MetaScores { @SuppressWarnings("unchecked") public static void calculateMetaScores(Document metaAlert, String threatTriageField, String threatSort) { MetaScores metaScores = new MetaScores(new ArrayList<>()); List<Object> alertsRaw = ((List<Object>) metaAlert.getDocument() .get(MetaAlertConstants.ALERT_FIELD)); if (alertsRaw != null && !alertsRaw.isEmpty()) { ArrayList<Double> scores = new ArrayList<>(); for (Object alertRaw : alertsRaw) { Map<String, Object> alert = (Map<String, Object>) alertRaw; Double scoreNum = parseThreatField(alert.get(threatTriageField)); if (scoreNum != null) { scores.add(scoreNum); } } metaScores = new MetaScores(scores); } metaAlert.getDocument().putAll(metaScores.getMetaScores()); Object threatScore = metaScores.getMetaScores().get(threatSort); metaAlert.getDocument() .put(threatTriageField, ConversionUtils.convert(threatScore, Float.class)); } MetaScores(List<Double> scores); Map<String, Object> getMetaScores(); @SuppressWarnings("unchecked") static void calculateMetaScores(Document metaAlert, String threatTriageField,
      String threatSort);  }
@Test public void testCalculateMetaScoresList() { final double delta = 0.001; List<Map<String, Object>> alertList = new ArrayList<>(); alertList.add(Collections.singletonMap(THREAT_FIELD_DEFAULT, 10.0f)); alertList.add(Collections.singletonMap(THREAT_FIELD_DEFAULT, 20.0f)); alertList.add(Collections.singletonMap("alert3", "has no threat score")); Map<String, Object> docMap = new HashMap<>(); docMap.put(ALERT_FIELD, alertList); Document metaalert = new Document(docMap, "guid", METAALERT_TYPE, 0L); MetaScores.calculateMetaScores(metaalert, THREAT_FIELD_DEFAULT, THREAT_SORT_DEFAULT); assertEquals(20D, (Double) metaalert.getDocument().get("max"), delta); assertEquals(10D, (Double) metaalert.getDocument().get("min"), delta); assertEquals(15D, (Double) metaalert.getDocument().get("average"), delta); assertEquals(2L, metaalert.getDocument().get("count")); assertEquals(30D, (Double) metaalert.getDocument().get("sum"), delta); assertEquals(15D, (Double) metaalert.getDocument().get("median"), delta); Object threatScore = metaalert.getDocument().get(THREAT_FIELD_DEFAULT); assertTrue(threatScore instanceof Float); assertEquals(30.0F, threatScore); }
@Test public void testCalculateMetaScoresWithDifferentFieldName() { List<Map<String, Object>> alertList = new ArrayList<>(); alertList.add( Collections.singletonMap(MetaAlertConstants.THREAT_FIELD_DEFAULT, 10.0f)); Map<String, Object> docMap = new HashMap<>(); docMap.put(MetaAlertConstants.ALERT_FIELD, alertList); Document metaalert = new Document(docMap, "guid", MetaAlertConstants.METAALERT_TYPE, 0L); AccessConfig accessConfig = new AccessConfig(); accessConfig.setGlobalConfigSupplier(() -> new HashMap<String, Object>() {{ put(Constants.THREAT_SCORE_FIELD_PROPERTY, MetaAlertConstants.THREAT_FIELD_DEFAULT); }}); MetaScores.calculateMetaScores(metaalert, MetaAlertConstants.THREAT_FIELD_DEFAULT, MetaAlertConstants.THREAT_SORT_DEFAULT); assertNotNull(metaalert.getDocument().get(MetaAlertConstants.THREAT_FIELD_DEFAULT)); }