Examples with METAALERT_TYPE org.apache.metron.indexing.dao.metaalert.MetaAlertConstants.METAALERT_TYPE used on opensource projects

Example 1 with METAALERT_TYPE

use of org.apache.metron.indexing.dao.metaalert.MetaAlertConstants.METAALERT_TYPE in project metron by apache.

the class MetaAlertIntegrationTest method shouldGetAllMetaAlertsForAlert.

@Test
public void shouldGetAllMetaAlertsForAlert() throws Exception {
    // Load alerts
    List<Map<String, Object>> alerts = buildAlerts(3);
    addRecords(alerts, getTestIndexFullName(), SENSOR_NAME);
    // Load metaAlerts
    List<Map<String, Object>> metaAlerts = buildMetaAlerts(12, MetaAlertStatus.ACTIVE, Optional.of(Collections.singletonList(alerts.get(0))));
    metaAlerts.add(buildMetaAlert("meta_active_12", MetaAlertStatus.ACTIVE, Optional.of(Arrays.asList(alerts.get(0), alerts.get(2)))));
    metaAlerts.add(buildMetaAlert("meta_inactive", MetaAlertStatus.INACTIVE, Optional.of(Arrays.asList(alerts.get(0), alerts.get(2)))));
    // We pass MetaAlertDao.METAALERT_TYPE, because the "_doc" gets appended automatically.
    addRecords(metaAlerts, getMetaAlertIndex(), METAALERT_TYPE);
    // Verify load was successful
    List<GetRequest> createdDocs = metaAlerts.stream().map(metaAlert -> new GetRequest((String) metaAlert.get(Constants.GUID), METAALERT_TYPE)).collect(Collectors.toList());
    createdDocs.addAll(alerts.stream().map(alert -> new GetRequest((String) alert.get(Constants.GUID), SENSOR_NAME)).collect(Collectors.toList()));
    findCreatedDocs(createdDocs);
    {
        // Verify searches successfully return more than 10 results
        SearchResponse searchResponse0 = metaDao.getAllMetaAlertsForAlert("message_0");
        List<SearchResult> searchResults0 = searchResponse0.getResults();
        assertEquals(13, searchResults0.size());
        Set<Map<String, Object>> resultSet = new HashSet<>();
        Iterables.addAll(resultSet, Iterables.transform(searchResults0, r -> r.getSource()));
        StringBuffer reason = new StringBuffer("Unable to find " + metaAlerts.get(0) + "\n");
        reason.append(Joiner.on("\n").join(resultSet));
        assertTrue(resultSet.contains(metaAlerts.get(0)), reason.toString());
        // Verify no meta alerts are returned because message_1 was not added to any
        SearchResponse searchResponse1 = metaDao.getAllMetaAlertsForAlert("message_1");
        List<SearchResult> searchResults1 = searchResponse1.getResults();
        assertEquals(0, searchResults1.size());
        // Verify only the meta alert message_2 was added to is returned
        SearchResponse searchResponse2 = metaDao.getAllMetaAlertsForAlert("message_2");
        List<SearchResult> searchResults2 = searchResponse2.getResults();
        assertEquals(1, searchResults2.size());
        assertEquals(metaAlerts.get(12), searchResults2.get(0).getSource());
    }
}

Example 2 with METAALERT_TYPE

use of org.apache.metron.indexing.dao.metaalert.MetaAlertConstants.METAALERT_TYPE in project metron by apache.

the class MetaAlertIntegrationTest method shouldSortByThreatTriageScore.

@Test
public void shouldSortByThreatTriageScore() throws Exception {
    // Load alerts
    List<Map<String, Object>> alerts = buildAlerts(2);
    alerts.get(0).put(METAALERT_FIELD, "meta_active_0");
    addRecords(alerts, getTestIndexFullName(), SENSOR_NAME);
    // Load metaAlerts
    List<Map<String, Object>> metaAlerts = buildMetaAlerts(1, MetaAlertStatus.ACTIVE, Optional.of(Collections.singletonList(alerts.get(0))));
    // We pass MetaAlertDao.METAALERT_TYPE, because the "_doc" gets appended automatically.
    addRecords(metaAlerts, getMetaAlertIndex(), METAALERT_TYPE);
    // Verify load was successful
    List<GetRequest> createdDocs = metaAlerts.stream().map(metaAlert -> new GetRequest((String) metaAlert.get(Constants.GUID), METAALERT_TYPE)).collect(Collectors.toList());
    createdDocs.addAll(alerts.stream().map(alert -> new GetRequest((String) alert.get(Constants.GUID), SENSOR_NAME)).collect(Collectors.toList()));
    findCreatedDocs(createdDocs);
    // Test descending
    SortField sf = new SortField();
    sf.setField(getThreatTriageField());
    sf.setSortOrder(SortOrder.DESC.getSortOrder());
    SearchRequest sr = new SearchRequest();
    sr.setQuery("*:*");
    sr.setSize(5);
    sr.setIndices(Arrays.asList(getTestIndexName(), METAALERT_TYPE));
    sr.setSort(Collections.singletonList(sf));
    SearchResponse result = metaDao.search(sr);
    List<SearchResult> results = result.getResults();
    assertEquals(2, results.size());
    assertEquals("meta_active_0", results.get((0)).getSource().get(Constants.GUID));
    assertEquals("message_1", results.get((1)).getSource().get(Constants.GUID));
    // Test ascending
    SortField sfAsc = new SortField();
    sfAsc.setField(getThreatTriageField());
    sfAsc.setSortOrder(SortOrder.ASC.getSortOrder());
    SearchRequest srAsc = new SearchRequest();
    srAsc.setQuery("*:*");
    srAsc.setSize(2);
    srAsc.setIndices(Arrays.asList(getTestIndexName(), METAALERT_TYPE));
    srAsc.setSort(Collections.singletonList(sfAsc));
    result = metaDao.search(srAsc);
    results = result.getResults();
    assertEquals("message_1", results.get((0)).getSource().get(Constants.GUID));
    assertEquals("meta_active_0", results.get((1)).getSource().get(Constants.GUID));
    assertEquals(2, results.size());
}