[session 1] fix(aria): drop unclassified INFO events at ingest (threat_event flood, #12) #13

2026-07-22T10:21:10-04:00

hiveiq commented

2026-07-22 10:21:10 -04:00

Session: 1

Fixes the ARIA threat_event flood from #12.

Root cause

Agents send the bare Windows event id signalKey="4663". The classifier only matches "EVENT_4663", so "4663" falls into the default branch → INFO, no attack phase, no IOC. These events:

are never published to Kafka (only HIGH/CRITICAL are), and
cannot form a precursor sequence (SequenceDetectionService filters out null-phase events and requires a PHYSICAL_ACCESS phase).

So they carry zero detection value yet bloated threat_event to 68M rows / 14 GB in 37 days.

Change

ThreatEventIngestionService now drops events that classify as INFO with no matched IOC and no attack phase before save() (and before sequence detection), with a periodic count log so volume stays visible. Anything with any detection value — elevated severity, an IOC match, or an attack phase — is unaffected.

Toggle: aria.ingest.drop-unclassified-info (env ARIA_DROP_UNCLASSIFIED_INFO, default true). Set false to restore prior behaviour.
Adds ThreatEventClassifierTest (4 tests) pinning the noise signature: bare 4663 and unknown signals = noise (dropped); EVENT_4663 (HIGH/MALWARE_STAGING) and DOOR_OPEN (MEDIUM/PHYSICAL_ACCESS) = kept.

Verification

mvn test green locally (4/4).
Post-merge: cd-develop build → recreate on bcos.dev → smoke: POST a 4663 event (expect not persisted) and a real signal (expect persisted).

Notes

The existing 68M prod rows were already purged (see #12 comment). This stops them coming back.
Follow-on (separate, agent-side): stop the agent forwarding 4663 at all, plus a retention/partition policy — tracked on #12.

Refs #12

**Session:** 1 Fixes the ARIA `threat_event` flood from #12. ### Root cause Agents send the **bare** Windows event id `signalKey="4663"`. The classifier only matches `"EVENT_4663"`, so `"4663"` falls into the `default` branch → `INFO`, no attack phase, no IOC. These events: - are **never published to Kafka** (only HIGH/CRITICAL are), and - **cannot form a precursor sequence** (`SequenceDetectionService` filters out null-phase events and requires a `PHYSICAL_ACCESS` phase). So they carry zero detection value yet bloated `threat_event` to **68M rows / 14 GB in 37 days**. ### Change `ThreatEventIngestionService` now drops events that classify as **INFO with no matched IOC and no attack phase** before `save()` (and before sequence detection), with a periodic count log so volume stays visible. Anything with any detection value — elevated severity, an IOC match, or an attack phase — is unaffected. - Toggle: `aria.ingest.drop-unclassified-info` (env `ARIA_DROP_UNCLASSIFIED_INFO`, default `true`). Set `false` to restore prior behaviour. - Adds `ThreatEventClassifierTest` (4 tests) pinning the noise signature: bare `4663` and unknown signals = noise (dropped); `EVENT_4663` (HIGH/MALWARE_STAGING) and `DOOR_OPEN` (MEDIUM/PHYSICAL_ACCESS) = kept. ### Verification - `mvn test` green locally (4/4). - Post-merge: cd-develop build → recreate on bcos.dev → smoke: POST a `4663` event (expect **not** persisted) and a real signal (expect persisted). ### Notes - The existing 68M prod rows were already purged (see #12 comment). This stops them coming back. - Follow-on (separate, agent-side): stop the agent forwarding 4663 at all, plus a retention/partition policy — tracked on #12. Refs #12

hiveiq added 1 commit 2026-07-22 10:21:10 -04:00

fix(aria): drop unclassified INFO events at ingest to stop threat_event flood a91e236032

Agents send the bare Windows event id "4663", which misses the classifier's
"EVENT_4663" case and lands in the INFO default branch. Such events are never
published to Kafka (only HIGH/CRITICAL are) and cannot form a precursor sequence
(SequenceDetectionService ignores null-phase events and requires PHYSICAL_ACCESS),
so persisting them only bloated threat_event to 68M rows / 14GB in 37 days.

ThreatEventIngestionService now drops events classified as INFO with no IOC match
and no attack phase before save(), with a periodic count log. Toggle via
aria.ingest.drop-unclassified-info (env ARIA_DROP_UNCLASSIFIED_INFO, default true).
Adds ThreatEventClassifierTest pinning the noise signature.

Refs #12

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

johannes approved these changes 2026-07-22 10:21:37 -04:00

hiveiq merged commit 34656dca4d into develop

2026-07-22 10:22:15 -04:00

hiveiq deleted branch fix/12-drop-unclassified-info-events

2026-07-22 10:22:15 -04:00

hiveiq referenced this pull request

2026-07-22 11:30:32 -04:00

[session 1] fix(security): bump hiveops-bom 1.0.8 -> 1.0.9 (tomcat CVE-2026-59083/59084, unblocks cd-develop) #14

hiveiq referenced this pull request

2026-07-22 11:44:50 -04:00

[session 1] Release 2026-07: aria — ingest noise filter + tomcat CVE fix (develop → main) #15

Sign in to join this conversation.