Promote from 4209 to main

lib/filters/invalid_login_attempt_filter.py

@@ -0,0 +1,21 @@
+import logging
+from datetime import datetime, timedelta
+from lib.log_processor import ProcessedLogEntry
+
+
+def invalid_login_attempt_filter(log_entry: ProcessedLogEntry) -> bool:
+
+    if not isinstance(log_entry.severity, str):
+        return False
+
+    if not isinstance(log_entry.message, str):
+        return False
+
+    if log_entry.severity != "ERROR":
+        return False
+
+    if 'Required "container.clusters.list" permission(s)' not in log_entry.message:
+        return False
+
+    logging.info(f"Skipping invalid login attempt alert")
+    return True

lib/send_alerts.py

@@ -25,6 +25,7 @@
 )
 from lib.log_processor import process_log_entry
 from lib.filters.no_instance_filter import no_instance_filter
+from lib.filters.invalid_login_attempt_filter import invalid_login_attempt_filter
 
 
 def log_entry_skipped(log_entry: ProcessedLogEntry):
@@ -38,6 +39,7 @@ def log_entry_skipped(log_entry: ProcessedLogEntry):
         watching_metadata_invalid_character_filter,
         ip_space_exhausted_filter,
         no_instance_filter,
+        invalid_login_attempt_filter,
     ]
 
     for filter in filters:

