forwarder

Documentation

Index

• Constants
• Variables
• type Alert
• type AlertDedupEvent
  • func FromDynamodDBAttribute(input map[string]events.DynamoDBAttributeValue) (event *AlertDedupEvent, err error)
• type Handler
  • func (h *Handler) Do(oldAlertDedupEvent, newAlertDedupEvent *AlertDedupEvent) (err error)
• type RuleCache
  • func NewCache(policyClient gatewayapi.API) *RuleCache
  • func (c *RuleCache) Get(id, version string) (*models.Rule, error)

Constants

const (
	// The type of an Alert that is triggered because of a rule encountering an error
	RuleErrorType = "RULE_ERROR"
)

Variables

var (
	StaticLogger = metrics.MustStaticLogger([]metrics.DimensionSet{
		{
			"AnalysisType",
			"Severity",
		},
		{
			"AnalysisType",
			"AnalysisID",
		},
		{
			"AnalysisType",
		},
	}, []metrics.Metric{
		{
			Name: "AlertsCreated",
			Unit: metrics.UnitCount,
		},
	})
	AnalysisTypeDimension = metrics.Dimension{
		Name:  "AnalysisType",
		Value: "Rule",
	}
)

Types

type Alert

type Alert struct {
	ID                  string    `dynamodbav:"id,string"`
	TimePartition       string    `dynamodbav:"timePartition,string"`
	Severity            string    `dynamodbav:"severity,string"`
	RuleDisplayName     *string   `dynamodbav:"ruleDisplayName,string"`
	FirstEventMatchTime time.Time `dynamodbav:"firstEventMatchTime,string"`
	LogTypes            []string  `dynamodbav:"logTypes,stringset"`
	// Alert Title - will be the Python-generated title or a default one if no Python-generated title is available.
	Title string `dynamodbav:"title,string"`
	AlertDedupEvent
}

Alert contains all the fields associated to the alert stored in DDB

type AlertDedupEvent

type AlertDedupEvent struct {
	RuleID              string    `dynamodbav:"ruleId"`
	RuleVersion         string    `dynamodbav:"ruleVersion"`
	DeduplicationString string    `dynamodbav:"dedup"`
	CreationTime        time.Time `dynamodbav:"creationTime"`
	UpdateTime          time.Time `dynamodbav:"updateTime"`
	EventCount          int64     `dynamodbav:"eventCount"`
	LogTypes            []string  `dynamodbav:"logTypes,stringset"`
	AlertContext        *string   `dynamodbav:"context,string"`
	Type                string    `dynamodbav:"type"`
	// Generated Fields
	GeneratedTitle               *string  `dynamodbav:"title,string"`
	GeneratedDescription         *string  `dynamodbav:"description,string"`
	GeneratedReference           *string  `dynamodbav:"reference"`
	GeneratedSeverity            *string  `dynamodbav:"severity"`
	GeneratedRunbook             *string  `dynamodbav:"runbook"`
	GeneratedDestinationOverride []string `dynamodbav:"destinationOverride,stringset"`
	AlertCount                   int64    `dynamodbav:"-"` // There is no need to store this item in DDB
}

AlertDedupEvent represents the event stored in the alert dedup DDB table by the rules engine

func FromDynamodDBAttribute

func FromDynamodDBAttribute(input map[string]events.DynamoDBAttributeValue) (event *AlertDedupEvent, err error)

type Handler

type Handler struct {
	SqsClient        sqsiface.SQSAPI
	Cache            *RuleCache
	DdbClient        dynamodbiface.DynamoDBAPI
	AlertTable       string
	AlertingQueueURL string
	MetricsLogger    metrics.Logger
}

func (*Handler) Do

func (h *Handler) Do(oldAlertDedupEvent, newAlertDedupEvent *AlertDedupEvent) (err error)

type RuleCache

type RuleCache struct {
	// contains filtered or unexported fields
}

s3ClientCacheKey -> S3 client

func NewCache

func NewCache(policyClient gatewayapi.API) *RuleCache

func (*RuleCache) Get

func (c *RuleCache) Get(id, version string) (*models.Rule, error)