[jira] [Commented] (METRON-290) Add ontologies to Stellar for building knowledge graphs

["Otto Fowler (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/METRON-290?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16104444#comment-16104444 ] 

Otto Fowler commented on METRON-290:
------------------------------------

What about different levels of ontologies?

Level 1 : Ontologies of known standard fields
Level 2 : Per Parser ( input ) Ontologies ( specialized )
Level 3 : Specialized and Cross Parser Ontologies

Level 3 would require end user customization,

Level 2 could be delivered optionally as part of a parser extensions installation

> Add ontologies to Stellar for building knowledge graphs
> -------------------------------------------------------
>
>                 Key: METRON-290
>                 URL: https://issues.apache.org/jira/browse/METRON-290
>             Project: Metron
>          Issue Type: New Feature
>    Affects Versions: 0.2.1BETA
>            Reporter: James Sirota
>            Assignee: Casey Stella
>              Labels: METRON_ML
>
> I want to be able to define, extract, and build ontologies/relations from Metron telemetry.  Here is an example.  If my message is as follows:
> {ip1:someIP1, ip2:someIp2, protocol:TCP,userAgent:A1}
> I want the following config defined:
> ontology1: ip1 connectsTo ip2
> ontology2: ip1 hasProtocol protocol
> ontology3: ip1 hasUserAgent userAgent
> ...
> ontology n
> And from that config I want the following be created with Stellar:
> someIP1 : connectsTo : someIP2
> someIP1 : hasProtocol : TCP
> someIP1: hasUserAgent: A1
> And then be pushed to a graph database with a TTL value.  By applying these to multiple telemetries we create a knowledge graph.  This is one of the fundamental capabilities that Metron needs for doing advanced analytics 



--
This message was sent by Atlassian JIRA
(v6.4.14#64029)