com.mozilla.secops.httprequest.heuristics

Class EndpointAbuseAnalysis

java.lang.Object

org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<org.apache.beam.sdk.values.KV<String,ArrayList<String>>>,org.apache.beam.sdk.values.PCollection<Alert>>

com.mozilla.secops.httprequest.heuristics.EndpointAbuseAnalysis

All Implemented Interfaces:

DocumentingTransform, Serializable, org.apache.beam.sdk.transforms.display.HasDisplayData

public class EndpointAbuseAnalysis
extends org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<org.apache.beam.sdk.values.KV<String,ArrayList<String>>>,org.apache.beam.sdk.values.PCollection<Alert>>
implements DocumentingTransform

Transform for detection of a single source making excessive requests of a specific endpoint path solely.

Generates alerts where the request profile violates path thresholds specified in the endpointAbusePath pipeline option configuration.

See Also:

Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	EndpointAbuseAnalysis.EndpointAbuseEndpointInfo Internal class for configured endpoints in EPA
static class	EndpointAbuseAnalysis.EndpointAbuseState Internal class for endpoint abuse state

Constructor Summary

Constructors

Constructor and Description
EndpointAbuseAnalysis(HTTPRequestToggles toggles, Boolean enableIprepdDatastoreExemptions, String iprepdDatastoreExemptionsProject) Static initializer for EndpointAbuseAnalysis

Method Summary

Modifier and Type	Method and Description
org.apache.beam.sdk.values.PCollection<Alert>	expand(org.apache.beam.sdk.values.PCollection<org.apache.beam.sdk.values.KV<String,ArrayList<String>>> input)
String	getTransformDoc() Get documentation string from transform based on it's current configuration

Methods inherited from class org.apache.beam.sdk.transforms.PTransform

compose, compose, getAdditionalInputs, getDefaultOutputCoder, getName, getResourceHints, populateDisplayData, setResourceHints, toString, validate

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

EndpointAbuseAnalysis

public EndpointAbuseAnalysis(HTTPRequestToggles toggles,
                             Boolean enableIprepdDatastoreExemptions,
                             String iprepdDatastoreExemptionsProject)

Static initializer for EndpointAbuseAnalysis

Parameters:

toggles - HTTPRequestToggles

enableIprepdDatastoreExemptions - True to enable datastore exemptions

iprepdDatastoreExemptionsProject - Project to look for datastore entities in

Method Detail

getTransformDoc

public String getTransformDoc()

Get documentation string from transform based on it's current configuration

Specified by:

getTransformDoc in interface DocumentingTransform

Returns:

String

expand

public org.apache.beam.sdk.values.PCollection<Alert> expand(org.apache.beam.sdk.values.PCollection<org.apache.beam.sdk.values.KV<String,ArrayList<String>>> input)

Specified by:

expand in class org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<org.apache.beam.sdk.values.KV<String,ArrayList<String>>>,org.apache.beam.sdk.values.PCollection<Alert>>