GitHub user nickwallen opened a pull request:
https://github.com/apache/metron/pull/845
METRON-1321 Metaalert Threat Score Type Does Not Match Sensor Indices
After creating Metaalerts in the Alerts UI, I am unable to sort by threat
triage score. The exception that is logged is shown in the issue. When
opening the Developer view in Chrome, I can see the API responds with an error.
An error message is logged under `/var/log/metron/metron-rest.log`.
## What happened?
An overall threat score is added to a Metaalert whenever it has any child
alerts. This overall threat score is a summary of the threat scores from each
of the child alerts.
This field is also named the same as the threat score fields from the
sensor indices; 'threat:triage:score'. The type of this field must be the same
as the 'threat:triage:score' fields from each of the sensor indices. Otherwise
the Alerts UI cannot properly sort alerts and metaalerts in the same table/view
in the UI.
## Changes
I updated the `ElasticsearchMetaalertDao` so that when it creates the
overall threat score, it is added as a Float to match the type expected from
the other sensor indices.
## Testing
1. Spin up Full Dev
2. Open up the Alerts UI
3. Sort by triage score and assure no errors occur
4. Create a Metaalert.
5. Sort by triage score and assure no errors occur
## Pull Request Checklist
- [ ] Is there a JIRA ticket associated with this PR? If not one needs to
be created at [Metron
Jira](https://issues.apache.org/jira/browse/METRON/?selectedTab=com.atlassian.jira.jira-projects-plugin:summary-panel).
- [ ] Does your PR title start with METRON-XXXX where XXXX is the JIRA
number you are trying to resolve? Pay particular attention to the hyphen "-"
character.
- [ ] Has your PR been rebased against the latest commit within the target
branch (typically master)?
- [ ] Have you included steps to reproduce the behavior or problem that is
being changed or addressed?
- [ ] Have you included steps or a guide to how the change may be verified
and tested manually?
- [ ] Have you ensured that the full suite of tests and checks have been
executed in the root metron folder via:
- [ ] Have you written or updated unit tests and or integration tests to
verify your changes?
- [ ] If adding new dependencies to the code, are these dependencies
licensed in a way that is compatible for inclusion under [ASF
2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] Have you verified the basic functionality of the build by building
and running locally with Vagrant full-dev environment or the equivalent?
You can merge this pull request into a Git repository by running:
$ git pull https://github.com/nickwallen/metron METRON-1321
Alternatively you can review and apply these changes as the patch at:
https://github.com/apache/metron/pull/845.patch
To close this pull request, make a commit to your master/trunk branch
with (at least) the following in the commit message:
This closes #845
----
commit c780058aad1611edb0ea7a4fae84038ee07d50fd
Author: Nick Allen <n...@nickallen.org>
Date: 2017-11-20T18:05:37Z
METRON-1321 Metaalert Threat Score Type Does Not Match Sensor Indices
----
---
