snowflakedb / SnowAlert

Security Analytics Using The Snowflake Data Warehouse
Apache License 2.0
180 stars 57 forks source link

GSE-2738: Add ENTITIES and TAGS column to SnowAlert alerting #641

Closed sfc-gh-bkou closed 1 year ago

sfc-gh-bkou commented 1 year ago

This PR add two additional columns, ENTITIES and TAGS, to the alert queries runner. This allow the two columns to be added to the SNOWALERT.RULES.<VIEW NAME> views and the columns will show up in the SNOWALERT.DATA.ALERTS view.

Here are the testing 1) Local testing on new installation using the new code: a) Run the install script to create a new SnowAlert database in KH account. b) Create a new alert rule with the new columns. c) Create another alert rule without the new columns. d) Trigger both alerts to slack channel. Result: Successfully triggered both alerts and confirmed the alert data.

2) Local testing using the new code on a SnowAlert database created by the older code: a) Recreate the DATA.ALERTS view to include the new columns. b) Create a new alert rule with the new columns. c) Create another alert rule without the new columns. d) Trigger both alerts to slack channel. Result: Successfully triggered both alerts and confirmed the alert data.

The roll out will use #2 and will start with SnowAlert database in OZ first and then to prod.

sfc-gh-afedorov commented 1 year ago

could you add testing methodology to description and review with @sfc-gh-nlele first