[jira] [Commented] (METRON-2195) Add defensive log level checks when constructing logs is expensive

[ https://issues.apache.org/jira/browse/METRON-2195?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16894738#comment-16894738 ] Simon Elliston Ball commented on METRON-2195: -

[jira] [Commented] (METRON-2195) Add defensive log level checks when constructing logs is expensive

[ https://issues.apache.org/jira/browse/METRON-2195?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16894674#comment-16894674 ] Simon Elliston Ball commented on METRON-2195: - Looks like that’s already fine to me. The

[jira] [Commented] (METRON-2178) Can two user access different data in one index at ElasticSearch after Apache Metron Indexing?

[ https://issues.apache.org/jira/browse/METRON-2178?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16881113#comment-16881113 ] Simon Elliston Ball commented on METRON-2178: - This question really belongs on [the 

[jira] [Commented] (METRON-2157) To better abstract the streaming infrastructure, use Apache Beam.

[ https://issues.apache.org/jira/browse/METRON-2157?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16864124#comment-16864124 ] Simon Elliston Ball commented on METRON-2157: - My one worry about it would be that it's a

[jira] [Created] (METRON-2118) Parser for LEEF data

Simon Elliston Ball created METRON-2118: --- Summary: Parser for LEEF data Key: METRON-2118 URL: https://issues.apache.org/jira/browse/METRON-2118 Project: Metron Issue Type: Bug

[jira] [Commented] (METRON-2105) Enhance BasicAsaParser to add patterns dynamically

[ https://issues.apache.org/jira/browse/METRON-2105?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16832508#comment-16832508 ] Simon Elliston Ball commented on METRON-2105: - I really like this idea. The grok parser is

[jira] [Assigned] (METRON-1923) Default Kafka consumer group for parser topology is "_parser"

[ https://issues.apache.org/jira/browse/METRON-1923?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball reassigned METRON-1923: --- Assignee: Simon Elliston Ball > Default Kafka consumer group for parser

[jira] [Commented] (METRON-1923) Default Kafka consumer group for parser topology is "_parser"

[ https://issues.apache.org/jira/browse/METRON-1923?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16710661#comment-16710661 ] Simon Elliston Ball commented on METRON-1923: - This would probably be better defaulted to

[jira] [Assigned] (METRON-1756) REST tests should use Embedded LDAP in metron-security

[ https://issues.apache.org/jira/browse/METRON-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball reassigned METRON-1756: --- Assignee: Ryan Merriman > REST tests should use Embedded LDAP in

[jira] [Created] (METRON-1779) Front-end authentication simulation for development environments

Simon Elliston Ball created METRON-1779: --- Summary: Front-end authentication simulation for development environments Key: METRON-1779 URL: https://issues.apache.org/jira/browse/METRON-1779

[jira] [Created] (METRON-1754) Add users to role mapping for ldap based Metron REST

Simon Elliston Ball created METRON-1754: --- Summary: Add users to role mapping for ldap based Metron REST Key: METRON-1754 URL: https://issues.apache.org/jira/browse/METRON-1754 Project: Metron

[jira] [Commented] (METRON-1016) METRON Demo System as separate install option

[ https://issues.apache.org/jira/browse/METRON-1016?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16590840#comment-16590840 ] Simon Elliston Ball commented on METRON-1016: - I agree that this would be a great step.

[jira] [Commented] (METRON-1746) CEF lacks an ES template

[ https://issues.apache.org/jira/browse/METRON-1746?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16590449#comment-16590449 ] Simon Elliston Ball commented on METRON-1746: - One thing to think about here is that it

[jira] [Created] (METRON-1688) Pass through of CSRF protection for proxied api calls

Simon Elliston Ball created METRON-1688: --- Summary: Pass through of CSRF protection for proxied api calls Key: METRON-1688 URL: https://issues.apache.org/jira/browse/METRON-1688 Project: Metron

[jira] [Commented] (METRON-1453) Create a Generic Syslog Base Parser Capability

[ https://issues.apache.org/jira/browse/METRON-1453?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16550989#comment-16550989 ] Simon Elliston Ball commented on METRON-1453: - Agreed, just a passing thought. > Create a

[jira] [Commented] (METRON-1453) Create a Generic Syslog Base Parser Capability

[ https://issues.apache.org/jira/browse/METRON-1453?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16550955#comment-16550955 ] Simon Elliston Ball commented on METRON-1453: - A syslog parser with good date handling

[jira] [Commented] (METRON-1453) Create a Generic Syslog Base Parser Capability

[ https://issues.apache.org/jira/browse/METRON-1453?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16550847#comment-16550847 ] Simon Elliston Ball commented on METRON-1453: - [~ottobackwards] would you see this a parser

