Examples with ThreatScore org.apache.metron.common.configuration.enrichment.threatintel.ThreatScore used on opensource projects

Example 6 with ThreatScore

use of org.apache.metron.common.configuration.enrichment.threatintel.ThreatScore in project metron by apache.

the class ThreatTriageProcessor method apply.

@Nullable
@Override
public ThreatScore apply(@Nullable Map input) {
    ThreatScore threatScore = new ThreatScore();
    StellarPredicateProcessor predicateProcessor = new StellarPredicateProcessor();
    StellarProcessor processor = new StellarProcessor();
    VariableResolver resolver = new MapVariableResolver(input, sensorConfig.getConfiguration(), threatIntelConfig.getConfig());
    // attempt to apply each rule to the threat
    for (RiskLevelRule rule : threatTriageConfig.getRiskLevelRules()) {
        if (predicateProcessor.parse(rule.getRule(), resolver, functionResolver, context)) {
            // add the rule's score to the overall threat score
            String reason = execute(rule.getReason(), processor, resolver, String.class);
            RuleScore score = new RuleScore(rule, reason);
            threatScore.addRuleScore(score);
        }
    }
    // calculate the aggregate threat score
    Aggregators aggregators = threatTriageConfig.getAggregator();
    List<Number> allScores = threatScore.getRuleScores().stream().map(score -> score.getRule().getScore()).collect(Collectors.toList());
    Double aggregateScore = aggregators.aggregate(allScores, threatTriageConfig.getAggregationConfig());
    threatScore.setScore(aggregateScore);
    return threatScore;
}

Example 7 with ThreatScore

use of org.apache.metron.common.configuration.enrichment.threatintel.ThreatScore in project metron by apache.

the class ThreatTriageTest method testThreatScoreWithMultipleRules.

/**
 * Each individual rule that was applied when scoring a threat should
 * be captured in the overall threat score.
 */
@Test
public void testThreatScoreWithMultipleRules() throws Exception {
    Map<Object, Object> message = new HashMap<Object, Object>() {

        {
            put("user.type", "admin");
            put("asset.type", "web");
        }
    };
    ThreatScore score = getProcessor(smokeTestProcessorConfig).apply(message);
    // expect rules 1 and 2 to have been applied
    List<String> expectedNames = ImmutableList.of("rule 1", "rule 2");
    Assert.assertEquals(2, score.getRuleScores().size());
    score.getRuleScores().forEach(ruleScore -> Assert.assertTrue(expectedNames.contains(ruleScore.getRule().getName())));
}