com.mozilla.secops.parser

Class EventFilterRule

java.lang.Object

com.mozilla.secops.parser.EventFilterRule

All Implemented Interfaces:

Serializable

public class EventFilterRule
extends Object
implements Serializable

Rule within an event filter

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
EventFilterRule() Create new empty EventFilterRule

Method Summary

Modifier and Type	Method and Description
EventFilterRule	addPayloadFilter(EventFilterPayloadInterface p) Add payload filter
EventFilterRule	except(EventFilterRule r) Install negation rules for this filter rule
ArrayList<EventFilterRule>	getExceptRules() Get except rules
ArrayList<EventFilterPayloadInterface>	getPayloadFilters() Get payload filters
Normalized.Type	getWantNormalizedType() Get want normalized type value
Map<String,String>	getWantStackdriverLabels() Get Stackdriver label filters
String	getWantStackdriverProject() Get want Stackdriver project value
Payload.PayloadType	getWantSubtype() Get want subtype value
Boolean	matches(Event e) Test if event matches rule
void	setExceptRules(ArrayList<EventFilterRule> erules) Set except rules
void	setPayloadFilters(ArrayList<EventFilterPayloadInterface> filters) Set payload filters
void	setWantStackdriverLabels(Map<String,String> labels) Set Stackdriver label filters
EventFilterRule	wantNormalizedType(Normalized.Type n) Add match criteria for a normalized event type
EventFilterRule	wantStackdriverLabel(String key, String value) Add match criteria for a Stackdriver label
EventFilterRule	wantStackdriverProject(String project) Add match criteria for Stackdriver project
EventFilterRule	wantSubtype(Payload.PayloadType p) Add match criteria for a payload subtype

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

EventFilterRule

public EventFilterRule()

Create new empty EventFilterRule

Method Detail

matches

public Boolean matches(Event e)

Test if event matches rule

Parameters:

e - Event to match against rule

Returns:

True if event matches

except

public EventFilterRule except(EventFilterRule r)

Install negation rules for this filter rule

Even if the filter rule matches, if the event also matches anything in the negation list it will not match the rule.

Parameters:

r - EventFilterRule to add to negation list

Returns:

EventFilterRule for chaining

setExceptRules

public void setExceptRules(ArrayList<EventFilterRule> erules)

Set except rules

Parameters:

erules - List of EventFilterRule for exceptions

getExceptRules

public ArrayList<EventFilterRule> getExceptRules()

Get except rules

Returns:

Array of exception EventFilterRule

addPayloadFilter

public EventFilterRule addPayloadFilter(EventFilterPayloadInterface p)

Add payload filter

Parameters:

p - Payload filter criteria

Returns:

EventFilterRule for chaining

setPayloadFilters

public void setPayloadFilters(ArrayList<EventFilterPayloadInterface> filters)

Set payload filters

Parameters:

filters - Array of EventFilterPayloadInterface

getPayloadFilters

public ArrayList<EventFilterPayloadInterface> getPayloadFilters()

Get payload filters

Returns:

Array of payload filters

wantSubtype

public EventFilterRule wantSubtype(Payload.PayloadType p)

Add match criteria for a payload subtype

Parameters:

p - Payload type

Returns:

EventFilterRule for chaining

getWantSubtype

public Payload.PayloadType getWantSubtype()

Get want subtype value

Returns:

Payload type, or null if unset

wantStackdriverProject

public EventFilterRule wantStackdriverProject(String project)

Add match criteria for Stackdriver project

If this rule is installed, an event will only match if it is an event from Stackdriver and the project matches the supplied argument.

Parameters:

project - Project name to match against

Returns:

EventFilterRule for chaining

getWantStackdriverProject

public String getWantStackdriverProject()

Get want Stackdriver project value

Returns:

Stackdrive project string, or null if unset

wantStackdriverLabel

public EventFilterRule wantStackdriverLabel(String key,
                                            String value)

Add match criteria for a Stackdriver label

If this rule is installed, an event will only match if it is an event from Stackdriver and has a label with the specified key and value.

Parameters:

key - Label key

value - Label value

Returns:

EventFilterRule for chaining

setWantStackdriverLabels

public void setWantStackdriverLabels(Map<String,String> labels)

Set Stackdriver label filters

Parameters:

labels - Map of key/value pairs

getWantStackdriverLabels

public Map<String,String> getWantStackdriverLabels()

Get Stackdriver label filters

Returns:

Map of key/value pairs

wantNormalizedType

public EventFilterRule wantNormalizedType(Normalized.Type n)

Add match criteria for a normalized event type

Parameters:

n - Normalized event type

Returns:

EventFilterRule for chaining

getWantNormalizedType

public Normalized.Type getWantNormalizedType()

Get want normalized type value

Returns:

Normalized type, or null if unset