tests/lib/filters/test_invalid_login_attempt_filter.py

@@ -0,0 +1,136 @@
+import pytest
+import datetime
+import dataclasses
+
+from lib.log_processor import ProcessedLogEntry
+from lib.filters.invalid_login_attempt_filter import invalid_login_attempt_filter
+
+
+@pytest.fixture()
+def processed_log_entry_invalid_login_attempt_error_Slack() -> ProcessedLogEntry:
+    return ProcessedLogEntry(
+        message="alert: ERROR: [AuditLog] Required \"container.clusters.list\" permission(s) for \"projects/ons-blaise-v2-prod\".'}}, {'type': 'section', 'fields': [{'type': 'mrkdwn', 'text': '*Platform:*\\ngke_cluster'}, {'type': 'mrkdwn', 'text': '*Application:*\\n[unknown]'}, {'type': 'mrkdwn', 'text': '*Log Time:*\\n2024-05-02 09:55:17'}, {'type': 'mrkdwn', 'text': '*Project:*\\nons-blaise-v2-prod'}]}, {'type': 'divider'}, {'type': 'section', 'text': {'type': 'plain_text', 'text': 'serviceName: container.googleapis.com\\nmethodName: google.container.v1.ClusterManager.ListClusters'}}, {'type': 'divider'}, {'type': 'section', 'text': {'type': 'mrkdwn', 'text': '*Next Steps*\\n1. Add some :eyes: to show you are investigating\\n2. <https://console.cloud.google.com/monitoring/uptime?referrer=search&project=ons-blaise-v2-prod | Check the system is online>\\n3. <https://console.cloud.google.com/logs/query;query=protoPayload.@type:%22type.googleapis.com/google.cloud.audit.AuditLog%22%20severity%3D%28WARNING%20OR%20ERROR%20OR%20CRITICAL%20OR%20ALERT%20OR%20EMERGENCY%20OR%20DEBUG%29;timeRange=2024-05-02T08:55:17.641927Z%2F2024-05-02T08:55:17.641927Z--PT1M?referrer=search&project=ons-blaise-v2-prod | View the logs>\\n4. Follow the <https://confluence.ons.gov.uk/pages/viewpage.action?pageId=98502389 | Managing Prod Alerts> process'}}]})",
+        data=dict(description="dummy"),
+        severity="ERROR",
+        platform="cloud_function",
+        application="slack-alerts",
+        log_name="/logs/cloudfunctions",
+        timestamp=datetime.datetime(2024, 5, 20, 10, 23, 56, 32425),
+        log_query={
+            "resource.type": "cloud_function",
+            "resource.labels.instance_id": "00f46b928521d49fcdbf455e4592829a1631850562c1b37283d70572deaca72b851130f7fbca367bbb5a75b386efa9832f3d974f1a5a463b2fb9af0fb2a9c2fb4e57",
+        },
+    )
+
+
+@pytest.fixture()
+def processed_log_entry_invalid_login_attempt_error_GCP() -> ProcessedLogEntry:
+    return ProcessedLogEntry(
+        message='Required "container.clusters.list" permission(s) for "projects/ons-blaise-v2-prod".',
+        data=dict(description="dummy"),
+        severity="ERROR",
+        platform="cloud_function",
+        application="unknown",
+        log_name="/logs/cloudfunctions",
+        timestamp=datetime.datetime(2024, 4, 18, 6, 22, 54, 24321),
+        log_query={
+            "resource.type": "cloud_function",
+            "resource.labels.instance_id": "234023940239340394",
+        },
+    )
+
+
+def test_log_is_not_skipped_when_its_first_run_invalid_login_attempt_error_Slack(
+    processed_log_entry_invalid_login_attempt_error_Slack: ProcessedLogEntry,
+):
+    log_is_skipped = invalid_login_attempt_filter(
+        processed_log_entry_invalid_login_attempt_error_Slack
+    )
+    assert log_is_skipped is True
+
+
+def test_log_is_skipped_when_its_from_cloud_function_when_invalid_login_attempt_error_GCP(
+    processed_log_entry_invalid_login_attempt_error_GCP: ProcessedLogEntry,
+):
+    log_is_skipped = invalid_login_attempt_filter(
+        processed_log_entry_invalid_login_attempt_error_GCP
+    )
+    assert log_is_skipped is True
+
+
+def test_log_message_is_not_a_string_when_invalid_login_attempt_error_Slack(
+    processed_log_entry_invalid_login_attempt_error_Slack: ProcessedLogEntry,
+):
+    processed_log_entry_invalid_login_attempt_error_Slack = dataclasses.replace(
+        processed_log_entry_invalid_login_attempt_error_Slack, message=1234
+    )
+    log_is_skipped = invalid_login_attempt_filter(
+        processed_log_entry_invalid_login_attempt_error_Slack
+    )
+
+    assert log_is_skipped is False
+
+
+def test_log_message_is_not_a_string_when_invalid_login_attempt_error_GCP(
+    processed_log_entry_invalid_login_attempt_error_GCP: ProcessedLogEntry,
+):
+    processed_log_entry_invalid_login_attempt_error_GCP = dataclasses.replace(
+        processed_log_entry_invalid_login_attempt_error_GCP, message=1234
+    )
+    log_is_skipped = invalid_login_attempt_filter(
+        processed_log_entry_invalid_login_attempt_error_GCP
+    )
+
+    assert log_is_skipped is False
+
+
+def test_log_message_is_not_skipped_when_it_does_not_contain_invalid_login_attempt_error_Slack(
+    processed_log_entry_invalid_login_attempt_error_Slack: ProcessedLogEntry,
+):
+    processed_log_entry_invalid_login_attempt_error_Slack = dataclasses.replace(
+        processed_log_entry_invalid_login_attempt_error_Slack, message="foo"
+    )
+    log_is_skipped = invalid_login_attempt_filter(
+        processed_log_entry_invalid_login_attempt_error_Slack
+    )
+
+    assert log_is_skipped is False
+
+
+def test_log_message_is_not_skipped_when_it_does_not_contain_invalid_login_attempt_error_GCP(
+    processed_log_entry_invalid_login_attempt_error_GCP: ProcessedLogEntry,
+):
+    processed_log_entry_invalid_login_attempt_error_GCP = dataclasses.replace(
+        processed_log_entry_invalid_login_attempt_error_GCP, message="foo"
+    )
+    log_is_skipped = invalid_login_attempt_filter(
+        processed_log_entry_invalid_login_attempt_error_GCP
+    )
+
+    assert log_is_skipped is False
+
+
+def test_log_message_is_not_skipped_when_it_contains_severity_info_Slack(
+    processed_log_entry_invalid_login_attempt_error_Slack: ProcessedLogEntry,
+):
+    processed_log_entry_invalid_login_attempt_error_Slack = dataclasses.replace(
+        processed_log_entry_invalid_login_attempt_error_Slack, severity="INFO"
+    )
+    log_is_skipped = invalid_login_attempt_filter(
+        processed_log_entry_invalid_login_attempt_error_Slack
+    )
+
+    assert log_is_skipped is False
+
+
+def test_log_message_is_not_skipped_when_it_contains_severity_info_GCP(
+    processed_log_entry_invalid_login_attempt_error_GCP: ProcessedLogEntry,
+):
+    processed_log_entry_invalid_login_attempt_error_GCP = dataclasses.replace(
+        processed_log_entry_invalid_login_attempt_error_GCP, severity="INFO"
+    )
+    log_is_skipped = invalid_login_attempt_filter(
+        processed_log_entry_invalid_login_attempt_error_GCP
+    )
+
+    assert log_is_skipped is False

