com.mozilla.secops.amo

Class AddonMultiMatch

java.lang.Object

org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>

com.mozilla.secops.amo.AddonMultiMatch

All Implemented Interfaces:

DocumentingTransform, Serializable, org.apache.beam.sdk.transforms.display.HasDisplayData

public class AddonMultiMatch
extends org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>
implements DocumentingTransform

Detect distributed AMO submissions with the same file hash

Detection operates on fixed windows of 10 minutes long. If the number of clients seen uploading a file with the exact same file hash exceeds the configured value within the fixed window, an alert is generated.

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
AddonMultiMatch(String monitoredResource, Integer suppressRecovery, Integer matchAlertOn) Construct new AddonMultiMatch

Method Summary

Modifier and Type	Method and Description
org.apache.beam.sdk.values.PCollection<Alert>	expand(org.apache.beam.sdk.values.PCollection<Event> col)
String	getTransformDoc() Get documentation string from transform based on it's current configuration

Methods inherited from class org.apache.beam.sdk.transforms.PTransform

compose, compose, getAdditionalInputs, getDefaultOutputCoder, getName, getResourceHints, populateDisplayData, setResourceHints, toString, validate

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

AddonMultiMatch

public AddonMultiMatch(String monitoredResource,
                       Integer suppressRecovery,
                       Integer matchAlertOn)

Construct new AddonMultiMatch

Parameters:

monitoredResource - Monitored resource indicator

suppressRecovery - Optional recovery suppression to include with alerts in seconds

matchAlertOn - Number of submissions of the same file hash to trigger alert

Method Detail

getTransformDoc

public String getTransformDoc()

Get documentation string from transform based on it's current configuration

Specified by:

getTransformDoc in interface DocumentingTransform

Returns:

String

expand

public org.apache.beam.sdk.values.PCollection<Alert> expand(org.apache.beam.sdk.values.PCollection<Event> col)

Specified by:

expand in class org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>