search

NVISOsecurity / ee-outliers

Open-source framework to detect outliers in Elasticsearch events
https://blog.nviso.eu
GNU General Public License v3.0
204 stars 34 forks source link

Verify that pct_of_average and other trigger methods actually takes into account the total number of hits for each bucket #34

Open daanraman opened 5 years ago

daanraman commented 5 years ago

Example:

20 x numerical value (10) + 1 x numerical value (1) should actually calculate the average of (20x10 + 1), not (10+1)

Check if this is actually the case

detobel36 commented 5 years ago

Tested for function get_decision_frontier here https://github.com/NVISO-BE/ee-outliers/blob/master/app/tests/unit_tests/test_utils.py#L303

Test "in real" conditions here: https://github.com/detobel36/ee-outliers/blob/generatorDoc/app/tests/unit_tests/test_analyzer_metrics.py#L829 and here: https://github.com/detobel36/ee-outliers/blob/generatorDoc/app/tests/unit_tests/test_analyzer_terms.py#L264