com.mozilla.secops.amo

Class FxaAccountAbuseAlias

java.lang.Object

org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>

com.mozilla.secops.amo.FxaAccountAbuseAlias

All Implemented Interfaces:

DocumentingTransform, Serializable, org.apache.beam.sdk.transforms.display.HasDisplayData

public class FxaAccountAbuseAlias
extends org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>
implements DocumentingTransform

Analysis for aliased account usage

A session gap duration of 120 minutes is used with early firings every 60 seconds. Within the window accounts in use are normalized and grouped together using the normalized value as a key. If the number of in-use aliases for a given account exceeds the configured value, and alert is generated.

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
FxaAccountAbuseAlias(String monitoredResource, Integer suppressRecovery, Integer maxAliases) Create new FxaAccountAbuseAlias

Method Summary

Modifier and Type	Method and Description
org.apache.beam.sdk.values.PCollection<Alert>	expand(org.apache.beam.sdk.values.PCollection<Event> col)
String	getTransformDoc() Get documentation string from transform based on it's current configuration

Methods inherited from class org.apache.beam.sdk.transforms.PTransform

compose, compose, getAdditionalInputs, getDefaultOutputCoder, getName, getResourceHints, populateDisplayData, setResourceHints, toString, validate

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

FxaAccountAbuseAlias

public FxaAccountAbuseAlias(String monitoredResource,
                            Integer suppressRecovery,
                            Integer maxAliases)

Create new FxaAccountAbuseAlias

Parameters:

monitoredResource - Monitored resource indicator

suppressRecovery - Optional recovery suppression for abusive accounts

maxAliases - Maximum number of permitted aliases for one account in a given session

Method Detail

getTransformDoc

public String getTransformDoc()

Get documentation string from transform based on it's current configuration

Specified by:

getTransformDoc in interface DocumentingTransform

Returns:

String

expand

public org.apache.beam.sdk.values.PCollection<Alert> expand(org.apache.beam.sdk.values.PCollection<Event> col)

Specified by:

expand in class org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>