Skip to content

TODO.md

Latest commit

 

History

History
68 lines (46 loc) · 4.28 KB

TODO.md

File metadata and controls

68 lines (46 loc) · 4.28 KB
Raw

TODO - WALLIX Bastion Technology Add-on

This document lists the improvement tasks for the WALLIX Bastion Add-on for Splunk. Tasks are categorized by priority and focus on what is achievable within the scope of the add-on.

Phase 1: Security and Reliability (High Priority)

The goal of this phase is to fix critical security issues, update dependencies, and improve the overall robustness of the add-on.

  • Security: Enable SSL Validation by Default

    • Description: Modify modalert_kill_session_helper.py to enable SSL/TLS certificate validation by default. The current setting (verify=False) is a major security risk. This should be coupled with an option to provide a custom CA bundle.
    • Files: bin/modalert_kill_session_helper.py

  • Security: Audit and Update Libraries

    • Description: Review the versions of the bundled Python libraries (e.g., requests) and update them to patch known vulnerabilities (CVEs).
    • Files: bin/ta_wallix_bastion/

  • Compatibility: Ensure Python 3 Compatibility

    • Description: Ensure full compatibility and optimize the code for recent Python 3 versions (e.g., 3.8+), as Splunk has deprecated Python 2.
    • Files: All Python scripts.

  • Reliability: Improve Error Handling

    • Description: Strengthen error handling in the alert action script, especially for WALLIX API connection failures (network errors, HTTP 4xx/5xx status codes), and provide clear, actionable log messages.
    • Files: bin/modalert_kill_session_helper.py

  • Code Quality: Integrate Linter and Formatter

    • Description: Set up tools like black and pylint to enforce a consistent code style and detect potential issues early.

Phase 2: Technical and User Experience Improvements

This phase focuses on performance optimization, improving the configuration UI, and ensuring compatibility.

  • Performance: Optimize Field Extraction Regex

    • Description: Analyze and optimize the regular expressions in props.conf to improve field extraction performance on large log volumes.
    • Files: default/props.conf

  • Configuration: Enhance Configuration UI

    • Description: Make the configuration page more intuitive and add real-time validation for user inputs (e.g., API URL format, API key presence).
    • Files: default/data/ui/views/configuration.xml, bin/TA_WALLIX_Bastion_rh_settings.py

  • Configuration: Allow Custom SSL Certificate Configuration

    • Description: Add an option in the configuration UI for the user to provide a path to a custom CA bundle for SSL validation, as an alternative to disabling it.
    • Files: default/data/ui/views/configuration.xml, bin/TA_WALLIX_Bastion_rh_settings.py

  • Compatibility: Validate for Splunk 9.x and Splunk Cloud

    • Description: Test and ensure the add-on functions correctly on the latest versions of Splunk Enterprise (9.x) and passes the AppInspect tool for Splunk Cloud readiness.

  • Logging: Improve Add-on Logging

    • Description: Implement structured logging (e.g., key-value pairs or JSON) for Python scripts to facilitate debugging. Include performance metrics (e.g., API call duration).

Phase 3: Advanced Features and Documentation

This phase aims to enrich the add-on with new capabilities and provide comprehensive documentation for users and developers.

  • Feature: Alert Action for Notifications

    • Description: Create a new custom alert action to send notifications (e.g., via a webhook) upon detecting a critical event.

  • Feature: Implement API Call Caching

    • Description: Implement a simple caching mechanism for repetitive API calls to reduce the load on the WALLIX Bastion and speed up operations.

  • Documentation: Installation and Configuration Guide

    • Description: Write a detailed guide with screenshots for installing, configuring, and using the add-on.

  • Documentation: Improve Code Documentation

    • Description: Enhance code documentation (docstrings) for all Python scripts, explaining the business logic and the purpose of key functions.

  • Testing: Develop a Unit Test Suite

    • Description: Create unit tests for the business logic in the Python scripts, particularly for the alert action script, to ensure reliability and prevent regressions.