class_docstr: Encapsulates a single alert and handles serializing to Dynamo and merging.
class_docstr_tok: ["Encapsulates","a","single","alert","and","handles","serializing","to","Dynamo","and","merging","."]
docstr: Create a new Alert with a random ID and timestamped now.
  
  Args:
      rule_name (str): Name of the rule which triggered the alert
      record (dict): Parsed log which triggered the alert
      outputs (set): Set of string outputs where the alert should be delivered to
  
  Kwargs (optional):
      alert_id (str): Existing AlertID, if known. If not specified, a random one is created.
      attempts (int): Number of attempts to deliver this alert so far. Defaults to 0.
      cluster (str): Cluster from which the alert was generated.
      context (dict): Context dictionary associated with the triggering rule.
      created (datetime): Alert creation time (UTC).
      dispatched (datetime): Time alert was last dispatched (UTC).
      log_source (str): Log type which triggered the alert, e.g. "binaryalert"
      log_type (str): The type of the triggering log. Usually "json"
      merge_by_keys (list): Alerts are merged if the values associated with all of these
          keys are equal. Keys can be present at any depth in the record.
      merge_window (timedelta): Merged alerts are sent at this interval.
      outputs_sent (set): Subset of outputs which have sent successfully.
      publishers (str|list|dict): A structure of Strings, representing either fully qualified
          function names, or publisher classes. Adopts one of the following formats:
  
          - None, or empty array; DefaultPublisher is run on all outputs.
          - Single string; One publisher is run on all outputs.
          - List of strings; All publishers are run on all outputs in order of declaration.
          - Dict mapping to strings or lists: The dict maps output service keys to a string
              or lists of strings. These strings corresponds to all publishers that are run,
              in order, for only that specific output service.
  
      rule_description (str): Description associated with the triggering rule.
      source_entity (str): Name of location from which the record originated. E.g. "mychannel"
      source_service (str): Input type from which the record originated. E.g. "slack"
      staged (bool): Whether this rule is currently in the staging process. Defaults to False
  
  Raises:
      AlertCreationError: If the keyword arguments are not in the expected set.
docstr_tok: ["Create","a","new","Alert","with","a","random","ID","and","timestamped","now",".","Args",":","rule_name","(","str",")",":","Name","of","the","rule","which","triggered","the","alert","record","(","dict",")",":","Parsed","log","which","triggered","the","alert","outputs","(","set",")",":","Set","of","string","outputs","where","the","alert","should","be","delivered","to","Kwargs","(","optional",")",":","alert_id","(","str",")",":","Existing","AlertID",",","if","known",".","If","not","specified",",","a","random","one","is","created",".","attempts","(","int",")",":","Number","of","attempts","to","deliver","this","alert","so","far",".","Defaults","to","0.","cluster","(","str",")",":","Cluster","from","which","the","alert","was","generated",".","context","(","dict",")",":","Context","dictionary","associated","with","the","triggering","rule",".","created","(","datetime",")",":","Alert","creation","time","(","UTC",")",".","dispatched","(","datetime",")",":","Time","alert","was","last","dispatched","(","UTC",")",".","log_source","(","str",")",":","Log","type","which","triggered","the","alert",",","e.g",".","``","binaryalert","''","log_type","(","str",")",":","The","type","of","the","triggering","log",".","Usually","``","json","''","merge_by_keys","(","list",")",":","Alerts","are","merged","if","the","values","associated","with","all","of","these","keys","are","equal",".","Keys","can","be","present","at","any","depth","in","the","record",".","merge_window","(","timedelta",")",":","Merged","alerts","are","sent","at","this","interval",".","outputs_sent","(","set",")",":","Subset","of","outputs","which","have","sent","successfully",".","publishers","(","str|list|dict",")",":","A","structure","of","Strings",",","representing","either","fully","qualified","function","names",",","or","publisher","classes",".","Adopts","one","of","the","following","formats",":","-","None",",","or","empty","array",";","DefaultPublisher","is","run","on","all","outputs",".","-","Single","string",";","One","publisher","is","run","on","all","outputs",".","-","List","of","strings",";","All","publishers","are","run","on","all","outputs","in","order","of","declaration",".","-","Dict","mapping","to","strings","or","lists",":","The","dict","maps","output","service","keys","to","a","string","or","lists","of","strings",".","These","strings","corresponds","to","all","publishers","that","are","run",",","in","order",",","for","only","that","specific","output","service",".","rule_description","(","str",")",":","Description","associated","with","the","triggering","rule",".","source_entity","(","str",")",":","Name","of","location","from","which","the","record","originated",".","E.g",".","``","mychannel","''","source_service","(","str",")",":","Input","type","from","which","the","record","originated",".","E.g",".","``","slack","''","staged","(","bool",")",":","Whether","this","rule","is","currently","in","the","staging","process",".","Defaults","to","False","Raises",":","AlertCreationError",":","If","the","keyword","arguments","are","not","in","the","expected","set","."]
code: def __init__(self, rule_name, record, outputs, **kwargs):
      """Create a new Alert with a random ID and timestamped now.
  
