Random Detector

The Random Detector inspects incoming ParserSchema instances and, according to its configuration, emits alerts with synthetic content. It can be configured to sample specific log variables, set thresholds or control alert frequency. Use it for integration testing, load testing, or as a simple example of a detector implementation.

In/out

Input and output schemas in the pipeline

	Schema	Description
Input	ParserSchema	Structured log
Output	DetectorSchema	Generated alerts

At a glance

Learns from training data	Auto-configuration	Needs events	Federation
❌	❌	✅	❌

Description

For every variable configured under events, the detector draws a random number between 0 and 1 and raises an alert when it is above that variable's threshold (set in that variable's params). It does not train, so it needs no data_use_training.

Example

import numpy as np
import yaml
from detectmatelibrary import schemas
from detectmatelibrary.detectors.random_detector import RandomDetector

with open("docs/examples/detectors/random_detector.yaml") as f:
    config = yaml.safe_load(f)
detector = RandomDetector(name="RandomDetector", config=config)

login = schemas.ParserSchema({"eventID": 0, "variables": ["alice", "10.0.0.1", "22"]})

np.random.seed(0)  # only to make this example reproducible

# no training needed: with threshold 0.9, roughly 1 in 10 logs raises an alert
alerts = [detector.process(login) for _ in range(100)]
print(sum(alert is not None for alert in alerts))  # around 10

Configuration file

The configuration used by the example above. It sets only what this use case needs; every other parameter keeps its default (see Configuration arguments).

detectors:
  RandomDetector:
    method_type: random_detector
    events:
      0:                        # EventID: "Accepted password for <*> from <*> port <*>"
        login:
          variables:
            - pos: 0
              name: user
              params:
                threshold: 0.9  # alert when a random number in [0, 1) exceeds this, i.e. ~10% of logs

The same file works unchanged in both places a detector runs:

• Library: load it with yaml.safe_load and pass the dict as config=, as in the example. The key under detectors: must match the detector's name.
• DetectMateService: use it as the service's detector configuration.

Configuration arguments

All parameters this detector accepts, grouped by the YAML block they go in. Scope tells whether a parameter is specific to this detector or shared with other detectors (see the Detectors overview). Where this detector changes a shared default, the shared value is shown in brackets.

Top level

Field	Type	Default	Scope	Description
method_type	string	random_detector	shared	Indicates what type of method it is.
auto_config	boolean	True	shared	Runs the configuration step before the training process. Has no effect unless data_use_configure is set.
events	object	{}	shared	Events configuration dict keyed by event_id.
global	object	{}	shared	Instances monitoring event-independent header variables (e.g. hostname, level), keyed by instance name. Written as global in YAML.

params

Field	Type	Default	Scope	Description
start_id	integer	10	shared	Number used to start the unique ID generator.
data_use_training	integer, null	None	shared	Number of logs used for training. None skips training.
data_use_configure	integer, null	None	shared	Number of logs used for the configuration step. None skips it.
use_config_data_as_training	boolean	True	shared	Combine the configured data in the training process if True.
train_buffer_max_records	integer	100000	shared	Configure records kept in memory for training (use_config_data_as_training) before the buffer spills to Parquet files on disk, in parts of this many records.
train_buffer_dir	string, null	None	shared	Local directory for the spilled training buffer. None uses the system temp directory (TMPDIR). Each spill goes to a private detectmate-train-* directory, removed after training reads it; a killed process leaves it behind.
parser	string	PARSER	shared	Name of the parser used.