com.mozilla.secops

Class IprepdIO

java.lang.Object

com.mozilla.secops.IprepdIO

public class IprepdIO
extends Object

IprepdIO provides an IO transform for writing violation messages to iprepd

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	IprepdIO.ExemptedObject ExemptedObject contains the metadata associated with a objects excluded from reporting to iprepd.
static class	IprepdIO.Reader
static class	IprepdIO.ReputationValue A reputation response from iprepd
static class	IprepdIO.Write Write violation messages to iprepd based on submitted Alert JSON strings

Field Summary

Fields

Modifier and Type	Field and Description
static String	exemptedEmailKind Kind for exempted email entry in Datastore
static String	exemptedIpKind Kind for exempted IP entry in Datastore
static String	exemptedObjectNamespace Namespace for exempted objects in Datastore
static String	METRICS_NAMESPACE Namespace for custom metrics
static String	VIOLATION_WRITES_METRIC Custom metric name used to count iprepd violation submissions from write functions

Constructor Summary

Constructors

Constructor and Description
IprepdIO()

Method Summary

Modifier and Type	Method and Description
static void	addMetadataIfIpIsExempt(String ip, Alert a) Add IP metadata if the IP address is exempt from reporting to iprepd.
static void	addMetadataIfIpIsExempt(String ip, Alert a, String datastoreProject) Add IP metadata if the IP address is exempt from reporting to iprepd.
static void	addMetadataIfObjectIsExempt(String obj, String type, Alert a) Add metadata if the object is exempt from reporting to iprepd.
static void	addMetadataIfObjectIsExempt(String obj, String type, Alert a, String datastoreProject) Add metadata if the object is exempt from reporting to iprepd.
static void	addMetadataSuppressRecovery(Integer value, Alert a) Add iprepd recovery suppression metadata to an alert
static IprepdIO.Reader	getReader(String iprepdSpec, String project) Return a new reader for reading reputation from iprepd
static IprepdIO.Write	writeSpecs(String[] iprepdSpecs, String project) Return PTransform to emit violations to one or more instances of iprepd

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

VIOLATION_WRITES_METRIC

public static final String VIOLATION_WRITES_METRIC

Custom metric name used to count iprepd violation submissions from write functions

See Also:

Constant Field Values

METRICS_NAMESPACE

public static final String METRICS_NAMESPACE

Namespace for custom metrics

See Also:

Constant Field Values

exemptedIpKind

public static final String exemptedIpKind

Kind for exempted IP entry in Datastore

See Also:

Constant Field Values

exemptedEmailKind

public static final String exemptedEmailKind

Kind for exempted email entry in Datastore

See Also:

Constant Field Values

exemptedObjectNamespace

public static final String exemptedObjectNamespace

Namespace for exempted objects in Datastore

See Also:

Constant Field Values

Constructor Detail

IprepdIO

public IprepdIO()

Method Detail

getReader

public static IprepdIO.Reader getReader(String iprepdSpec,
                                        String project)

Return a new reader for reading reputation from iprepd

Specification format: url|api key

Example: "https://iprepd.example.com|secretapikey"

The specification processor supports RuntimeSecrets, and may therefore also be a cloudkms:// URL or a GCS URL.

Parameters:

iprepdSpec - iprepd input specification

project - GCP project name, only required if decrypting apiKey via cloudkms

Returns:

Reader

writeSpecs

public static IprepdIO.Write writeSpecs(String[] iprepdSpecs,
                                        String project)

Return PTransform to emit violations to one or more instances of iprepd

Specification format: url|api key

Example: "https://iprepd.example.com|secretapikey"

The specification processor supports RuntimeSecrets, and may therefore also be a cloudkms:// URL or a GCS URL.

Parameters:

iprepdSpecs - String[] of iprepd input specifications

project - GCP project name, only required if decrypting apiKey via cloudkms

Returns:

IO transform

addMetadataSuppressRecovery

public static void addMetadataSuppressRecovery(Integer value,
                                               Alert a)

Add iprepd recovery suppression metadata to an alert

Parameters:

value - Seconds for recovery suppression

a - Alert

addMetadataIfIpIsExempt

public static void addMetadataIfIpIsExempt(String ip,
                                           Alert a)
                                    throws IOException

Add IP metadata if the IP address is exempt from reporting to iprepd.

Parameters:

ip - IP address to check

a - Alert to add metadata to

Throws:

IOException - IOException

addMetadataIfIpIsExempt

public static void addMetadataIfIpIsExempt(String ip,
                                           Alert a,
                                           String datastoreProject)
                                    throws IOException

Add IP metadata if the IP address is exempt from reporting to iprepd.

This variant allows specification of a project ID, for cases where the datastore instance lives in another GCP project.

Parameters:

ip - IP address to check

a - Alert to add metadata to

datastoreProject - If Datastore is in another project, non-null project ID

Throws:

IOException - IOException

addMetadataIfObjectIsExempt

public static void addMetadataIfObjectIsExempt(String obj,
                                               String type,
                                               Alert a)
                                        throws IOException

Add metadata if the object is exempt from reporting to iprepd.

Parameters:

obj - Object to check (usually an IP or email)

type - Type of object (usually "ip" or "email")

a - Alert to add metadata to

Throws:

IOException - IOException

addMetadataIfObjectIsExempt

public static void addMetadataIfObjectIsExempt(String obj,
                                               String type,
                                               Alert a,
                                               String datastoreProject)
                                        throws IOException

Add metadata if the object is exempt from reporting to iprepd.

This variant allows specification of a project ID, for cases where the datastore instance lives in another GCP project.

If for some reason the exemption state lookup fails, an IOException will be thrown.

Parameters:

obj - Object to check (usually an IP or email)

type - Type of object (usually "ip" or "email")

a - Alert to add metadata to

datastoreProject - If Datastore is in another project, non-null project ID

Throws:

IOException - IOException