Skip to content

Commit

Permalink
Fixes bug in AQR
Browse files Browse the repository at this point in the history
Alert columns with value NULL::STRING cause errors in Jira handler
  • Loading branch information
sfc-gh-afedorov committed Oct 22, 2019
1 parent 29acf72 commit 7736ae4
Showing 1 changed file with 14 additions and 14 deletions.
28 changes: 14 additions & 14 deletions src/runners/alert_queries_runner.py
Original file line number Diff line number Diff line change
Expand Up @@ -24,20 +24,20 @@
SELECT OBJECT_CONSTRUCT(
'ALERT_ID', UUID_STRING(),
'QUERY_NAME', '{{query_name}}',
'QUERY_ID', IFNULL(QUERY_ID, PARSE_JSON('null')),
'ENVIRONMENT', IFNULL(ENVIRONMENT, PARSE_JSON('null')),
'SOURCES', IFNULL(SOURCES, PARSE_JSON('null')),
'ACTOR', IFNULL(ACTOR, PARSE_JSON('null')),
'OBJECT', IFNULL(OBJECT, PARSE_JSON('null')),
'ACTION', IFNULL(ACTION, PARSE_JSON('null')),
'TITLE', IFNULL(TITLE, PARSE_JSON('null')),
'EVENT_TIME', IFNULL(EVENT_TIME, PARSE_JSON('null')),
'ALERT_TIME', IFNULL(ALERT_TIME, PARSE_JSON('null')),
'DESCRIPTION', IFNULL(DESCRIPTION, PARSE_JSON('null')),
'DETECTOR', IFNULL(DETECTOR, PARSE_JSON('null')),
'EVENT_DATA', IFNULL(EVENT_DATA, PARSE_JSON('null')),
'SEVERITY', IFNULL(SEVERITY, PARSE_JSON('null')),
'HANDLERS', IFNULL(OBJECT_CONSTRUCT(*):HANDLERS, PARSE_JSON('null'))
'QUERY_ID', IFNULL(QUERY_ID::VARIANT, PARSE_JSON('null')),
'ENVIRONMENT', IFNULL(ENVIRONMENT::VARIANT, PARSE_JSON('null')),
'SOURCES', IFNULL(SOURCES::VARIANT, PARSE_JSON('null')),
'ACTOR', IFNULL(ACTOR::VARIANT, PARSE_JSON('null')),
'OBJECT', IFNULL(OBJECT::VARIANT, PARSE_JSON('null')),
'ACTION', IFNULL(ACTION::VARIANT, PARSE_JSON('null')),
'TITLE', IFNULL(TITLE::VARIANT, PARSE_JSON('null')),
'EVENT_TIME', IFNULL(EVENT_TIME::VARIANT, PARSE_JSON('null')),
'ALERT_TIME', IFNULL(ALERT_TIME::VARIANT, PARSE_JSON('null')),
'DESCRIPTION', IFNULL(DESCRIPTION::VARIANT, PARSE_JSON('null')),
'DETECTOR', IFNULL(DETECTOR::VARIANT, PARSE_JSON('null')),
'EVENT_DATA', IFNULL(EVENT_DATA::VARIANT, PARSE_JSON('null')),
'SEVERITY', IFNULL(SEVERITY::VARIANT, PARSE_JSON('null')),
'HANDLERS', IFNULL(OBJECT_CONSTRUCT(*):HANDLERS::VARIANT, PARSE_JSON('null'))
) AS alert
, alert_time
, event_time
Expand Down

0 comments on commit 7736ae4

Please sign in to comment.