[jira] [Assigned] (METRON-1666) Mpack updates for LDAP, SSO config and removal of JPA

[ https://issues.apache.org/jira/browse/METRON-1666?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball reassigned METRON-1666: --- Assignee: Simon Elliston Ball > Mpack updates for LDAP, SSO config and

[jira] [Assigned] (METRON-1664) Add Knox to Blueprints for full dev

[ https://issues.apache.org/jira/browse/METRON-1664?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball reassigned METRON-1664: --- Assignee: Simon Elliston Ball Resolution: (was: Done) > Add Knox

[jira] [Assigned] (METRON-1665) Move hosting of Alerts and Config UIs from Nodejs to Spring Boot

[ https://issues.apache.org/jira/browse/METRON-1665?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball reassigned METRON-1665: --- Assignee: Simon Elliston Ball > Move hosting of Alerts and Config UIs from

[jira] [Assigned] (METRON-1667) Remove the JPA and MySQL elements

[ https://issues.apache.org/jira/browse/METRON-1667?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball reassigned METRON-1667: --- Assignee: Simon Elliston Ball > Remove the JPA and MySQL elements >

[jira] [Assigned] (METRON-1668) Remove login services and screens from UIs

[ https://issues.apache.org/jira/browse/METRON-1668?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball reassigned METRON-1668: --- Assignee: Simon Elliston Ball > Remove login services and screens from UIs

[jira] [Commented] (METRON-1677) UUIDv4 GUID is not Lucene friendly

[ https://issues.apache.org/jira/browse/METRON-1677?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16547609#comment-16547609 ] Simon Elliston Ball commented on METRON-1677: - This is an excellent point on the performance

[jira] [Created] (METRON-1670) Stellar WEEK_OF_YEAR test is locale sensitive

Simon Elliston Ball created METRON-1670: --- Summary: Stellar WEEK_OF_YEAR test is locale sensitive Key: METRON-1670 URL: https://issues.apache.org/jira/browse/METRON-1670 Project: Metron

[jira] [Updated] (METRON-1666) Mpack updates for LDAP, SSO config and removal of JPA

[ https://issues.apache.org/jira/browse/METRON-1666?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball updated METRON-1666: Description: Add config files, templates and params to setup SSO and LDAP

[jira] [Updated] (METRON-1665) Move hosting of Alerts and Config UIs from Nodejs to Spring Boot

[ https://issues.apache.org/jira/browse/METRON-1665?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball updated METRON-1665: Description: The current UIs are served up by very lightweight nodejs

[jira] [Updated] (METRON-1669) Create a Knox Service as SSL gateway

[ https://issues.apache.org/jira/browse/METRON-1669?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball updated METRON-1669: Description: Knox also provides an SSL gateway which allows us to proxy both the

[jira] [Created] (METRON-1668) Remove login services and screens from UIs

Simon Elliston Ball created METRON-1668: --- Summary: Remove login services and screens from UIs Key: METRON-1668 URL: https://issues.apache.org/jira/browse/METRON-1668 Project: Metron

[jira] [Created] (METRON-1669) Remove login services and screens from UIs

Simon Elliston Ball created METRON-1669: --- Summary: Remove login services and screens from UIs Key: METRON-1669 URL: https://issues.apache.org/jira/browse/METRON-1669 Project: Metron

[jira] [Created] (METRON-1667) Remove the JPA and MySQL elements

Simon Elliston Ball created METRON-1667: --- Summary: Remove the JPA and MySQL elements Key: METRON-1667 URL: https://issues.apache.org/jira/browse/METRON-1667 Project: Metron Issue Type:

[jira] [Created] (METRON-1666) Add mpack settings to configure spring security

Simon Elliston Ball created METRON-1666: --- Summary: Add mpack settings to configure spring security Key: METRON-1666 URL: https://issues.apache.org/jira/browse/METRON-1666 Project: Metron

[jira] [Updated] (METRON-1665) Move hosting of Alerts and Config UIs from Nodejs to Spring Boot

[ https://issues.apache.org/jira/browse/METRON-1665?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball updated METRON-1665: Summary: Move hosting of Alerts and Config UIs from Nodejs to Spring Boot (was:

[jira] [Updated] (METRON-1665) Moving hosting of Alerts and Config UIs from Nodejs to Spring Boot

[ https://issues.apache.org/jira/browse/METRON-1665?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball updated METRON-1665: Issue Type: Sub-task (was: Bug) Parent: METRON-1663 > Moving hosting of

[jira] [Created] (METRON-1665) Moving hosting of Alerts and Config UIs from Nodejs to Spring Boot

