Package be.cylab.mark.detection

Class Max

java.lang.Object

be.cylab.mark.detection.Max

All Implemented Interfaces:

DetectionAgentInterface

public class Max
extends Object
implements DetectionAgentInterface

This operator keeps the highest score of evidences reports produced during a time window. It takes only one parameter:

• time_window in seconds (default 3600 - 1h)

Example configuration (2h.max.detection.yml):

 ---
 class_name:     be.cylab.mark.detection.Max
 label:          detection.2h.max
 trigger_label:  detection.2h.count
 parameters: {
   time_window : 7200
 }
 

Author:

Thibault Debatty

Constructor Summary

Constructors

Constructor	Description
Max()

Method Summary

Modifier and Type	Method	Description
void	analyze(Event event, DetectionAgentProfile profile, ServerInterface datastore)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

Max

public Max()

Method Detail

analyze

public final void analyze(Event event,
                          DetectionAgentProfile profile,
                          ServerInterface datastore)
                   throws Throwable

Specified by:

analyze in interface DetectionAgentInterface

Throws:

Throwable