-
Notifications
You must be signed in to change notification settings - Fork 13
New issue
Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? # to your account
release 0.4.0 #39
release 0.4.0 #39
Conversation
Signed-off-by: Andreas Schade <san@zurich.ibm.com>
Signed-off-by: Andreas Schade <san@zurich.ibm.com>
Signed-off-by: Andreas Schade <san@zurich.ibm.com>
Signed-off-by: Andreas Schade <san@zurich.ibm.com>
Signed-off-by: Andreas Schade <san@zurich.ibm.com>
Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
…p lifecycle when used with policy monitor; refactor policy monitor and simplified usage in policy engine Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
…nterpreter constructor Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
Thanks for this PR. It fixes the ambiguity we had in the policy engine modes and add pluggable, user-defined actions to the processor. Nice job! I went through the code changes, and made some additional changes, fixes, and refactoring:
I tested the pipeline modes, in both enrich and alert mode, and it looks good. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
…ith monitor parameters Signed-off-by: Frederico Araujo <frederico.araujo@ibm.com>
This PR fixes the mode ambiguity in the policy engine and adds pluggable action handling to the processor.
This PR contains the latest changes for release 0.4.0 of sf-processor:
enrich
andalert
enrich
adds policy info, priority, and tags records that match rules. Non-matching records are pushed as is (non-blocking). This is the default mode.alert
adds policy info, priority, and tags to matching records and raises them to alerts. Non-matching records are blocked.drop
rules can be used to pre-filter the record stream before applying rules. The oldfilter
keyword is silently supported (not documented).action
key in a rule. Value is a comma-separated list of action names. Each action can add context such as tags to the record. Actions attached to a particular rule are executed in the order they were specified.