cloudmarker / cloudmarker

90%

master: 84%

LAST BUILD ON BRANCH audit-version

branch: audit-version

CHANGE BRANCH

x

Reset

• audit-version
• 0.1.0
• alertdocs
• apidocindent
• auditemails
• azcloud
• azstorage
• azurecloud
• azurecloud-exception
• azvm_record_type
• azwebapp
• badges
• baseconfig
• bracket
• buckets
• build-matrix
• changelog
• clioptions
• clouderror
• common-plugins-config
• consistency
• copy-ext
• copyext
• cov_clean
• dependabot/pip/cryptography-3.3.2
• dependabot/pip/httplib2-0.18.0
• dependabot/pip/httplib2-0.19.0
• dependabot/pip/pyyaml-5.4
• dependabot/pip/rsa-4.7
• dependabot/pip/urllib3-1.26.5
• dist
• docfixes
• doctest-fix
• email_debug_param_from_config
• emailbody
• emaildocs
• empty-port
• esstore
• firewalleventtest
• firewallnorm
• firewallruleevent
• fix-esstore-done
• fix-unused-input-queue
• fix_cloud_worker
• fixbuild
• fixcoverage
• fixindent
• freeze
• gcpcloudlogs
• gcpcloudtest
• iam_policy
• ignore-virtual-machines
• ioworkers
• key_file_name_fix
• lint
• load_yaml_safely
• log
• logfixes
• logger-defaults
• logging-levels
• master
• maxrecs
• mock-records
• mockplugins
• mongodbdefaults
• mongodbfix
• mongodbtests
• multiprocessing
• pluginframework
• pluginloader
• readable-version
• readme
• remove-email-config
• removefirewallevent
• rename_logger
• renameparams
• requirements
• rest
• reuse-mock
• rm-venv
• slackalert
• smtpssl
• sphinx
• sphinx-rst-update
• splunkfixes
• splunkhecstore_docs
• splunkhectokentest
• splunkstore
• sub_id_rename
• tests
• travis
• userconfig
• userdoc
• userecordterm
• verdev
• webapp
• worker-com-fields
• worker-error-handling
• workerlogs

Build # 701

Build Type

Pull #120

travis-ci-com

Committed by web-flow

Commit Message

Add audit version to all records

This change adds a field named `audit_version` to every record. The
value of this field is a string that represents the time at which the
audits started. The value of this field is in `YYYYmmddHHMMSS` format,
e.g., `20190429180829`.

This version string is created only once at the beginning of a run of
all configured audits. The same version string is then used for all
audits. This way, all data obtained during a single run get the same
version string regardless of the actual start time of the individual
audits.

Additionally, this change adds two new record types.

  - `begin_audit`: A record with `record_type` as `begin_audit`
    indicates that a specific audit has started. The `audit_key` field
    in the `com` bucket shows which audit has started.

  - `end_audit`: A record of this type indicates that a specific audit
     has ended. The `audit_key` field in the `com` bucket shows which
     audit has ended.

Note that the same destination target may contain multiple `begin_audit`
record at the beginning of an audit. For example, if the same Splunk
instance is configured both as a store as well as an alert, then it
would receive one `begin_audit` record sent to the store worker and one
more sent to the alert worker. This holds good for `end_audit` record
too.

The audit version string in these records are useful in selecting or
querying the data obtained from the most recent run of an audit.

Pull Request Pull Request #120: Add audit version to all records

Run Details

335 of 381 branches covered (87.93%)

Branch coverage included in aggregate %.

65 of 65 new or added lines in 4 files covered. (100.0%)

1644 of 1806 relevant lines covered (91.03%)

2.73 hits per line