Simon Elliston Ball created METRON-1665: --- Summary: Moving hosting of Alerts and Config UIs from Nodejs to Spring Boot Key: METRON-1665 URL: https://issues.apache.org/jira/browse/METRON-1665

[jira] [Created] (METRON-1664) Add Knox to Blueprints for full dev

Simon Elliston Ball created METRON-1664: --- Summary: Add Knox to Blueprints for full dev Key: METRON-1664 URL: https://issues.apache.org/jira/browse/METRON-1664 Project: Metron Issue

[jira] [Created] (METRON-1663) Single Sign On for Metron UIs and REST

Simon Elliston Ball created METRON-1663: --- Summary: Single Sign On for Metron UIs and REST Key: METRON-1663 URL: https://issues.apache.org/jira/browse/METRON-1663 Project: Metron Issue

[jira] [Commented] (METRON-1662) PCAP UI: Downloading PDML

[ https://issues.apache.org/jira/browse/METRON-1662?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16540153#comment-16540153 ] Simon Elliston Ball commented on METRON-1662: - Is PDML a realistic format for download to an

[jira] [Created] (METRON-1639) Grok Parser does not handle missing year well in syslog rfc3164 timestamps

Simon Elliston Ball created METRON-1639: --- Summary: Grok Parser does not handle missing year well in syslog rfc3164 timestamps Key: METRON-1639 URL: https://issues.apache.org/jira/browse/METRON-1639

[jira] [Created] (METRON-1615) Fill in some endpoint details from Ambari info

Simon Elliston Ball created METRON-1615: --- Summary: Fill in some endpoint details from Ambari info Key: METRON-1615 URL: https://issues.apache.org/jira/browse/METRON-1615 Project: Metron

[jira] [Commented] (METRON-1583) issue regarding cisco asa logs

[ https://issues.apache.org/jira/browse/METRON-1583?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16494581#comment-16494581 ] Simon Elliston Ball commented on METRON-1583: - Would it be possible to share the full log

[jira] [Commented] (METRON-1538) Don't use GUIDS for Elastic document id, but autogenerated ID's for performance

[ https://issues.apache.org/jira/browse/METRON-1538?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16449941#comment-16449941 ] Simon Elliston Ball commented on METRON-1538: - Absolutely. In general I agree with your

[jira] [Commented] (METRON-1538) Don't use GUIDS for Elastic document id, but autogenerated ID's for performance

[ https://issues.apache.org/jira/browse/METRON-1538?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16449914#comment-16449914 ] Simon Elliston Ball commented on METRON-1538: - In ES defence, it makes sense to do the

[jira] [Commented] (METRON-1538) Don't use GUIDS for Elastic document id, but autogenerated ID's for performance

[ https://issues.apache.org/jira/browse/METRON-1538?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16449783#comment-16449783 ] Simon Elliston Ball commented on METRON-1538: - This is not necessarily a good idea. We use

[jira] [Commented] (METRON-1537) Vagrant Up becomes unsuccessfull after metron Build is successfull

[ https://issues.apache.org/jira/browse/METRON-1537?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16449559#comment-16449559 ] Simon Elliston Ball commented on METRON-1537: - Right, nested VMs are highly unlikely to work.

[jira] [Commented] (METRON-1537) Vagrant Up becomes unsuccessfull after metron Build is successfull

[ https://issues.apache.org/jira/browse/METRON-1537?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16447995#comment-16447995 ] Simon Elliston Ball commented on METRON-1537: - It looks like your machine, most likely your

[jira] [Created] (METRON-1534) Typosquat Detection via Bloom filters overlaps

Simon Elliston Ball created METRON-1534: --- Summary: Typosquat Detection via Bloom filters overlaps Key: METRON-1534 URL: https://issues.apache.org/jira/browse/METRON-1534 Project: Metron

[jira] [Commented] (METRON-1517) GeoLite discontinuation notice

[ https://issues.apache.org/jira/browse/METRON-1517?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16437184#comment-16437184 ] Simon Elliston Ball commented on METRON-1517: - Seems maxmind have changed their mind on

[jira] [Commented] (METRON-1523) Add issues list links to metron.apache.org community page

[ https://issues.apache.org/jira/browse/METRON-1523?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16435525#comment-16435525 ] Simon Elliston Ball commented on METRON-1523: - Looks like this has been done in METRON-1510,

[jira] [Created] (METRON-1523) Add issues list links to metron.apache.org community page

Simon Elliston Ball created METRON-1523: --- Summary: Add issues list links to metron.apache.org community page Key: METRON-1523 URL: https://issues.apache.org/jira/browse/METRON-1523 Project:

