Examples with RiskLevelRule org.apache.metron.common.configuration.enrichment.threatintel.RiskLevelRule used on opensource projects

Example 1 with RiskLevelRule

use of org.apache.metron.common.configuration.enrichment.threatintel.RiskLevelRule in project metron by apache.

the class ThreatTriageFunctionsTest method testAddMultipleWithEngine.

@Test
public void testAddMultipleWithEngine() {
    // init the engine
    ThreatTriageProcessor engine = (ThreatTriageProcessor) run("THREAT_TRIAGE_INIT()");
    Map<String, Object> vars = new HashMap<>();
    vars.put("engine", engine);
    // add a new rule
    run("THREAT_TRIAGE_ADD(engine, { 'name':'rule1', 'rule':'value < 2', 'score':10 } )", vars);
    // add another rule
    run("THREAT_TRIAGE_ADD(engine, { 'name':'rule2', 'rule':'value < 4', 'score':10 } )", vars);
    List<RiskLevelRule> triageRules = engine.getRiskLevelRules();
    Assert.assertEquals(2, triageRules.size());
}

Example 2 with RiskLevelRule

use of org.apache.metron.common.configuration.enrichment.threatintel.RiskLevelRule in project metron by apache.

the class ThreatTriageFunctionsTest method testAddEmpty.

@Test
public void testAddEmpty() {
    String newConfig = (String) run("THREAT_TRIAGE_ADD(config, { 'rule' : SHELL_GET_EXPRESSION('less'), 'score' : 10 } )", toMap("config", configStr));
    List<RiskLevelRule> triageRules = getTriageRules(newConfig);
    Assert.assertEquals(1, triageRules.size());
    RiskLevelRule rule = triageRules.get(0);
    Assert.assertEquals(variables.get("less").getExpression().get(), rule.getRule());
    Assert.assertEquals(10.0, rule.getScore().doubleValue(), 1e-6);
}

Example 3 with RiskLevelRule

use of org.apache.metron.common.configuration.enrichment.threatintel.RiskLevelRule in project metron by apache.

the class ThreatTriageFunctionsTest method testAddEmptyWithEngine.

@Test
public void testAddEmptyWithEngine() {
    // init the engine
    ThreatTriageProcessor engine = (ThreatTriageProcessor) run("THREAT_TRIAGE_INIT()");
    Map<String, Object> vars = new HashMap<>();
    vars.put("engine", engine);
    String newConfig = (String) run("THREAT_TRIAGE_ADD(engine, {'rule' : SHELL_GET_EXPRESSION('less'), 'score' : 10 } )", vars);
    // validate the returned configuration
    List<RiskLevelRule> triageRules = getTriageRules(newConfig);
    Assert.assertEquals(1, triageRules.size());
    // validate that the engine was updated
    Assert.assertEquals(1, engine.getSensorConfig().getThreatIntel().getTriageConfig().getRiskLevelRules().size());
}

Example 4 with RiskLevelRule

use of org.apache.metron.common.configuration.enrichment.threatintel.RiskLevelRule in project metron by apache.

the class ThreatTriageFunctionsTest method testAddHasExisting.

@Test
public void testAddHasExisting() {
    String newConfig = (String) run("THREAT_TRIAGE_ADD(config, { 'rule' : SHELL_GET_EXPRESSION('less'), 'score' : 10, 'reason' : '2 + 2' } )", toMap("config", configStr));
    newConfig = (String) run("THREAT_TRIAGE_ADD(config, { 'rule' : SHELL_GET_EXPRESSION('greater'), 'score' : 20 } )", toMap("config", newConfig));
    List<RiskLevelRule> triageRules = getTriageRules(newConfig);
    Assert.assertEquals(2, triageRules.size());
    RiskLevelRule less = triageRules.get(0);
    Assert.assertEquals(variables.get("less").getExpression().get(), less.getRule());
    Assert.assertEquals(10.0, less.getScore().doubleValue(), 1e-6);
    RiskLevelRule greater = triageRules.get(1);
    Assert.assertEquals(variables.get("greater").getExpression().get(), greater.getRule());
    Assert.assertEquals(20.0, greater.getScore().doubleValue(), 1e-6);
}

Example 5 with RiskLevelRule

use of org.apache.metron.common.configuration.enrichment.threatintel.RiskLevelRule in project metron by apache.

the class ThreatTriageProcessor method apply.

@Nullable
@Override
public ThreatScore apply(@Nullable Map input) {
    ThreatScore threatScore = new ThreatScore();
    StellarPredicateProcessor predicateProcessor = new StellarPredicateProcessor();
    StellarProcessor processor = new StellarProcessor();
    VariableResolver resolver = new MapVariableResolver(input, sensorConfig.getConfiguration(), threatIntelConfig.getConfig());
    // attempt to apply each rule to the threat
    for (RiskLevelRule rule : threatTriageConfig.getRiskLevelRules()) {
        if (predicateProcessor.parse(rule.getRule(), resolver, functionResolver, context)) {
            // add the rule's score to the overall threat score
            String reason = execute(rule.getReason(), processor, resolver, String.class);
            RuleScore score = new RuleScore(rule, reason);
            threatScore.addRuleScore(score);
        }
    }
    // calculate the aggregate threat score
    Aggregators aggregators = threatTriageConfig.getAggregator();
    List<Number> allScores = threatScore.getRuleScores().stream().map(score -> score.getRule().getScore()).collect(Collectors.toList());
    Double aggregateScore = aggregators.aggregate(allScores, threatTriageConfig.getAggregationConfig());
    threatScore.setScore(aggregateScore);
    return threatScore;
}