Merge pull request #12 from Lyndon-prequel/main

Added new tags and CRE descriptions

Author: tonymeehan

rules/cre-2025-0021/keda-nil-pointer.yaml

@@ -37,7 +37,7 @@ rules:
       gen: 1
     rule:
       set:
-        window: 1s
+        window: 5s
         event:
           source: keda-operator
         match:

rules/cre-2025-0025/kafka-broker-replication-mismatch.yaml

@@ -3,7 +3,7 @@ rules:
       id: CRE-2025-0025
       severity: 2
       title: Kafka broker replication mismatch
-      category: message-queue-problems
+      category: message-queue-problem
       author: Prequel
       description: |
         When the configured replication factor for a Kafka topic is greater than the actual number of brokers in the cluster, Kafka repeatedly fails to assign partitions and logs replication-related errors. This results in persistent warnings or an `InvalidReplicationFactorException` when the broker tries to create internal or user-defined topics.

rules/cre-2025-0026/aws-ebs-csi-driver-fails-to.yaml

@@ -39,6 +39,7 @@ rules:
     set:
       event:
         source: aws-eks-nodeagent
+      window: 10s
       match:
         - value: the server could not find the requested resource (get volumesnapshotcontents.snapshot.storage.k8s.io)
         - value: Unhandled Error

rules/cre-2025-0028/opentelemetry-python-fails-to.yaml

@@ -38,6 +38,7 @@ rules:
     set:
       event:
         source: opentelemetry
+      window: 5s
       match:
         - value: ERROR opentelemetry.context:Failed to detach context
         - regex: "ValueError: <Token var=<ContextVar name='current_context' .* was created in a different Context"

rules/cre-2025-0030/sqlalchemy-fails-when.yaml

@@ -43,4 +43,4 @@ rules:
         source: logs
       window: 5s
       match:
-      - regex: '.*sqlalchemy.exc.ArgumentError: Could not parse rfc1738 URL from string.*'
+        - regex: '.*sqlalchemy.exc.ArgumentError: Could not parse rfc1738 URL from string.*'

rules/cre-2025-0032/loki-generates-excessive-logs.yaml

@@ -6,17 +6,17 @@ rules:
     category: observability-problem
     author: Prequel
     description: |
-      - 'Loki instances using memcached for caching may emit excessive warning or error logs when the configured`memcached_client` service port name does not match the actual Kubernetes service port. This does not cause a crash or failure, but it results in noisy logs and ineffective caching behavior.
+      - Loki instances using memcached for caching may emit excessive warning or error logs when the configured`memcached_client` service port name does not match the actual Kubernetes service port. This does not cause a crash or failure, but it results in noisy logs and ineffective caching behavior.
     cause: |
-      - 'Loki''s memcached client resolves the service by port name. If the port name is incorrect or not present in the Kubernetes service definition, the client fails to connect silently or repeatedly logs errors while retrying.
+      - Loki's memcached client resolves the service by port name. If the port name is incorrect or not present in the Kubernetes service definition, the client fails to connect silently or repeatedly logs errors while retrying.
     tags:
-    - loki
-    - memcached
-    - configuration
-    - service
-    - cache
-    - known-issue
-    - kubernetes
+      - loki
+      - memcached
+      - configuration
+      - service
+      - cache
+      - known-issue
+      - kubernetes
     mitigation: | 
       - Ensure that the `memcached_client` configuration references the correct Kubernetes service **port name**.
       - Match the port name exactly as defined in your memcached service. 
@@ -43,10 +43,10 @@ rules:
     id: 8LBoHzFdJy9RP4tZcpry2T
     gen: 1
   rule:
-    set:
+    sequence:
       event:
         source: logs
       window: 60s
-      match:
+      order:
         - regex: '.*msg="failed to connect to memcached server.*lookup .* on .*: no such host.*'
           count: 20

rules/cre-2025-0033/opentelemetry-collector.yaml

@@ -41,7 +41,6 @@ rules:
     set:
       event:
         source: logs
-      window: 5s
       match:
         - regex: '.*scrape/scrape.go:\d+\s+Scrape commit failed.*\"error\": \"data refused due to high memory usage\"'
 

rules/cre-2025-0034/datadog-agent-disabled-due-to.yaml

@@ -40,6 +40,5 @@ rules:
     set:
       event:
         source: logs
-      window: 5s
       match:
         - regex: .*DD_API_KEY undefined\. Metrics, logs and events will not be reported to DataDog.*

rules/cre-2025-0035/psycopg2-ssl-error-due-to.yaml

@@ -43,6 +43,5 @@ rules:
     set:
       event:
         source: logs
-      window: 5s
       match:
         - regex: '.*django\.db\.utils\.OperationalError: SSL error: decryption failed or bad record mac.*'

rules/cre-2025-0036/opentelemetry-collector-drops.yaml

@@ -42,6 +42,5 @@ rules:
     set:
       event:
         source: logs
-      window: 5s
       match:
         - regex: 'internal/queue_sender.*Exporting failed.*"exporter".*Permanent error: 413 Payload Too Large.*'