airbnb/streamalert

[publishers] Add support for default publishers per output

blakemotl opened this issue · 0 comments

Background

Currently if you want to leverage publishers for a rule, you have to configure them for every single rule that you want to use the publisher for. While using this feature I noticed that in most cases publishers are tightly coupled to a specific output. Additionally if you maintain a large list of rules, it is a lot of work to add a new publisher, since you have to manually apply it to every single rule that needs that publisher even if the output for it is already configured. Therefore I propose a feature to support a default publisher per output. If no publisher for that output is specified on a rule, it defaults to the preconfigured publisher if it exists.

Desired Change

Allow a default publisher to be specified per output in outputs.conf, and update the rules engine to apply this publisher when none is specified per output per rule.