com.mozilla.secops.alert

Class AlertFormatter

java.lang.Object

org.apache.beam.sdk.transforms.DoFn<Alert,Alert>

com.mozilla.secops.alert.AlertFormatter

All Implemented Interfaces:

Serializable, org.apache.beam.sdk.transforms.display.HasDisplayData

public class AlertFormatter
extends org.apache.beam.sdk.transforms.DoFn<Alert,Alert>

DoFn for normalization and supplemental enrichment of Alert objects

See Also:

Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	AlertFormatter.AlertToString SimpleFunction for conversion of Alert objects to JSON string

Nested classes/interfaces inherited from class org.apache.beam.sdk.transforms.DoFn

org.apache.beam.sdk.transforms.DoFn.AlwaysFetched, org.apache.beam.sdk.transforms.DoFn.BoundedPerElement, org.apache.beam.sdk.transforms.DoFn.BundleFinalizer, org.apache.beam.sdk.transforms.DoFn.Element, org.apache.beam.sdk.transforms.DoFn.FieldAccess, org.apache.beam.sdk.transforms.DoFn.FinishBundle, org.apache.beam.sdk.transforms.DoFn.FinishBundleContext, org.apache.beam.sdk.transforms.DoFn.GetInitialRestriction, org.apache.beam.sdk.transforms.DoFn.GetInitialWatermarkEstimatorState, org.apache.beam.sdk.transforms.DoFn.GetRestrictionCoder, org.apache.beam.sdk.transforms.DoFn.GetSize, org.apache.beam.sdk.transforms.DoFn.GetWatermarkEstimatorStateCoder, org.apache.beam.sdk.transforms.DoFn.Key, org.apache.beam.sdk.transforms.DoFn.MultiOutputReceiver, org.apache.beam.sdk.transforms.DoFn.NewTracker, org.apache.beam.sdk.transforms.DoFn.NewWatermarkEstimator, org.apache.beam.sdk.transforms.DoFn.OnTimer, org.apache.beam.sdk.transforms.DoFn.OnTimerContext, org.apache.beam.sdk.transforms.DoFn.OnTimerFamily, org.apache.beam.sdk.transforms.DoFn.OnWindowExpiration, org.apache.beam.sdk.transforms.DoFn.OnWindowExpirationContext, org.apache.beam.sdk.transforms.DoFn.OutputReceiver<T>, org.apache.beam.sdk.transforms.DoFn.ProcessContext, org.apache.beam.sdk.transforms.DoFn.ProcessContinuation, org.apache.beam.sdk.transforms.DoFn.ProcessElement, org.apache.beam.sdk.transforms.DoFn.RequiresStableInput, org.apache.beam.sdk.transforms.DoFn.RequiresTimeSortedInput, org.apache.beam.sdk.transforms.DoFn.Restriction, org.apache.beam.sdk.transforms.DoFn.Setup, org.apache.beam.sdk.transforms.DoFn.SideInput, org.apache.beam.sdk.transforms.DoFn.SplitRestriction, org.apache.beam.sdk.transforms.DoFn.StartBundle, org.apache.beam.sdk.transforms.DoFn.StartBundleContext, org.apache.beam.sdk.transforms.DoFn.StateId, org.apache.beam.sdk.transforms.DoFn.Teardown, org.apache.beam.sdk.transforms.DoFn.TimerFamily, org.apache.beam.sdk.transforms.DoFn.TimerId, org.apache.beam.sdk.transforms.DoFn.Timestamp, org.apache.beam.sdk.transforms.DoFn.TruncateRestriction, org.apache.beam.sdk.transforms.DoFn.UnboundedPerElement, org.apache.beam.sdk.transforms.DoFn.WatermarkEstimatorState, org.apache.beam.sdk.transforms.DoFn.WindowedContext

Constructor Summary

Constructors

Constructor and Description
AlertFormatter(IOOptions options) Initialize new AlertFormatter
AlertFormatter(String monitoredResourceIndicator, String maxmindCityDbPath, String maxmindIspDbPath) Initialize new AlertFormatter

Method Summary

Modifier and Type	Method and Description
static void	addGeoIPData(Alert a, GeoIP geoip) Process metadata fields and add GeoIP information
void	processElement(org.apache.beam.sdk.transforms.DoFn.ProcessContext c)
void	setup()

Methods inherited from class org.apache.beam.sdk.transforms.DoFn

getAllowedTimestampSkew, getInputTypeDescriptor, getOutputTypeDescriptor, populateDisplayData, prepareForProcessing

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AlertFormatter

public AlertFormatter(IOOptions options)

Initialize new AlertFormatter

Parameters:

options - IOOptions

AlertFormatter

public AlertFormatter(String monitoredResourceIndicator,
                      String maxmindCityDbPath,
                      String maxmindIspDbPath)

Initialize new AlertFormatter

Parameters:

monitoredResourceIndicator - Monitored resource indicator

maxmindCityDbPath - Path to Maxmind City DB

maxmindIspDbPath - Path to Maxmind ISP DB

Method Detail

addGeoIPData

public static void addGeoIPData(Alert a,
                                GeoIP geoip)

Process metadata fields and add GeoIP information

Parameters:

a - Alert

geoip - Initialized GeoIP

setup

@DoFn.Setup
public void setup()

processElement

@DoFn.ProcessElement
public void processElement(org.apache.beam.sdk.transforms.DoFn.ProcessContext c)