feat: Add get_event by ID method to Events client v1 and v2 (#188)

* feat: Add get_event by ID method to Events client v1 and v2
* fix: Solve linting problems
* fix(ci): Update custom fixture rules file

Author: tembleking

fixtures/custom_rules.yaml

@@ -12,20 +12,6 @@
 
 # Or override any rule, macro, or list from the Default Rules
 ---
-- macro: "user_known_k8s_client_container"
-  condition: "container.image.repository=\"k8s.gcr.io/fluentd-gcp-scaler\" or container.image.repository=\"\
-    fluxcd/flux\" or container.image.repository=\"sysdig/agent\" or container.image.repository=\"\
-    fluxcd/helm-operator\" or (container.image.repository=\"google/cloud-sdk\")"
-  append: false
-
-- macro: "user_known_write_below_root_activities"
-  condition: "(container.image.repository startswith \"bbcdocker/go-synapse\" and\
-    \ fd.name=\"/haproxy.conf\") or (container.image.repository=\"cassandra\" and\
-    \ fd.name startswith \"/root/.cassandra/\") or (container.id=host and fd.name\
-    \ startswith /root/.kube/) or (container.image.repository=\"mariadb\" and proc.name=\"\
-    mysqld\") or (container.image.repository=\"mariadb\" and proc.name=\"mysql\")"
-  append: false
-
 - macro: "user_known_network_tool_client_container"
   condition: "container.image.repository=\"bbcdocker/go-synapse\" or container.image.repository=\"\
     strimzi/kafka\" or container.image.repository=\"landoop/fast-data-dev\""
@@ -50,12 +36,6 @@
   source: "syscall"
   append: false
 
-- macro: "user_known_write_below_etc_activities"
-  condition: "(container.image.repository=\"quay.io/thanos/thanos\" and fd.name=\"\
-    /etc/prom/prometheus.yaml.tmp\" or (container.image.repository=\"eu.gcr.io/bbc-registry/comuto3\"\
-    \ and fd.name startswith \"/etc/nginx/\"))"
-  append: false
-
 - rule: "The docker client is executed in a container"
   desc: "Detect a k8s client tool executed inside a container"
   condition: "spawned_process and container and not user_known_k8s_client_container\
@@ -85,39 +65,6 @@
   - "users"
   append: false
 
-- macro: "user_known_write_etc_conditions"
-  condition: "proc.name=confd or (container.image.repository=\"confluentinc/cp-schema-registry\"\
-    \ and fd.name startswith \"/etc/schema-registry/\") or (container.image.repository=\"\
-    eu.gcr.io/bbc-registry/communication\" and fd.name startswith \"/etc/nginx/\"\
-    ) or (container.image.repository=\"eu.gcr.io/bbc-registry/redirector\" and fd.name\
-    \ startswith \"/etc/nginx/\") or (container.image.repository=\"eu.gcr.io/bbc-registry/webhooks\"\
-    \ and fd.name startswith \"/etc/nginx/\")or (container.image.repository=\"thanosio/thanos\"\
-    \ and fd.name startswith \"/etc/prom/\") or (container.image.repository=\"eu.gcr.io/bbc-registry/insurance-backoffice\"\
-    \ and fd.name startswith \"/etc/nginx/\") or (container.id=\"host\" and proc.name=\"\
-    exe\" and proc.pname=\"dockerd\")"
-  append: false
-
-- macro: "user_known_package_manager_in_container"
-  condition: "(container.image.repository=\"confluentinc/cp-schema-registry\" and\
-    \ proc.name=\"pip\") or (container.image.repository=sysdig/node-image-analyzer\
-    \ and proc.name=rpm)"
-  append: false
-
-- macro: "user_privileged_containers"
-  condition: "(container.image.repository endswith sysdig/agent) or (container.image.repository=weaveworks/scope)\
-    \ or (container.image.repository=docker.io/weaveworks/scope) or (container.image.repository=gcr.io/google-containers/startup-script)\
-    \ or (container.image.repository=gke.gcr.io/kube-proxy) or (container.image.repository=sysdig/node-image-analyzer)"
-  append: false
-
-- macro: "user_sensitive_mount_containers"
-  condition: "(container.image.repository = docker.io/sysdig/agent) or (container.image.repository=quay.io/prometheus/node-exporter)\
-    \ or (container.image.repository=weaveworks/scope) or (container.image.repository=datadog/agent)"
-  append: false
-
-- macro: "user_known_change_thread_namespace_activities"
-  condition: "container.image.repository=gcr.io/google-containers/startup-script"
-  append: false
-
 - list: "user_known_hostnetwork_images"
   items:
   - "gke.gcr.io/kube-proxy"
@@ -168,23 +115,6 @@
   tags: []
   append: true
 
