peersky / autodefender Goto Github PK

Right now actions can be implemented only as part of monitors. We should be able to define actions without. by adding new command in cli: ts-node src/cli.js functions --config defender.config.ts

Access control matcher right now just checks for DEFAULT_ADMIN_ROLE

However the correct behaviour would be to use events log to get
a. any role granted events that are not DEFAULT_ADMIN
b. all privileged accounts that were granted roles

For a various reasons some of monitoring activity makes sense to report in Slack as aggregate summary over some time window. I.e statistical data: numbers of transactions, numbers of privileged account activity etc.

Hence It would be great if we have following workflow:

1. Any Monitors that must report to such summary dashboard are connected to "Summarizer" action.
2. Such "Summarizer" action takes alert information / metadata and records it in to KVS store (or any other DB solution we can get)
3. Another Autotask is invoked on schedule basis to read KVS store with reports and process them. (Idea: Add anomaly detector here!)
4. Send summary webhook sentinel that will post an update to slack/telegram/email etc

From user side ideally we just specify "SummaryWriter" in Notification Channel.

if monitored contracts remove/add new account (i.e. OwnershipChanged) monitoring system should be able to automatically append new owner to ExtractedAccountsList and remove old one IF he is not involved in other privileges anymore

In order to do so we need to:

1. compile typescript
2. substitute in cli.js "contracts.ts" and "monitors.ts" invocation to ".js" files
3. improve cli.js with required arguments, error in case of empty arguments supplied
4. Perhaps it makes sense in same batch of changes to move ./src/types to ./types
5. update readme with package variant of config file: defender.config.js

That will allow functions to use provided api servers i.e. to get ABI's

With this flag the scope of defined networks in configuration should be filtered and only specified network must be used.

I.e.
--network mainnet means that all other networks beyond mainnet must be skipped