code: protected boolean isMatchingAttack(SearchCriteria criteria, Attack attack) {
  		boolean match = false;
  
  		User user = criteria.getUser();
  		DetectionPoint detectionPoint = criteria.getDetectionPoint();
  		Collection<String> detectionSystemIds = criteria.getDetectionSystemIds();
  		DateTime earliest = DateUtils.fromString(criteria.getEarliest());
  		Rule rule = criteria.getRule();
  
  		// check user match if user specified
  		boolean userMatch = (user != null) ? user.equals(attack.getUser()) : true;
  
  		// check detection system match if detection systems specified
  		boolean detectionSystemMatch = (detectionSystemIds != null && detectionSystemIds.size() > 0) ?
  				detectionSystemIds.contains(attack.getDetectionSystem().getDetectionSystemId()) : true;
  
  		// check detection point match if detection point specified
  		boolean detectionPointMatch = (detectionPoint != null) ?
  				detectionPoint.typeAndThresholdMatches(attack.getDetectionPoint()) : true;
  
  		//check rule match if rule specified
  		boolean ruleMatch = true;
  		if (rule != null) {
  			ruleMatch = (attack.getRule() != null) ?
  				rule.guidMatches(attack.getRule()) : false;
  		}
  
  		boolean earliestMatch = (earliest != null) ? earliest.isBefore(DateUtils.fromString(attack.getTimestamp())): true;
  
  		if (userMatch && detectionSystemMatch && detectionPointMatch && ruleMatch && earliestMatch) {
  			match = true;
  		}
  
  		return match;
  	}
docs: Finder for attacks in the AttackStore.
  
  @param criteria the {@link org.owasp.appsensor.core.criteria.SearchCriteria} object to search by
  @param attack the {@link Attack} object to match on
  @return true or false depending on the matching of the search criteria to the {@link Attack}