-- macro: "user_shell_container_exclusions"
-  condition: "((container.image.repository=bitnami/rabbitmq and proc.pname=erl) or\
-    \ (container.image.repository=bitnami/rabbitmq and proc.pname=\"beam.smp\"))"
-  append: false
-
-- macro: "user_known_write_root_conditions"
-  condition: "(fd.name=/root/.bash_history) or (container.image.repository=\"cassandra\"\
-    \ and fd.name startswith \"/root/.cassandra/\") or (container.image.repository=\"\
-    bbcdocker/go-synapse\" and fd.name=\"/haproxy.conf\") or (container.id=\"host\"\
-    \ and proc.name=\"exe\" and proc.pname=\"dockerd\")"
-  append: false
-
-- macro: "exe_running_docker_save"
-  condition: "((proc.cmdline startswith \"exe /var/lib/docker\" or proc.cmdline startswith\
-    \ \"exe / /var/lib/docker\") and proc.pname in (dockerd, docker))"
-  append: false
-
 - rule: "Update Package Repository"
   condition: "and not exe_running_docker_save"
   tags: []
@@ -201,11 +131,6 @@
   tags: []
   append: true
 
-- macro: "allowed_clear_log_files"
-  condition: "(container.image.repository=\"landoop/fast-data-dev\" and fd.name=\"\
-    /var/log/broker.log\")"
-  append: false
-
 - list: "user_known_gke_metadata_images"
   items:
   - "gke.gcr.io/kube-proxy-amd64"
@@ -225,7 +150,7 @@
 
 - macro: "mariadb_snapshots_validator"
   condition: "(container.image.repository=\"google/cloud-sdk\" and container.name\
-    \ contains\"snapshot-validator\")"
+    \ contains \"snapshot-validator\")"
   append: false
 
 - macro: "bbc_java_app_proc"
@@ -286,10 +211,6 @@
   tags: []
   append: true
 
-- macro: "user_shell_container_exclusions"
-  condition: "(container.image.repository=\"kong\" and proc.pname=\"nginx\")"
-  append: false
-
 - list: "user_known_privilged_k8s_roles"
   items:
   - "mariadb-moderation-snapshot-validated"
@@ -319,21 +240,6 @@
   tags: []
   append: true
 
-- macro: "user_known_network_tool_activities"
-  condition: "(container.image.repository=\"mariadb\" and (proc.pname=\"wsrep_sst_maria\"\
-    \ or proc.pname=\"timeout\") and proc.name=\"socat\")"
-  append: false
-
-- macro: "user_shell_container_exclusions"
-  condition: "(container.image.repository=\"mariadb\" and proc.pname=\"mysqld\" and\
-    \ proc.name=\"sh\")"
-  append: false
-
-- macro: "user_known_remote_file_copy_activities"
-  condition: "(container.image.repository=\"eu.gcr.io/bbc-registry/command-export-russian-user\"\
-    \ and proc.name=\"sftp\")"
-  append: false
-
 - rule: "Launch Remote File Copy Tools in Container"
   condition: "and not user_known_remote_file_copy_activities"
   tags: []
@@ -349,27 +255,6 @@
   tags: []
   append: true
 
-- macro: "user_known_container_drift_activities"
-  condition: "((container.image.repository=\"fluxcd/helm-operator\" and proc.name=\"\
-    git\" and evt.arg.filename endswith \"/.git/config\") or (container.image.repository=\"\
-    fluxcd/flux\" and proc.name=\"git\" and evt.arg.filename endswith \"/.git/config\"\
-    ) or (container.image.repository=\"k8s.gcr.io/fluentd-gcp-scaler\" and proc.name=\"\
-    kubectl\" and evt.arg.filename startswith \"/root/.kube/cache/discovery/\") or\
-    \ (container.image.repository=\"eu.gcr.io/bbc-registry/command-bnp-payout-report\"\
-    \ and proc.name=\"gpg-agent\" and evt.arg.filename startswith \"/root/.gnupg/\"\
-    ) or (container.image.repository=\"gcr.io/stackdriver-agents/stackdriver-logging-agent\"\
-    \ and evt.arg.filename startswith \"/var/run/google-fluentd/\") or (container.image.repository=\"\
-    weaveworks/prom-aggregation-gateway\" and proc.name=\"prom-aggregatio\" and evt.arg.filename\
-    \ startswith \"/var/lib/docker/\") or (container.image.repository=\"datadog/agent\"\
-    \ and proc.name=\"system-probe\" and evt.arg.filename startswith \"/var/run/sysprobe/\"\
-    ) or (container.image.repository=\"docker.elastic.co/elasticsearch/elasticsearch\"\
-    \ and proc.name=\"java\" and evt.arg.filename startswith \"/usr/share/elasticsearch/plugins/\"\
-    ) or (container.image.repository=\"docker.elastic.co/elasticsearch/elasticsearch\"\
-    \ and proc.name=\"cp\" and evt.arg.filename startswith \"/mnt/elastic-internal/elasticsearch-config-local/\"\
-    ) or (container.image.repository=\"istio/proxyv2\" and proc.name=\"pilot-agent\"\
-    \ and evt.arg.filename startswith \"/var/lib/docker/overlay2/\"))"
-  append: false
-
 - macro: "test_foo_bar"
   condition: "never_true"
   append: false

