Sekoia.io: handle null value#2917
Open
squioc wants to merge 2 commits into
Open
Conversation
Contributor
Reviewer's GuideThe PR hardens Sekoia.io alert triggers against null or missing values in alert payloads and extends tests to validate behavior when alert attributes or nested fields are None, plus bumps the integration version and changelog. Flow diagram for null-safe alert attribute handling in handle_eventflowchart TD
M[message]
HE[handle_event]
AA["alert_attrs = message.get(attributes) or {}"]
ST["status_dict = alert.get(status) or {}"]
CS["custom_status_dict = alert.get(custom_status) or {}"]
VG["verdict_dict = alert.get(verdict) or {}"]
UR["urgency_dict = alert.get(urgency) or {}"]
EN["entity_dict = alert.get(entity) or {}"]
AT["alert_type_dict = alert.get(alert_type) or {}"]
RL["rule_dict = alert.get(rule) or {}"]
OUT[build alert_payload]
M --> HE
HE --> AA
HE --> ST
HE --> CS
HE --> VG
HE --> UR
HE --> EN
HE --> AT
HE --> RL
ST --> OUT
CS --> OUT
VG --> OUT
UR --> OUT
EN --> OUT
AT --> OUT
RL --> OUT
AA --> OUT
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- The alert payload assembly logic now repeats
(alert.get("field") or {})patterns in multiple places; consider extracting a small helper function to centralize this null-safe nested access and keep the trigger code more readable. - The parametrized
samplealert dictionaries are duplicated betweentest_trigger_updated_alert_with_null_parametersandtest_trigger_comment_created_with_null_parameters; you could move them to a shared fixture or factory to reduce repetition and make future updates easier. - The fake API base URL (
http://fake.url/api/v1/sic/alerts/...) is hard-coded in several tests; using a shared constant or fixture for the base URL would simplify maintenance if those endpoints ever change.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The alert payload assembly logic now repeats `(alert.get("field") or {})` patterns in multiple places; consider extracting a small helper function to centralize this null-safe nested access and keep the trigger code more readable.
- The parametrized `sample` alert dictionaries are duplicated between `test_trigger_updated_alert_with_null_parameters` and `test_trigger_comment_created_with_null_parameters`; you could move them to a shared fixture or factory to reduce repetition and make future updates easier.
- The fake API base URL (`http://fake.url/api/v1/sic/alerts/...`) is hard-coded in several tests; using a shared constant or fixture for the base URL would simplify maintenance if those endpoints ever change.
## Individual Comments
### Comment 1
<location path="Sekoia.io/CHANGELOG.md" line_range="14" />
<code_context>
+
+### Fixed
+
+- Fix the way to handle absent or null values in the triggers
+
## 2026-07-22 - 2.74.4
</code_context>
<issue_to_address>
**suggestion (typo):** Consider rephrasing this entry for clearer grammar.
The current wording is slightly awkward. Consider "Fix handling of absent or null values in triggers" or "Fix how absent or null values are handled in triggers" for smoother readability.
```suggestion
- Fix handling of absent or null values in triggers
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
|
||
| ### Fixed | ||
|
|
||
| - Fix the way to handle absent or null values in the triggers |
Contributor
There was a problem hiding this comment.
suggestion (typo): Consider rephrasing this entry for clearer grammar.
The current wording is slightly awkward. Consider "Fix handling of absent or null values in triggers" or "Fix how absent or null values are handled in triggers" for smoother readability.
Suggested change
| - Fix the way to handle absent or null values in the triggers | |
| - Fix handling of absent or null values in triggers |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR hardens the Sekoia.io alert-related triggers against null/missing fields in incoming notifications and Alert API payloads, adds regression tests for these cases, and releases the fix as module version 2.74.5.
Changes:
- Make trigger handlers tolerate
message["attributes"]beingnullby defaulting to{}. - Guard access to nullable nested alert fields (
status,rule,verdict,custom_status, etc.) when building outgoing event payloads. - Extend trigger tests to include Alert API responses with
nullvalues for nested fields; bump manifest version and add a changelog entry.
Reviewed changes
Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
Sekoia.io/sekoiaio/triggers/alerts.py |
Adds null-safe defaults for notification attributes and nested alert fields when constructing trigger events. |
Sekoia.io/tests/ic_oc_triggers/test_alerts.py |
Adds coverage for notifications / alert payloads containing null attributes and nested fields. |
Sekoia.io/manifest.json |
Bumps module version to 2.74.5. |
Sekoia.io/CHANGELOG.md |
Adds a 2.74.5 changelog entry describing the fix. |
Comment on lines
+99
to
103
| "urgency": (alert.get("urgency") or {}).get("current_value"), | ||
| "entity": (alert.get("entity") or {}), | ||
| "alert_type": (alert.get("alert_type") or {}), | ||
| "rule": {"name": (alert.get("rule") or {}).get("name"), "uuid": (alert.get("rule") or {}).get("uuid")}, | ||
| "last_seen_at": alert.get("last_seen_at"), |
|
|
||
| ### Fixed | ||
|
|
||
| - Fix the way to handle absent or null values in the triggers |
PierrickV
reviewed
Jul 23, 2026
PierrickV
left a comment
PierrickV
left a comment
Contributor
There was a problem hiding this comment.
Shouldn't this be a pydantic model ? 🙏
PierrickV
approved these changes
Jul 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fix the way the trigger handles null values in some parameters of an alert.
Summary by Sourcery
Handle null or absent alert attributes safely in Sekoia.io triggers and document the fix.
Bug Fixes:
Enhancements:
Build:
Documentation:
Tests: