com.mozilla.secops.postprocessing

Class AlertSummary

java.lang.Object

org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Alert>,org.apache.beam.sdk.values.PCollection<Alert>>

com.mozilla.secops.postprocessing.AlertSummary

All Implemented Interfaces:

DocumentingTransform, Serializable, org.apache.beam.sdk.transforms.display.HasDisplayData

public class AlertSummary
extends org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Alert>,org.apache.beam.sdk.values.PCollection<Alert>>
implements DocumentingTransform

Summarize alerts and various attributes of alerts over time and generate subsequent alerts if certain thresholds or anomolies are detected.

This transform requires configuration be passed in using PostProcessing.PostProcessingOptions.

The format of each threshold should be classifier:percentup:precentdown:minimum. A percent up/down value of 0 will effectively disable that type of check.

The classifier "*" will apply the thresholding to all alerts. For example, *:10:10:100 will generate an alert if a 10% increase or decrease in alerts was seen with a minimum of 100 in the newest window being considered.

To apply the threshold for all alerts associated with a given monitored resource, the resource name can be used. For example www.mozilla.org:50:0:10 will generate an alert if a 50% increase is seen with at least 10 alerts in the latest window, but will not generate an alert on decrease.

To further apply the threshold to a specific resource and a specific alert category, append the category to the resource name. For example www.mozilla.org-httprequest:50:0:10. This can be further extended with the subcategory, example www.mozilla.org-httprequest-error_rate:50:0:10.

Currently thresholds are evaluated on adjacent 15 minute windows, and adjacent 1 hour windows.

In some locations in the code there are references to "sblock" and "lblock". This corresponds to the smallest resolution we use for summary, and the largest window we will summarize alerts over.

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
AlertSummary(PostProcessing.PostProcessingOptions options) Initialize new AlertSummary

Method Summary

Modifier and Type	Method and Description
org.apache.beam.sdk.values.PCollection<Alert>	expand(org.apache.beam.sdk.values.PCollection<Alert> col)
String	getTransformDoc() Get documentation string from transform based on it's current configuration

Methods inherited from class org.apache.beam.sdk.transforms.PTransform

compose, compose, getAdditionalInputs, getDefaultOutputCoder, getName, getResourceHints, populateDisplayData, setResourceHints, toString, validate

Methods inherited from class java.lang.Object

equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

AlertSummary

public AlertSummary(PostProcessing.PostProcessingOptions options)

Initialize new AlertSummary

Parameters:

options - Pipeline options

Method Detail

getTransformDoc

public String getTransformDoc()

Get documentation string from transform based on it's current configuration

Specified by:

getTransformDoc in interface DocumentingTransform

Returns:

String

expand

public org.apache.beam.sdk.values.PCollection<Alert> expand(org.apache.beam.sdk.values.PCollection<Alert> col)

Specified by:

expand in class org.apache.beam.sdk.transforms.PTransform<org.apache.beam.sdk.values.PCollection<Alert>,org.apache.beam.sdk.values.PCollection<Alert>>