[viktorbeck98]

Task

Closes #357

Description

Two bugs in JsonParser, both from the issue.

1. AttributeError when the config is not a dictionary. The content parser was only created inside if isinstance(config, dict):. With JsonParser() or a JsonParserConfig object the attribute never existed, and the first log with a message field crashed.

• A non-dict config now gets a MatcherParser() without templates, so the message comes back as <Not Found> / -1.
• The issue allows either this or a clear error on creation. I chose this because a config object only holds the name of the content parser, and the basic docs example and the existing tests build the parser without a dict.

2. Logs without a message field got EventID 0. parse() started from a hardcoded 0, which is also the ID of the first template.

• The default is now -1 with the template <Not Found>, the same as a message that matches no template.

Things to check when reviewing:

• The template_not_found rule in rule_detector.py alerts on EventID == -1, so it now fires for every JSON log without a message field.
• A log without a message and a message that matches no template now share -1. If they should be told apart, that needs a separate ID.
• Not changed here: a message that is a number, object or list raises TypeError, and an empty, null or 0 message is treated as no message.

How Has This Been Tested?

• 2 new tests, and test_parse_json_without_message updated: it asserted the old EventID 0.
• The 3 tests fail without the source change and pass with it.
• Full suite passes (928 passed, 82 skipped).
• The reproduction script from the issue now prints no error, -1 for the log without a message and 0 for the first template.

Checklist

• This Pull-Request goes to the development branch.
• I have successfully run prek locally.
• I have added tests to cover my changes.
• I have linked the issue-id to the task-description.
• I have performed a self-review of my own code.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[thorinaboenke]

@viktorbeck98 is that fine like this? "A log without a message and a message that matches no template now share -1"
-> json logs with out message alert will then trigger RuleDetector R001?
"A non-dict config now gets a MatcherParser() without templates" -> everything /with message and without message field) will come back indiscriminately with id -1? should there at least be a warning for the user?

[viktorbeck98]

@thorinaboenke we could also differentiate between the two cases. You're right, it's probably cleaner. We could use "-2" for when no message field is given

[viktorbeck98]

@thorinaboenke I addressed your comments

[ipmach]

Looks good, the only thing is about the -2. Should we connect this with other components as well? Or is just something from this parser.

For example, what happen when the template matcher does not receive templates because we are sending him Apache logs? Should those logs also have eventid -2?

[viktorbeck98]

Looks good, the only thing is about the -2. Should we connect this with other components as well? Or is just something from this parser.

For example, what happen when the template matcher does not receive templates because we are sending him Apache logs? Should those logs also have eventid -2?

Good point but let's come back to this when we encounter an issue with the -2