terraform generation code to use tf_lambda module * updating tf_athena module to remove lambda code * updates for packaging, rollback, and deploy * misc updates related to config path renaming, etc * removing no-longer-used method (athena is default) * addressing PR feedback * adding more granular time prefix to athena client * fixing duplicate resource issues (#1218) * fixing duplicate resource issues * fixing some other bugs in #1217 * fixing tf targets for athena deploy (#1220) * adding "--config-dir" flag to CLI to support specifying path for config files (#1224) * adding support for supplying path to config via CLI flag * misc touchups * updating publishers to accept configurable paths (#1223) * moving matchers outside of rules directory * updating rules for new matcher path * updating unit test for consistency * making publisher locations configurable * fixing typo * updating tf_lambda module to remove extra resources (#1225) * fixing rollback for all functions, removing 'all' flag for function deploys (#1222) * updating rollback functionality to include all funcs * updating tests to check for rollback of all funcs * updating docs * fixing tf cycle and index issue (#1226) * [core] Artifact Extractor lambda code * [core] load firehose client for artifact extractor * [core] Move FirehoseClient to shared folder * [test] Here we go pylint * [docs] Add high level Normalization doc * Ooops, leftover print * Address coment about docc * bumping version to 3.3.0 * Remove a FIXME comment * Add terraform resources * Fix some issues discovered during terraform build * [test] Add unit test cases and tune some code during testing * [cli] update artifact extractor module resource for lambda deploy * [doc] Update docstring * pylint * Address comments * Address more comments * [bugs] Fixed couple bugs before normalization code change * [core] Refactor normalization code, unit test cases and add new ones * [core] Re-implement normalization code \O/ * [docs] Update docs * [docs] More docs * Rework normalization logic to use key path from conf/schemas/*.json to find original key * [tests] update unit test cases * [rule][conf] Update conf right_to_left_character rule to use new normalization * [docs] Update docs and address comments * Fix a bug and update the unit test helper * Remove unnecessary comments * buggy, remove None values from normalization field * Add record id to artifacts and record * [tf] Upgrade terraform aws provider to 2.48.0 * Add condition to normalizer * [docs] Update docs * Address comment * Add three custom metrics * [cli] fix undeclared module issue related to artifact_extractor * [doc] Update artifact extractor deploy instruction Co-authored-by: Ryan Deivert <ryan.deivert@airbnb.com> Co-authored-by: Chunyong Lin <chunyong.lin@airbnb.com> * [config] Add Okta log schema (#1263) * [config] Add Okta log schema * Add test record * Fix tests * Fix tests Co-authored-by: Matt Muller <matt.muller@coinbase.com> * Add additional G-Suite Admin Audit types. (#1260) Co-authored-by: darkjokelady <chunyong.lin@gmail.com> * Update getting-started.rst (#1255) * Update getting-started.rst Fix path to `cloudtrail_root_account_usage.py` rule being modified in the Getting Started documentation. * test ci change in fork * second update for ci tests in forks Co-authored-by: Ryxias <derek.wang@airbnb.com> Co-authored-by: ryandeivert <ryan.deivert@airbnb.com> Co-authored-by: ryandeivert <ryandeivert@gmail.com> Co-authored-by: darkjokelady <chunyong.lin@gmail.com> * [core] fix bug when normalization config empty (#1262) * [core] fix bug when normalization config empty * [test] Update unit test case * [docs] Update how to search artifacts table Co-authored-by: Chunyong Lin <chunyong.lin@airbnb.com> * CLI support for extra user supplied terraform files (#1267) * adding cli arg to supply additional terraform config files * removing old tf cleanup code since temp path will be used * cliconfig support for temp tf directory * updates to tf_runner and run_command for temp tf path * removing tf clean command since runs are now idempotent * packaging change for tf temp path * logic for copying files to tf temp path * removing init backend option * cleanup * fix unit tests * config support for extra tf files * doc update for `terraform_files` setting * unit test for cliconfig terraform files * fix for init backend outside of generate logic * update to support supplying static dir for builds * fixing issue with streamalert.zip not existing at build times (#1269) * Move artifact extractor logic to classifier (#1268) * [core] Move artifact extractor logic to classifier * [core] Add send_to_artifacts flag to normalizer * [cli] Remove leftover variables, permissions * [core] Fix bugs, update custom metrics for artifacts * [tests] Update test cases * [docs] Update docs * [cli] Update artifact_extract.tf.json path after PR #1267 merged Co-authored-by: Chunyong Lin <chunyong.lin@airbnb.com> * rebuilding pkg on every tf run (#1270) * ensuring prefix is a lowercase string (#1272) * updating dependencies (#1277) * updating deps * updating precompiled deps * misc cleanup * [core][apps] Increase aliyun timeout (#1274) Co-authored-by: Chunyong Lin <chunyong.lin@airbnb.com> * proper cloudwatch events permissions for cross account access (#1276) * updating cloudwatch events module to support advanced event brige rule * adding proper support for cloudwatch event permission for cross account cwe * terraform gen code for new cross account cwe perms * doc updates for x-acct cwe perms * fix readme * reverting usage of cloudformation stack * allowing optional scopes * proper provider support for different regions * fixing pylint * adding role arn to target * installing venv in vagrant (#1278) * fixing copying of zips, since lambda layers are zips (#1279) * cloudtrail module config tweak (#1280) * updating cloudtrail module config slightly * updating unit tests and docs for cloudtrail module change * fixing default for enable_events * update to docs * raising exceptions when error occurs while downloading from s3 (#1281) * raising exceptions with s3 download errors * fixing unit test * addressing issue with 0 byte files in s3 (#1284) * adding support for other accounts to publish to sns topic (#1283) * fixing a bug I think but who really knows (#1285) * adding fix for #1282 (#1286) Co-authored-by: Ryxias <derek.wang@airbnb.com> Co-authored-by: darkjokelady <chunyong.lin@gmail.com> Co-authored-by: Chunyong Lin <chunyong.lin@airbnb.com> Co-authored-by: Jordan Wright <jmwright798@gmail.com> Co-authored-by: themullinator <matt@mattmuller.info> Co-authored-by: Matt Muller <matt.muller@coinbase.com> Co-authored-by: Gavin <gav.elder@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
to: @airbnb/streamalert-maintainers
related to: #1230, #1237, #1238, #1242, #1245 and #1246
resolves:
Background
This is the PR for Normalization v2 feature that I have been working on during past couple month. Most of the code has been reviewed in the feature branch.
Changes
Testing
release-3-3-0branch to staging and enable historical search oncloudwatchandosqueryevents, which have normalization configured.artifact_extractorlambda function following by the documentation.account,ip_address,user_agent,user_identity,commandandfile_pathtypes are writing to S3 and searchable inartifactstable correctly.