cloudmarker / cloudmarker

90%

master: 84%

LAST BUILD ON BRANCH worker-com-fields

branch: worker-com-fields

CHANGE BRANCH

x

Reset

• worker-com-fields
• 0.1.0
• alertdocs
• apidocindent
• audit-version
• auditemails
• azcloud
• azstorage
• azurecloud
• azurecloud-exception
• azvm_record_type
• azwebapp
• badges
• baseconfig
• bracket
• buckets
• build-matrix
• changelog
• clioptions
• clouderror
• common-plugins-config
• consistency
• copy-ext
• copyext
• cov_clean
• dependabot/pip/cryptography-3.3.2
• dependabot/pip/httplib2-0.18.0
• dependabot/pip/httplib2-0.19.0
• dependabot/pip/pyyaml-5.4
• dependabot/pip/rsa-4.7
• dependabot/pip/urllib3-1.26.5
• dist
• docfixes
• doctest-fix
• email_debug_param_from_config
• emailbody
• emaildocs
• empty-port
• esstore
• firewalleventtest
• firewallnorm
• firewallruleevent
• fix-esstore-done
• fix-unused-input-queue
• fix_cloud_worker
• fixbuild
• fixcoverage
• fixindent
• freeze
• gcpcloudlogs
• gcpcloudtest
• iam_policy
• ignore-virtual-machines
• ioworkers
• key_file_name_fix
• lint
• load_yaml_safely
• log
• logfixes
• logger-defaults
• logging-levels
• master
• maxrecs
• mock-records
• mockplugins
• mongodbdefaults
• mongodbfix
• mongodbtests
• multiprocessing
• pluginframework
• pluginloader
• readable-version
• readme
• remove-email-config
• removefirewallevent
• rename_logger
• renameparams
• requirements
• rest
• reuse-mock
• rm-venv
• slackalert
• smtpssl
• sphinx
• sphinx-rst-update
• splunkfixes
• splunkhecstore_docs
• splunkhectokentest
• splunkstore
• sub_id_rename
• tests
• travis
• userconfig
• userdoc
• userecordterm
• verdev
• webapp
• worker-error-handling
• workerlogs

Build # 675

Build Type

Pull #117

travis-ci-com

Committed by web-flow

Commit Message

Populate `alert_worker` in `com` bucket

Prior to this change, the `com` bucket of events alerted with an alert
plugin looked like the following example:

    "com": {
      "record_type": "mock_event",
      "origin_worker": "mockaudit-mockevent",
      "origin_type": "event",
      "event_worker": "mockaudit-mockevent",
      "store_worker": "mockaudit-filestore"
    }

Note that the last key in the example above is named as `store_worker`
although alerting is done by alert plugins. This was so because store
plugins and alert plugins implement the exact same interface via
duck-typing, so both types of plugins were worked on by a function named
`store_worker`.

While this makes sense for us (the developers), finding a `store_worker`
key in data written by an alert plugin could be confusing to a user.
Therefore, with this change, the `com` bucket of events alerted with an
alert plugin looks like this:

    "com": {
      "record_type": "mock_event",
      "origin_worker": "mockaudit-mockevent",
      "origin_type": "event",
      "event_worker": "mockaudit-mockevent",
      "alert_worker": "mockaudit-filestore"
    }

To accomplish this behaviour, `workers.py` has been refactored by moving
the existing `store_worker` functionality to an internal `_write_worker`
function which can work on both store and alert plugins. It accepts an
additional parameter that tells it whether to populate `store_worker` or
`alert_worker` in the `com` bucket. Now there are two functions
`store_worker` and `alert_worker` which invoke with the `_write_worker`
function with the additional parameter to populate the `com` bucket
appropriately.

Pull Request Pull Request #117: Set `origin_type` and `alert_worker` for events

Run Details

328 of 374 branches covered (87.7%)

Branch coverage included in aggregate %.

19 of 19 new or added lines in 2 files covered. (100.0%)

1613 of 1775 relevant lines covered (90.87%)

2.73 hits per line