Github user nickwallen commented on a diff in the pull request:
https://github.com/apache/metron/pull/845#discussion_r152077236
--- Diff:
metron-platform/metron-elasticsearch/src/main/java/org/apache/metron/elasticsearch/dao/ElasticsearchMetaAlertDao.java
---
@@ -614,8 +625,15 @@ protected void calculateMetaScores(Document metaAlert)
{
}
metaScores = new MetaScores(scores);
}
+
+ // add a summary (max, min, avg, count, sum) of all the threat scores
from the child alerts
metaAlert.getDocument().putAll(metaScores.getMetaScores());
- metaAlert.getDocument().put(threatTriageField,
metaScores.getMetaScores().get(threatSort));
+
+ // the overall threat score for the metaalert; either max, min, avg,
count or sum of all child scores
--- End diff --
The `ElasticsearchMetaAlertDao` adds an overall threat score to the
Metaalert. The overall threat score can be any one of the following summary
aggregations of the child alerts; sum, min, max, count, average, or median.
These summary values are calculated in `MetaScores` and result in Double
values. Since the other sensor indices currently define `threat:triage:score`
as a float, this solution just casts this to a Double to match those.
I think an alternative way to solve this is to just make the
`threat:triage:score` in each of the sensor indices a Double as you mentioned.
I think your approach seems a little cleaner to me. Although, I am not sure if
there are other down sides I am not thinking about. Can anyone else think of a
problem with this approach? @justinleet @merrimanr ?
---