sdcclient/monitor/_events_v1.py

@@ -36,6 +36,27 @@ def get_events(self, from_s=None, to_s=None, last_s=None):
         res = self.http.get(self.url + '/api/events/', headers=self.hdrs, params=params, verify=self.ssl_verify)
         return self._request_result(res)
 
+    def get_event(self, id):
+        """
+        Retrieve an event using the ID
+        Args:
+            id(str): ID of the event to retrieve
+
+        Returns:
+            A tuple where the first parameter indicates if the call was successful,
+            and the second parameter holds either the error as string, or the event matching this ID.
+
+        Examples:
+            >>> from sdcclient.monitor import EventsClientV1
+            >>> client = EventsClientV1(token=SECURE_TOKEN)
+            >>> ok, res = client.get_event(id='2343214984')
+            >>> if ok:
+            >>>     print(res["event"])
+        """
+        url = f'{self.url}/api/events/{id}'
+        res = self.http.get(url, headers=self.hdrs, verify=self.ssl_verify)
+        return self._request_result(res)
+
     def post_event(self, name, description=None, severity=None, event_filter=None, tags=None):
         '''**Description**
             Send an event to Sysdig Monitor. The events you post are available in the Events tab in the Sysdig Monitor UI and can be overlied to charts.

sdcclient/monitor/_events_v2.py

@@ -79,6 +79,28 @@ def get_events(self, name=None, category=None, direction='before', status=None,
         res = self.http.get(self.url + '/api/v2/events/', headers=self.hdrs, params=params, verify=self.ssl_verify)
         return self._request_result(res)
 
+    def get_event(self, id):
+        """
+        Retrieve an event using the ID
+        Args:
+            id(str): ID of the event to retrieve
+
+        Returns:
+            A tuple where the first parameter indicates if the call was successful,
+            and the second parameter holds either the error as string, or the event matching this ID.
+
+        Examples:
+            >>> from sdcclient.monitor import EventsClientV2
+            >>> client = EventsClientV2(token=SECURE_TOKEN)
+            >>> ok, res = client.get_event(id='2343214984')
+            >>> if ok:
+            >>>     print(res["event"])
+        """
+
+        url = f'{self.url}/api/v2/events/{id}'
+        res = self.http.get(url, headers=self.hdrs, verify=self.ssl_verify)
+        return self._request_result(res)
+
     def delete_event(self, event):
         '''**Description**
             Deletes an event.

specs/monitor/events_v1_spec.py

@@ -1,7 +1,7 @@
 import os
 import time
 
-from expects import expect, have_key, contain, have_keys, be_empty
+from expects import expect, have_key, contain, have_keys, be_empty, equal
 from mamba import it, before, description
 
 from sdcclient.monitor import EventsClientV1
@@ -18,6 +18,19 @@
                                       description="This event was created in a CI pipeline for the Python SDK library")
         expect(call).to(be_successful_api_call)
 
+    with it("is able to retrieve an event by ID"):
+        ok, res = self.client.post_event(name=self.event_name,
+                                         description="This event was created in a CI pipeline for the Python SDK library")
+        expect((ok, res)).to(be_successful_api_call)
+
+        event = res["event"]
+        event_id = event["id"]
+
+        ok, res = self.client.get_event(id=event_id)
+        expect((ok, res)).to(be_successful_api_call)
+
+        expect(res["event"]).to(equal(event))
+
     with it("is able to list the events happened without any filter"):
         time.sleep(3)  # Wait for the event to appear in the feed
         ok, res = self.client.get_events()

specs/monitor/events_v2_spec.py

@@ -32,6 +32,19 @@
         expect(res).to(have_key("events"))
         expect(res["events"]).to(contain(have_key("scope", equal("host.hostName = 'ci'"))))
 
+    with it("is able to retrieve an event by ID"):
+        ok, res = self.client.post_event(name=self.event_name,
+                                         description="This event was created in a CI pipeline for the Python SDK library")
+        expect((ok, res)).to(be_successful_api_call)
+
+        event = res["event"]
+        event_id = event["id"]
+
+        ok, res = self.client.get_event(id=event_id)
+        expect((ok, res)).to(be_successful_api_call)
+
+        expect(res["event"]).to(equal(event))
+
     with it("is able to list the events happened without any filter"):
         time.sleep(3)  # Wait for the event to appear in the feed
         ok, res = self.client.get_events()