tests/test_main.py

@@ -1174,3 +1174,69 @@ def test_skip_all_prod_aborted_where_no_available_instance_alerts(
         logging.INFO,
         "Skipping no instance agent alert",
     ) in caplog.record_tuples
+
+
+def test_skip_invalid_login_attempt_alerts(
+    run_slack_alerter, number_of_http_calls, caplog
+):
+    # arrange
+    example_log_entry = {
+        "protoPayload": {
+            "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
+            "status": {
+                "code": 7,
+                "message": 'Required "container.clusters.list" permission(s) for "projects/ons-blaise-v2-prod".',
+            },
+            "authenticationInfo": {"principalEmail": "ri...e@gm...m"},
+            "requestMetadata": {"requestAttributes": {}, "destinationAttributes": {}},
+            "serviceName": "container.googleapis.com",
+            "methodName": "google.container.v1.ClusterManager.ListClusters",
+            "authorizationInfo": [
+                {
+                    "resource": "projects/ons-blaise-v2-prod",
+                    "permission": "container.clusters.list",
+                    "resourceAttributes": {
+                        "service": "cloudresourcemanager.googleapis.com",
+                        "name": "projects/ons-blaise-v2-prod",
+                        "type": "cloudresourcemanager.googleapis.com/Project",
+                    },
+                    "permissionType": "ADMIN_READ",
+                }
+            ],
+            "resourceName": "projects/ons-blaise-v2-prod/zones/-",
+            "request": {
+                "@type": "type.googleapis.com/google.container.v1alpha1.ListClustersRequest",
+                "parent": "projects/ons-blaise-v2-prod/locations/-",
+            },
+            "resourceLocation": {"currentLocations": ["-"]},
+            "policyViolationInfo": {"orgPolicyViolationInfo": {}},
+        },
+        "insertId": "qx4ozlctr2",
+        "resource": {
+            "type": "gke_cluster",
+            "labels": {
+                "project_id": "ons-blaise-v2-prod",
+                "cluster_name": "",
+                "location": "-",
+            },
+        },
+        "timestamp": "2024-05-02T08:55:17.007657529Z",
+        "severity": "ERROR",
+        "logName": "projects/ons-blaise-v2-prod/logs/cloudaudit.googleapis.com%2Fdata_access",
+        "receiveTimestamp": "2024-05-02T08:55:17.757250577Z",
+    }
+
+    event = create_event(example_log_entry)
+
+    # act
+    with caplog.at_level(logging.INFO):
+        response = run_slack_alerter(event)
+
+    # assert
+    assert response == "Alert skipped"
+    assert number_of_http_calls() == 0
+    assert (
+        "root",
+        logging.INFO,
+        "Skipping invalid login attempt alert",
+    ) in caplog.record_tuples