Add WAF metrics

Author: Yuri Zubov

.rubocop.yml

@@ -35,9 +35,13 @@ Style/Next:
 Style/FormatString:
   Enabled: false
 
+Style/FrozenStringLiteralComment:
+  Enabled: false
+
 Style/ClassVars:
   Exclude:
     - test/**/*.rb
+
 Metrics/BlockLength:
   Exclude:
     - test/**/*.rb

CHANGELOG.md

@@ -4,6 +4,11 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 This CHANGELOG follows the format listed [here](https://github.com/sensu-plugins/community/blob/master/HOW_WE_CHANGELOG.md)
 
 ## [Unreleased]
+### Security
+- updated yard dependency to `~> 0.9.11` per: https://nvd.nist.gov/vuln/detail/CVE-2017-17042 (@yuri-zubov sponsored by Actility, https://www.actility.com)
+
+### Added
+- Added ability to get metrics from WAF (@yuri-zubov sponsored by Actility, https://www.actility.com)
 
 ## [11.3.1] - 2018-04-17
 ### Fixed

bin/metrics-waf.rb

@@ -0,0 +1,111 @@
+#! /usr/bin/env ruby
+#
+# metrics-waf
+#
+# DESCRIPTION:
+#   Gets latency metrics from CloudWatch and puts them in Graphite for longer term storage
+#
+# OUTPUT:
+#   metric-data
+#
+# PLATFORMS:
+#   Linux
+#
+# DEPENDENCIES:
+#   gem: aws-sdk
+#   gem: sensu-plugin
+#   gem: sensu-plugin-aws
+#   gem: time
+#
+# USAGE:
+#
+#
+# NOTES:
+#
+# LICENSE:
+#   Zubov Yuri <[email protected]> sponsored by Actility, https://www.actility.com
+#   Released under the same terms as Sensu (the MIT license); see LICENSE
+#   for details.
+#
+
+require 'sensu-plugin/metric/cli'
+require 'aws-sdk'
+require 'sensu-plugins-aws'
+require 'time'
+
+class WafMetrics < Sensu::Plugin::Metric::CLI::Generic
+  include CloudwatchCommon
+
+  option :scheme,
+         description: 'Metric naming scheme, text to prepend to metric',
+         short: '-s SCHEME',
+         long: '--scheme SCHEME',
+         default: 'aws.waf'
+
+  option :aws_region,
+         short: '-r AWS_REGION',
+         long: '--aws-region REGION',
+         description: 'AWS Region (defaults to us-east-1).',
+         default: 'us-east-1'
+
+  option :metric,
+         description: 'Metric to fetch',
+         short: '-m METRIC',
+         long: '--metric',
+         required: false,
+         in: %w[AllowedRequests BlockedRequests CountedRequests PassedRequests]
+
+  option :end_time,
+         short:       '-t T',
+         long:        '--end-time TIME',
+         default:     Time.now,
+         proc:        proc { |a| Time.parse a },
+         description: 'CloudWatch metric statistics end time'
+
+  option :period,
+         short:       '-p N',
+         long:        '--period SECONDS',
+         default:     60,
+         proc:        proc(&:to_i),
+         description: 'CloudWatch metric statistics period'
+
+  def print_statistics(statistics, config)
+    statistics.each do |key, stats|
+      r = client.get_metric_statistics(metrics_request(config).merge(metric_name: key, statistics: [stats]))
+      keys = [config[:scheme]]
+      keys.concat([key, stats])
+      unless r[:datapoints].first.nil?
+        output metric_name: keys.join('.'), value: r[:datapoints].first[stats.downcase]
+      end
+    end
+  end
+
+  def run
+    statistic = {
+      'AllowedRequests' => 'Sum',
+      'BlockedRequests' => 'Sum',
+      'CountedRequests' => 'Sum',
+      'PassedRequests' => 'Sum'
+    }
+
+    unless config[:metric].nil?
+      statistic.select! { |key, _| key == config[:metric] }
+    end
+
+    new_config = config.clone
+    new_config[:namespace] = 'WAF'
+    new_config[:dimensions] = [
+      {
+        name: 'WebACL',
+        value: 'SecurityAutomationsMaliciousRequesters'
+      },
+      {
+        name: 'Rule',
+        value: 'ALL'
+      }
+    ]
+
+    print_statistics(statistic, new_config)
+    ok
+  end
+end

sensu-plugins-aws.gemspec

@@ -51,5 +51,5 @@ Gem::Specification.new do |s| # rubocop:disable Metrics/BlockLength
   s.add_development_dependency 'redcarpet',                 '~> 3.2'
   s.add_development_dependency 'rspec',                     '~> 3.4'
   s.add_development_dependency 'rubocop',                   '~> 0.51.0'
-  s.add_development_dependency 'yard',                      '~> 0.8'
+  s.add_development_dependency 'yard',                      '~> 0.9.11'
 end