Package com.mozilla.secops.authprofile

Pipeline for authentication source profiling and alerting

See: Description

Interface Summary

Interface	Description
AuthProfile.AuthProfileOptions	Runtime options for AuthProfile pipeline.

Class Summary

Class	Description
AuthProfile	AuthProfile implements analysis of normalized authentication events
AuthProfile.ExtractIdentity	Extract subject user for each event in input PCollection
AuthProfile.Parse	Parse input strings returning applicable authentication events.
AuthProfile.StateAnalyze	Analyze grouped events associated with a particular user or identity against persistent user state
AwsAssumeRoleCorrelator	Analyze cross account assumeRole events and correlates between the trusting account (the account a role is being assumed in) and the trusted account (the account with the iam user assuming a role).
AwsAssumeRoleCorrelator.CrossAccountAssumeRoleFilter	Returns only AssumeRole events with a sharedEventID indicating there's events across two accounts that need to be correlated
CritObjectAnalyze	Analysis for authentication involving critical objects

Enum Summary

Enum	Description
AuthProfile.StateAnalyze.ActionType	The outcome of state analysis can result in various actions being taken.

Package com.mozilla.secops.authprofile Description

Pipeline for authentication source profiling and alerting