com.mozilla.secops.alert

Class AlertSuppressor

java.lang.Object

org.apache.beam.sdk.transforms.DoFn<org.apache.beam.sdk.values.KV<String,Alert>,Alert>

com.mozilla.secops.alert.AlertSuppressor

All Implemented Interfaces:

Serializable, org.apache.beam.sdk.transforms.display.HasDisplayData

Direct Known Subclasses:

AlertSuppressorCount

public class AlertSuppressor
extends org.apache.beam.sdk.transforms.DoFn<org.apache.beam.sdk.values.KV<String,Alert>,Alert>

Implements generic alert suppression

AlertSuppressor can be used to suppress additional alerts for a given key. The first time an alert is seen for a given key, it will be emitted and state will be stored indicating when it was sent. Any further alerts for that key will be suppressed until the state value expires.

This implementation uses state, so care should be taken to ensure the collection being suppressed is windowed into windows that are appropriate for the state expiration value.

See Also:

Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	AlertSuppressor.AlertSuppressionState Internal class for alert suppression state

Nested classes/interfaces inherited from class org.apache.beam.sdk.transforms.DoFn

org.apache.beam.sdk.transforms.DoFn.AlwaysFetched, org.apache.beam.sdk.transforms.DoFn.BoundedPerElement, org.apache.beam.sdk.transforms.DoFn.BundleFinalizer, org.apache.beam.sdk.transforms.DoFn.Element, org.apache.beam.sdk.transforms.DoFn.FieldAccess, org.apache.beam.sdk.transforms.DoFn.FinishBundle, org.apache.beam.sdk.transforms.DoFn.FinishBundleContext, org.apache.beam.sdk.transforms.DoFn.GetInitialRestriction, org.apache.beam.sdk.transforms.DoFn.GetInitialWatermarkEstimatorState, org.apache.beam.sdk.transforms.DoFn.GetRestrictionCoder, org.apache.beam.sdk.transforms.DoFn.GetSize, org.apache.beam.sdk.transforms.DoFn.GetWatermarkEstimatorStateCoder, org.apache.beam.sdk.transforms.DoFn.Key, org.apache.beam.sdk.transforms.DoFn.MultiOutputReceiver, org.apache.beam.sdk.transforms.DoFn.NewTracker, org.apache.beam.sdk.transforms.DoFn.NewWatermarkEstimator, org.apache.beam.sdk.transforms.DoFn.OnTimer, org.apache.beam.sdk.transforms.DoFn.OnTimerContext, org.apache.beam.sdk.transforms.DoFn.OnTimerFamily, org.apache.beam.sdk.transforms.DoFn.OnWindowExpiration, org.apache.beam.sdk.transforms.DoFn.OnWindowExpirationContext, org.apache.beam.sdk.transforms.DoFn.OutputReceiver<T>, org.apache.beam.sdk.transforms.DoFn.ProcessContext, org.apache.beam.sdk.transforms.DoFn.ProcessContinuation, org.apache.beam.sdk.transforms.DoFn.ProcessElement, org.apache.beam.sdk.transforms.DoFn.RequiresStableInput, org.apache.beam.sdk.transforms.DoFn.RequiresTimeSortedInput, org.apache.beam.sdk.transforms.DoFn.Restriction, org.apache.beam.sdk.transforms.DoFn.Setup, org.apache.beam.sdk.transforms.DoFn.SideInput, org.apache.beam.sdk.transforms.DoFn.SplitRestriction, org.apache.beam.sdk.transforms.DoFn.StartBundle, org.apache.beam.sdk.transforms.DoFn.StartBundleContext, org.apache.beam.sdk.transforms.DoFn.StateId, org.apache.beam.sdk.transforms.DoFn.Teardown, org.apache.beam.sdk.transforms.DoFn.TimerFamily, org.apache.beam.sdk.transforms.DoFn.TimerId, org.apache.beam.sdk.transforms.DoFn.Timestamp, org.apache.beam.sdk.transforms.DoFn.TruncateRestriction, org.apache.beam.sdk.transforms.DoFn.UnboundedPerElement, org.apache.beam.sdk.transforms.DoFn.WatermarkEstimatorState, org.apache.beam.sdk.transforms.DoFn.WindowedContext

Constructor Summary

Constructors

Constructor and Description
AlertSuppressor(Long expiry) Initialize new AlertSuppressor

Method Summary

Modifier and Type	Method and Description
void	onExpiry(org.apache.beam.sdk.transforms.DoFn.OnTimerContext c, org.apache.beam.sdk.state.ValueState<AlertSuppressor.AlertSuppressionState> counter)
void	processElement(org.apache.beam.sdk.transforms.DoFn.ProcessContext c, org.apache.beam.sdk.state.ValueState<AlertSuppressor.AlertSuppressionState> counter, org.apache.beam.sdk.state.Timer counterExpiry)

Methods inherited from class org.apache.beam.sdk.transforms.DoFn

getAllowedTimestampSkew, getInputTypeDescriptor, getOutputTypeDescriptor, populateDisplayData, prepareForProcessing

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

AlertSuppressor

public AlertSuppressor(Long expiry)

Initialize new AlertSuppressor

Parameters:

expiry - State expiry timer in seconds

Method Detail

onExpiry

@DoFn.OnTimer(value="expiryState")
public void onExpiry(org.apache.beam.sdk.transforms.DoFn.OnTimerContext c,
                                                        @DoFn.StateId(value="counter")
                                                        org.apache.beam.sdk.state.ValueState<AlertSuppressor.AlertSuppressionState> counter)

processElement

@DoFn.ProcessElement
public void processElement(org.apache.beam.sdk.transforms.DoFn.ProcessContext c,
                                                @DoFn.StateId(value="counter")
                                                org.apache.beam.sdk.state.ValueState<AlertSuppressor.AlertSuppressionState> counter,
                                                @DoFn.TimerId(value="expiryState")
                                                org.apache.beam.sdk.state.Timer counterExpiry)