cloudmarker / cloudmarker

91%

master: 84%

LAST BUILD ON BRANCH ignore-virtual-machines

branch: ignore-virtual-machines

CHANGE BRANCH

x

Reset

• ignore-virtual-machines
• 0.1.0
• alertdocs
• apidocindent
• audit-version
• auditemails
• azcloud
• azstorage
• azurecloud
• azurecloud-exception
• azvm_record_type
• azwebapp
• badges
• baseconfig
• bracket
• buckets
• build-matrix
• changelog
• clioptions
• clouderror
• common-plugins-config
• consistency
• copy-ext
• copyext
• cov_clean
• dependabot/pip/cryptography-3.3.2
• dependabot/pip/httplib2-0.18.0
• dependabot/pip/httplib2-0.19.0
• dependabot/pip/pyyaml-5.4
• dependabot/pip/rsa-4.7
• dependabot/pip/urllib3-1.26.5
• dist
• docfixes
• doctest-fix
• email_debug_param_from_config
• emailbody
• emaildocs
• empty-port
• esstore
• firewalleventtest
• firewallnorm
• firewallruleevent
• fix-esstore-done
• fix-unused-input-queue
• fix_cloud_worker
• fixbuild
• fixcoverage
• fixindent
• freeze
• gcpcloudlogs
• gcpcloudtest
• iam_policy
• ioworkers
• key_file_name_fix
• lint
• load_yaml_safely
• log
• logfixes
• logger-defaults
• logging-levels
• master
• maxrecs
• mock-records
• mockplugins
• mongodbdefaults
• mongodbfix
• mongodbtests
• multiprocessing
• pluginframework
• pluginloader
• readable-version
• readme
• remove-email-config
• removefirewallevent
• rename_logger
• renameparams
• requirements
• rest
• reuse-mock
• rm-venv
• slackalert
• smtpssl
• sphinx
• sphinx-rst-update
• splunkfixes
• splunkhecstore_docs
• splunkhectokentest
• splunkstore
• sub_id_rename
• tests
• travis
• userconfig
• userdoc
• userecordterm
• verdev
• webapp
• worker-com-fields
• worker-error-handling
• workerlogs

Build # 844

Build Type

Pull #137

travis-ci-com

Committed by web-flow

Commit Message

Check only vm_instance_view data in disk plugins

The current implementations of `AzVMOSDiskEncryptionEvent` and
`AzVMDataDiskEncryptionEvent` plugins generate events for VM records
obtained by `AzCloud` as well. This is a problem when both `AzCloud` and
`AzVM` belong to the same audit definition. Here is an example minimal
config that reproduces this issue:

    plugins:
      myazcloud:
        plugin: cloudmarker.clouds.azcloud.AzCloud
        params:
          tenant:
          client:
          secret:

      myazvm:
        plugin: cloudmarker.clouds.azvm.AzVM
        params:
          tenant:
          client:
          secret:

    audits:
      myazaudit:
        clouds:
          - myazcloud
          - myazvm
        stores:
          - filestore
        events:
          - firewallruleevent
          - azvmosdiskencryptionevent
          - azvmdatadiskencryptionevent
        alerts:
          - filestore
    run:
      - myazaudit

Assuming there is only one VM in the cloud, `AzVMOSDiskEncryptionEvent`
would generate two events, one for the `virtual_machine` record
generated by `AzCloud` and one more for the `vm_instance_view` record
generated by `AzVM`.

Since these two plugins work only on `vm_instance_view` records (i.e.,
extended record type is `vm_instance_view`), it should ignore any other
extended record types. This change implements this.

Further, while implementing this change, I realized that it would be
better to not log warning messages for missing `com` and `ext` buckets.
One of the design goals of this project has been to let users write
their own plugins in which they are free to choose their record format.
If their records do not have `com` and `ext` buckets but these plugins
are configured to receive them, then these plugins should silently
ignore any records that these plugins do not care about instead of
logging a warning message for every record that does not meet these
plugins' expected format.

Pull Request Pull Request #137: Check only vm_instance_view data in disk plugins

Run Details

368 of 419 branches covered (87.83%)

Branch coverage included in aggregate %.

12 of 12 new or added lines in 2 files covered. (100.0%)

1866 of 2047 relevant lines covered (91.16%)

2.73 hits per line