CrowdStrike / falcon-integration-gateway

Falcon Integration Gateway (FIG)
The Unlicense
18 stars 17 forks source link

eventType Filter addition #157

Closed carlosmmatos closed 1 year ago

carlosmmatos commented 1 year ago

This PR implements several changes that aim to improve the system's handling of detection events and provide better debugging tools for these processes. Here are the key changes:

  1. Refactoring of Event Type Checks: In backends/__init__.py, the way we check if RELEVANT_EVENT_TYPES is "ALL" has been modified. Instead of comparing the entire list to the string "ALL", we now check if "ALL" is an element of RELEVANT_EVENT_TYPES. This change allows for more flexibility in the RELEVANT_EVENT_TYPES configuration, as it does not have to be exactly "ALL" to be considered as such.

  2. Minor Grammar Change: In falcon/models.py, the logging message for when a detection event is skipped has been grammatically fixed.

  3. Incorporation of Relevant Event Types in Streaming Connection: Changes in falcon/stream.py add relevant_event_types as a parameter in the StreamingConnection class. This allows relevant_event_types to be used when establishing the connection. Now, when constructing the URL for the streaming connection, if relevant_event_types is not None, it is added as a filter in the URL query parameters (&eventType=). This change should help in reducing unnecessary network traffic by filtering out irrelevant events directly at the source.

  4. Enhanced Debugging Information: Also in falcon/stream.py, a new debugging log has been added to print the complete URL used for the streaming connection. This addition should assist in debugging issues related to streaming connection setup.

These changes are expected to enhance the system's performance and make it easier to manage and debug.