com.mozilla.secops.amo

Class AddonMultiSubmit

java.lang.Object

org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>

com.mozilla.secops.amo.AddonMultiSubmit

All Implemented Interfaces:

DocumentingTransform, Serializable, org.apache.beam.sdk.transforms.display.HasDisplayData

public class AddonMultiSubmit
extends org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>
implements DocumentingTransform

Detect distributed submissions based on file size intervals

Operates on fixed windows of 5 minutes. Uploads seen during this window are grouped based on file size rounded up to the nearest 10000 byte boundary. Where the number of uploads at a particular interval exceeds the configured alerting value, an alert will be generated.

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
AddonMultiSubmit(String monitoredResource, Integer suppressRecovery, Integer matchAlertOn) Construct new AddonMultiSubmit

Method Summary

Modifier and Type	Method and Description
org.apache.beam.sdk.values.PCollection<Alert>	expand(org.apache.beam.sdk.values.PCollection<Event> col)
String	getTransformDoc() Get documentation string from transform based on it's current configuration

Methods inherited from class org.apache.beam.sdk.transforms.PTransform

compose, compose, getAdditionalInputs, getDefaultOutputCoder, getName, getResourceHints, populateDisplayData, setResourceHints, toString, validate

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

AddonMultiSubmit

public AddonMultiSubmit(String monitoredResource,
                        Integer suppressRecovery,
                        Integer matchAlertOn)

Construct new AddonMultiSubmit

Parameters:

monitoredResource - Monitored resource indicator

suppressRecovery - Optional recovery suppression to include with alerts in seconds

matchAlertOn - Number of submissions at rounded interval to trigger alert

Method Detail

getTransformDoc

public String getTransformDoc()

Get documentation string from transform based on it's current configuration

Specified by:

getTransformDoc in interface DocumentingTransform

Returns:

String

expand

public org.apache.beam.sdk.values.PCollection<Alert> expand(org.apache.beam.sdk.values.PCollection<Event> col)

Specified by:

expand in class org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>