      Args:
          rule_name (str): Name of the rule which triggered the alert
          record (dict): Parsed log which triggered the alert
          outputs (set): Set of string outputs where the alert should be delivered to
  
      Kwargs (optional):
          alert_id (str): Existing AlertID, if known. If not specified, a random one is created.
          attempts (int): Number of attempts to deliver this alert so far. Defaults to 0.
          cluster (str): Cluster from which the alert was generated.
          context (dict): Context dictionary associated with the triggering rule.
          created (datetime): Alert creation time (UTC).
          dispatched (datetime): Time alert was last dispatched (UTC).
          log_source (str): Log type which triggered the alert, e.g. "binaryalert"
          log_type (str): The type of the triggering log. Usually "json"
          merge_by_keys (list): Alerts are merged if the values associated with all of these
              keys are equal. Keys can be present at any depth in the record.
          merge_window (timedelta): Merged alerts are sent at this interval.
          outputs_sent (set): Subset of outputs which have sent successfully.
          publishers (str|list|dict): A structure of Strings, representing either fully qualified
              function names, or publisher classes. Adopts one of the following formats:
  
              - None, or empty array; DefaultPublisher is run on all outputs.
              - Single string; One publisher is run on all outputs.
              - List of strings; All publishers are run on all outputs in order of declaration.
              - Dict mapping to strings or lists: The dict maps output service keys to a string
                  or lists of strings. These strings corresponds to all publishers that are run,
                  in order, for only that specific output service.
  
          rule_description (str): Description associated with the triggering rule.
          source_entity (str): Name of location from which the record originated. E.g. "mychannel"
          source_service (str): Input type from which the record originated. E.g. "slack"
          staged (bool): Whether this rule is currently in the staging process. Defaults to False
  
      Raises:
          AlertCreationError: If the keyword arguments are not in the expected set.
      """
      if not set(kwargs).issubset(self._EXPECTED_INIT_KWARGS):
          raise AlertCreationError(
              "Invalid Alert kwargs: {} are not in the expected set of {}".format(
                  ", ".join(
                      sorted(
                          set(kwargs).difference(
                              self._EXPECTED_INIT_KWARGS
                          )
                      )
                  ),
                  ", ".join(sorted(self._EXPECTED_INIT_KWARGS)),
              )
          )
  
      # Empty strings and empty sets are not allowed in Dynamo, so for safety we explicitly
      # convert any Falsey value to the expected type during Alert creation.
      # This is why we use "or" instead of kwargs.get() with a default value.
      self.alert_id = kwargs.get("alert_id") or str(uuid.uuid4())
      self.created = kwargs.get("created") or datetime.utcnow()
  
      self.outputs = outputs
      self.record = record
      self.rule_name = rule_name
  
      self.attempts = (
          int(kwargs.get("attempts", 0)) or 0
      )  # Convert possible Decimal to int
      self.cluster = kwargs.get("cluster") or None
      self.context = kwargs.get("context") or {}
      self.publishers = kwargs.get("publishers") or {}
  
      # datetime.min isn't supported by strftime, so use Unix epoch instead for default value
      self.dispatched = kwargs.get("dispatched") or datetime(
          year=1970, month=1, day=1
      )
  
      self.log_source = kwargs.get("log_source") or None
      self.log_type = kwargs.get("log_type") or None
      self.merge_by_keys = kwargs.get("merge_by_keys") or []
      self.merge_window = kwargs.get("merge_window") or timedelta(
          minutes=0
      )
      self.outputs_sent = kwargs.get("outputs_sent") or set()
      self.rule_description = kwargs.get("rule_description") or None
      self.source_entity = kwargs.get("source_entity") or None
      self.source_service = kwargs.get("source_service") or None
      self.staged = kwargs.get("staged") or False
  
imports: from datetime import datetime, timedelta
  import json
  import uuid
  from streamalert.shared import resources, utils
label_desc: Use image node_id 1 to create a new Alert object  with example: obj = Alert(rule_name, record, outputs)