[jira] [Created] (METRON-1507) Add support for Vagrant Cachier plugin if present

Simon Elliston Ball created METRON-1507: --- Summary: Add support for Vagrant Cachier plugin if present Key: METRON-1507 URL: https://issues.apache.org/jira/browse/METRON-1507 Project: Metron

[jira] [Commented] (METRON-1293) NiFi Indexer(?) capability

[ https://issues.apache.org/jira/browse/METRON-1293?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16289538#comment-16289538 ] Simon Elliston Ball commented on METRON-1293: - So you would imagine something that picks up

[jira] [Commented] (METRON-1293) NiFi Indexer(?) capability

[ https://issues.apache.org/jira/browse/METRON-1293?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16289486#comment-16289486 ] Simon Elliston Ball commented on METRON-1293: - I see the thinking there, and there is some

[jira] [Updated] (METRON-1341) Projection FieldTransformation

[ https://issues.apache.org/jira/browse/METRON-1341?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball updated METRON-1341: Summary: Projection FieldTransformation (was: Projection FieldTansformation) >

[jira] [Created] (METRON-1341) Projection FieldTansformation

Simon Elliston Ball created METRON-1341: --- Summary: Projection FieldTansformation Key: METRON-1341 URL: https://issues.apache.org/jira/browse/METRON-1341 Project: Metron Issue Type:

[jira] [Commented] (METRON-1036) Stellar log function

[ https://issues.apache.org/jira/browse/METRON-1036?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16251460#comment-16251460 ] Simon Elliston Ball commented on METRON-1036: - Yes. Looks like they got rolled up into that

[jira] [Commented] (METRON-1238) Enrichment topology start at EARLIEST again after de-activating topology

[ https://issues.apache.org/jira/browse/METRON-1238?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16197007#comment-16197007 ] Simon Elliston Ball commented on METRON-1238: - While this is potentially an issue in Kafka /

[jira] [Commented] (METRON-1217) ALERT-UI should call out limitation of searchable indices in the readme

[ https://issues.apache.org/jira/browse/METRON-1217?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16185660#comment-16185660 ] Simon Elliston Ball commented on METRON-1217: - I don't thing this is a real limitation once

[jira] [Commented] (METRON-685) Scores in Threat Triage should be a Stellar Statement

[ https://issues.apache.org/jira/browse/METRON-685?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16177663#comment-16177663 ] Simon Elliston Ball commented on METRON-685: I would agree that it should be limited to

[jira] [Created] (METRON-1140) Profiler MPack does not handle creation of kafka for hbase acls in a kerberised cluster

Simon Elliston Ball created METRON-1140: --- Summary: Profiler MPack does not handle creation of kafka for hbase acls in a kerberised cluster Key: METRON-1140 URL:

[jira] [Created] (METRON-1139) MPack for the profiler breaks stack advisor

Simon Elliston Ball created METRON-1139: --- Summary: MPack for the profiler breaks stack advisor Key: METRON-1139 URL: https://issues.apache.org/jira/browse/METRON-1139 Project: Metron

[jira] [Created] (METRON-1037) Stellar power function

Simon Elliston Ball created METRON-1037: --- Summary: Stellar power function Key: METRON-1037 URL: https://issues.apache.org/jira/browse/METRON-1037 Project: Metron Issue Type:

[jira] [Created] (METRON-1036) Stellar log function

Simon Elliston Ball created METRON-1036: --- Summary: Stellar log function Key: METRON-1036 URL: https://issues.apache.org/jira/browse/METRON-1036 Project: Metron Issue Type: Improvement

[jira] [Created] (METRON-1035) Documentation for rules triage aggregation does not include SUM

Simon Elliston Ball created METRON-1035: --- Summary: Documentation for rules triage aggregation does not include SUM Key: METRON-1035 URL: https://issues.apache.org/jira/browse/METRON-1035

[jira] [Updated] (METRON-1033) Profiler example uses incorrect units for expires

[ https://issues.apache.org/jira/browse/METRON-1033?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Simon Elliston Ball updated METRON-1033: Description: The profiler documentation states that expires is in ms, but examples

[jira] [Created] (METRON-1033) Profiler example uses incorrect units for expires

Simon Elliston Ball created METRON-1033: --- Summary: Profiler example uses incorrect units for expires Key: METRON-1033 URL: https://issues.apache.org/jira/browse/METRON-1033 Project: Metron

[jira] [Created] (METRON-906) Rest service storm configuration does not allow for proper URLs

Simon Elliston Ball created METRON-906: -- Summary: Rest service storm configuration does not allow for proper URLs Key: METRON-906 URL: https://issues.apache.org/jira/browse/METRON-906 Project: