I think setting TTL values for enrichments should be fine for the time being.
I am not sure what the issue was originally where we didn't feel it was
sufficient (probably performance implication on Hbase?), but I think it should
be safe reverting back to setting TTL.
James
13.08.2019,
Ah, that feature. Yes, it never seemed to catch on. It actually wasn't
from OpenSOC, but a very early feature of Metron. The use-case was that
enrichments may go stale and removing them based on TTL was easy to do, but
not ideal. The LeastRecentlyUsedPruner was a MR job which would allow
Sure. I should have provided some more context. I can tell you what I do
know about it. Perhaps others can provide some more color.
- This is functionality accessed by a user by running the script; ${
METRON_HOME}/bin/threatintel_bulk_prune.sh
- If you are using access trackers with
Can you summarize what it does? Is it from OpenSOC?
On August 13, 2019 at 17:53:52, Nick Allen (n...@nickallen.org) wrote:
As part of https://github.com/apache/metron/pull/1470, I found it difficult
to update the "Least Recently Used Pruner" to work with HBase 2.0.2. I am
sure that given more
As part of https://github.com/apache/metron/pull/1470, I found it difficult
to update the "Least Recently Used Pruner" to work with HBase 2.0.2. I am
sure that given more time and effort, I could make it work, but is it worth
it?
This is a feature that I myself am not familiar with. I do not
