com.mozilla.secops.pioneer

Class Pioneer.PioneerExfiltration

java.lang.Object

org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>

com.mozilla.secops.pioneer.Pioneer.PioneerExfiltration

All Implemented Interfaces:

DocumentingTransform, Serializable, org.apache.beam.sdk.transforms.display.HasDisplayData

Enclosing class:

Pioneer

public static class Pioneer.PioneerExfiltration
extends org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>
implements DocumentingTransform

Generate alerts if flow logs indicate a certain volume of data has been transferred within a specified period of time.

This transform currently keys on very specific attributes of the ingested flows, namely everything other than a flow with a source port of 22 is excluded. This could be adapted to be more generic in the future if required.

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
PioneerExfiltration(Pioneer.PioneerOptions options) Construct new PioneerExfiltration

Method Summary

Modifier and Type	Method and Description
org.apache.beam.sdk.values.PCollection<Alert>	expand(org.apache.beam.sdk.values.PCollection<Event> col)
String	getTransformDoc() Get documentation string from transform based on it's current configuration

Methods inherited from class org.apache.beam.sdk.transforms.PTransform

compose, compose, getAdditionalInputs, getDefaultOutputCoder, getName, getResourceHints, populateDisplayData, setResourceHints, toString, validate

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

PioneerExfiltration

public PioneerExfiltration(Pioneer.PioneerOptions options)

Construct new PioneerExfiltration

Parameters:

options - Pipeline options

Method Detail

getTransformDoc

public String getTransformDoc()

Get documentation string from transform based on it's current configuration

Specified by:

getTransformDoc in interface DocumentingTransform

Returns:

String

expand

public org.apache.beam.sdk.values.PCollection<Alert> expand(org.apache.beam.sdk.values.PCollection<Event> col)

Specified by:

expand in class org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Event>,org.apache.beam.sdk.values.PCollection<Alert>>