Did they get in?
Thursday, February 24, 2011
1:11 PM
Second question: did the attackers get in?
A signature of a successful distributed attack is a successful login from somewhere the user doesn't frequent, after several unsuccessful login attempts from the same place. 
Now we really have to work!
Step 1: start over!
log = LOAD 'log' USING MyLogParser() 
AS (time:long, user:chararray, action:chararray, status:chararray, subnet:chararray); 
We do not have to retype this. It is an alias, not a command! 
Select the users we know are under attack: Remember that the schema for that list is
user4: {user:chararray, places:int}
First we make a list of users under attack: 
attacked = FOREACH user4 GENERATE user; 
And then we select all records for those users via an inner join:
vulnerable = JOIN log BY user, attacked BY user;
And we are interested only in login attempts: 
vulnerable2 = FILTER vulnerable by action=='login'; 
And then strip the joined field off (it's a duplicate), along with the action field (it's redundant now). 
vulnerable3 = FOREACH vulnerable2 GENERATE log::time as time, log::user as user, log::status as status, log::subnet as subnet;   
Now our schema is 
vulnerable3: {time:long, user:chararray, status:chararray, subnet:chararray}