com.mozilla.secops.parser

Class EventFilter

java.lang.Object

com.mozilla.secops.parser.EventFilter

All Implemented Interfaces:

Serializable

public class EventFilter
extends Object
implements Serializable

Event filtering and matching

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
EventFilter() Create new EventFilter

Method Summary

Modifier and Type	Method and Description
void	addRule(EventFilterRule rule) Add new rule to filter
Boolean	getMatchAny() Get match any setting
ArrayList<EventFilterRule>	getRules() Get configured rules
static org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Event>>	getTransform(EventFilter filter) Get composite transform to apply filter to event stream
Boolean	getWantUTC() Get UTC handling parameter
EventFilter	matchAny()
Boolean	matches(Event e) Test if event matches filter
EventFilter	passConfigurationTicks() Configure filter to pass configuration ticks
void	setMatchAny(Boolean matchAny) Set match any flag to specified value
void	setRules(ArrayList<EventFilterRule> rules) Set filter rules
EventFilter	setWantUTC(Boolean flag) Choose to ignore non-UTC timezone events

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

EventFilter

public EventFilter()

Create new EventFilter

Method Detail

passConfigurationTicks

public EventFilter passConfigurationTicks()

Configure filter to pass configuration ticks

Adds a rule to the filter that will pass configuration ticks.

Returns:

EventFilter

getTransform

public static org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Event>> getTransform(EventFilter filter)

Get composite transform to apply filter to event stream

Parameters:

filter - Event filter

Returns:

Transform

matches

public Boolean matches(Event e)

Test if event matches filter

Parameters:

e - Event to match against filter

Returns:

True if filter matches

addRule

public void addRule(EventFilterRule rule)

Add new rule to filter

Parameters:

rule - New rule to add

setRules

public void setRules(ArrayList<EventFilterRule> rules)

Set filter rules

Parameters:

rules - Array of rules

getRules

public ArrayList<EventFilterRule> getRules()

Get configured rules

Returns:

Array of rules

setWantUTC

public EventFilter setWantUTC(Boolean flag)

Choose to ignore non-UTC timezone events

Parameters:

flag - If true, drop events with parsed timezones that are not UTC

Returns:

EventFilter for chaining

getWantUTC

public Boolean getWantUTC()

Get UTC handling parameter

Returns:

True if non-UTC events should be dropped in filter

matchAny

public EventFilter matchAny()

setMatchAny

public void setMatchAny(Boolean matchAny)

Set match any flag to specified value

Parameters:

matchAny - True to match everything

getMatchAny

public Boolean getMatchAny()

Get match any setting

Returns:

Boolean