Append one or more collection attribute labels to a dataframe based on the
observationDomainid and vlanId fields in the data.
Append one or more collection attribute labels to a dataframe based on the
observationDomainid and vlanId fields in the data.
input dataframe
append_label_columns(df, "enclave", "department", "organization")
An array containing the values of a column expression of a dataframe.
An array containing the values from the first column of a dataframe.
Given the name of a collection attribute and a set of matching labels, produce a filter expression that can be used to filter a DataFrame for * flows matching the given labels.
Given the name of a collection attribute and a set of matching labels, produce a filter expression that can be used to filter a DataFrame for * flows matching the given labels.
df.filter(collection_labels("enclave", "IT1A", "DEV2B"))
will find flows in either the IT1A or DEV2B enclaves.
Given a set of collector labels, returns a set of filter expressions for filtering records from those collectors.
Given a set of collector labels, returns a set of filter expressions for filtering records from those collectors.
df.filter(collector_labels("IT1", "DEV2"))
Convenience method for building filter conditions using comparison operators.
Group data by one or more collection attributes and count the number of flows within each group.
Group data by one or more collection attributes and count the number of flows within each group.
input dataframe
count_by_label_columns(df, "enclave", "department")
Given a set of department labels, returns a set of filter expressions for filtering records from those departments.
Given a set of department labels, returns a set of filter expressions for filtering records from those departments.
df.filter(department_labels("IT", "DEV"))
Given a set of enclave labels, returns a set of filter expressions for filtering records from those enclaves.
Given a set of enclave labels, returns a set of filter expressions for filtering records from those enclaves.
df.filter(enclave_labels("IT1A", "DEV2B"))
Filter a DataFrame on the passed field, value and condition.
Return a DataFrame containing only flows starting at or after the passed start time before or at the passed end time.
Return a DataFrame containing only flows starting at or after the passed start time before or at the passed end time. Empty strings can be passed for the start or end times to avoid filtering on that field.
This function filters and returns a DataFrame based on whether the value or values in the given field of the DataFrame are contained in the given list.
True if the input is a string representing an IP address not in the internal set.
True if the input is a string representing an IP address not in the internal set. False if it is an IP address that is in the internal set. NULL if the value cannot be parsed as an IP address.
True if the input is a string representing an IP address in the internal set.
True if the input is a string representing an IP address in the internal set. False if it is an IP address that is not in the internal set. NULL if the value cannot be parsed as an IP address.
Import data from a CSV file and return a DataFrame containing the imported data.
Import data from a CSV file and return a DataFrame containing the imported data.
Load a SiLK IPset file into a DataFrame of individual IP addresses.
Load a SiLK IPset file into a DataFrame of IP address blocks.
Given a set of organization labels, returns a set of filter expressions for filtering records from those organizations.
Given a set of organization labels, returns a set of filter expressions for filtering records from those organizations.
df.filter(organization_labels("ORG1", "ORG2))
Write data in an existing DataFrame to a CSV file.
Write data in an existing DataFrame to a CSV file. The output CSV file will have headers corresponding to the column names of the DataFrame.
Write data in an existing DataFrame to a Hive table.
Save a DataFrame of IP addresses or blocks as a SiLK IPset file.
If both arguments are strings parsable as IP addresses, and if the first argument (sip) represents the initiator of a connection and the second argument (dip) represents the recipient of a connection, returns:
If both arguments are strings parsable as IP addresses, and if the first argument (sip) represents the initiator of a connection and the second argument (dip) represents the recipient of a connection, returns:
"in" if the initiator is external and the recipient is internal "out" if the initiator is internal and the recipient is external "int2int" if both are internal "ext2ext" if both are external NULL if either value is not parsable as an IP address
Given a string in the form of yyyy-mm-dd representing a date, returns a filter expression that can be used to filter a DataFrame for records with a start time on that date.
Given a string in the form of yyyy-mm-dd representing a date, returns a filter expression that can be used to filter a DataFrame for records with a start time on that date.
df.filter(stime_date("2018-01-01"))
Given string arguments representing the begin and end of a time range, returns a filter expression that can be used to filter a DataFrame for records with a start time within that range.
Given string arguments representing the begin and end of a time range, returns a filter expression that can be used to filter a DataFrame for records with a start time within that range.
df.filter(stime_range("2018-01-01 12:00:00", "2018-01-01 13:00:00"))
A collection of analysis helper functions for working with network data in Spark.