@@ -0,0 +1,1327 @@
+#!/usr/bin/env python%0A%0A# This Source Code Form is subject to the terms of the Mozilla Public%0A# License, v. 2.0. If a copy of the MPL was not distributed with this%0A# file, You can obtain one at http://mozilla.org/MPL/2.0/.%0A# Copyright (c) 2014 Mozilla Corporation%0A#%0A# Contributors:%0A# Jeff Bryner jbryner@mozilla.com%0A%0Afrom lib.alerttask import AlertTask%0Aimport pyes%0A%0Aclass ldapLockout(AlertTask):%0A    def main(self):%0A        # look for events in last x %0A        date_timedelta = dict(minutes=15)%0A        # Configure filters%0A        # looking for pwdAccountLockedTime setting by admin%0A        must = %5B%0A            pyes.TermFilter('category', 'ldapChange'),%0A            pyes.TermFilter(%22actor%22, %22cn=admin,dc=mozilla%22),%0A            pyes.QueryFilter(pyes.MatchQuery('changepairs', 'replace:pwdAccountLockedTime','phrase'))%0A        %5D%0A        self.filtersManual(date_timedelta, must=must)%0A%0A        # Search events%0A        self.searchEventsSimple()%0A        self.walkEvents()%0A%0A    # Set alert properties%0A    def onEvent(self, event):%0A        category = 'ldap'%0A        tags = %5B'ldap'%5D%0A        severity = 'NOTICE'%0A        summary='%7B0%7D LDAP account locked'.format(event%5B'_source'%5D%5B'details'%5D%5B'dn'%5D)%0A%0A        # Create the alert object based on these properties%0A        return self.createAlertDict(summary, category, tags, %5Bevent%5D, severity)%0A

add ldap lockout alert, closes #320