Skip to content

fix: warn when trigger condition references missing alert field - #117

Merged
peaktwilight merged 1 commit into
opensoar-hq:mainfrom
Darkroom4364:fix/trigger-condition-field-warning
Apr 19, 2026
Merged

fix: warn when trigger condition references missing alert field#117
peaktwilight merged 1 commit into
opensoar-hq:mainfrom
Darkroom4364:fix/trigger-condition-field-warning

Conversation

@Darkroom4364

Copy link
Copy Markdown
Contributor

Summary

  • Log a warning when a trigger condition references a field not present in the alert data
  • A typo like {"severiy": "critical"} silently causes the playbook to never match — this makes it visible in logs

Note: Issue #110 originally described the behavior as matching everything; the actual behavior is the opposite (the playbook is silently skipped). Either way, the root problem is the same — no feedback on misconfigured conditions.

Closes #110

A typo in a trigger condition field name (e.g. "severiy" instead of
"severity") silently causes the playbook to never match. Log a warning
so misconfigured conditions are visible in logs.

Closes opensoar-hq#110
@peaktwilight
peaktwilight merged commit 849a495 into opensoar-hq:main Apr 19, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Playbook trigger conditions silently match on mistyped field names

2 participants