Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add amo pipeline updates #181

Merged
merged 2 commits into from Jul 18, 2019
Merged

add amo pipeline updates #181

merged 2 commits into from Jul 18, 2019

Conversation

ameihm0912
Copy link

No description provided.

@ameihm0912 ameihm0912 requested a review from ajvb July 18, 2019 20:30
ajvb
ajvb previously approved these changes Jul 18, 2019
src/main/java/com/mozilla/secops/amo/Amo.java Outdated Show resolved Hide resolved
if (!email.equals(nb)) {
buf += ", " + nb;
}
alert.addMetadata("email", buf);
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not blocking, but packing multiple email addresses into one metadata kv pair seems like it may lead to pain later (and pain now with regards to analyzing and searching through alerts in bq, via queries or in something like redash)

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yeah, completely agree. I'm not sure what the best way to handle this is right now, we wouldn't want something like multiple keys either I suspect.

It's probably worth standardizing on some sort of metadata value array type that applies constraints on how this is constructed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants