Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[SIEMINT-69] DDS: Cisco Secure Endpoint: Crawler Integration v1.0.0 #17958

Merged
merged 32 commits into from
Sep 24, 2024
Merged

[SIEMINT-69] DDS: Cisco Secure Endpoint: Crawler Integration v1.0.0 #17958

merged 32 commits into from
Sep 24, 2024

Conversation

ankitarajput-crest
Copy link
Contributor

@ankitarajput-crest ankitarajput-crest commented Jul 1, 2024 •
edited
Loading

What does this PR do?

This is a initial release PR of Cisco Secure Endpoint integration including all the required assets.

Additional Notes

  • Crawler code for this integration has been committed in its respective repo
  • Pipeline and Facet group created for this integration are available in our sandbox and would be shared separately with the required teams.
  • Samples for the pipeline review would also be shared separately with the required teams.
  • OOTB detection rules JSON would be shared separately with the required teams as a part of separate repository.
  • Since during the standard attribute remapping we are not preserving the source attributes as per suggested best practices, it would result in filters using these standard attributes populating the values of other integrations as well as per current Datadog behaviour.
  • According to the Cisco Secure Endpoint Documentation, it also supports Private Cloud deployment. As there are no additional requirements mentioned in its documentation, the integration should work for private cloud deployment. But we won’t be able to test since our lab is cloud only.

Review checklist (to be filled by reviewers)

  • Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
  • Changelog entries must be created for modifications to shipped code
  • Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
  • If you need to backport this PR to another branch, you can add the backport/ label to the PR and it will automatically open a backport PR once this one is merged.

@ankitarajput-crest ankitarajput-crest changed the title [DRAFT] Cisco Secure Endpoint: Crawler Integration v1.0.0 Cisco Secure Endpoint: Crawler Integration v1.0.0 Jul 2, 2024
@ankitarajput-crest ankitarajput-crest marked this pull request as ready for review July 2, 2024 18:02
@ankitarajput-crest ankitarajput-crest requested review from a team as code owners July 2, 2024 18:02
@hestonhoffman hestonhoffman added the editorial review Waiting on a more in-depth review from a docs team editor label Jul 2, 2024
@dj0well dj0well changed the title Cisco Secure Endpoint: Crawler Integration v1.0.0 [SIEMINT-69] Cisco Secure Endpoint: Crawler Integration v1.0.0 Jul 3, 2024
@ankitarajput-crest ankitarajput-crest changed the title [SIEMINT-69] Cisco Secure Endpoint: Crawler Integration v1.0.0 [SIEMINT-69] DDS: Cisco Secure Endpoint: Crawler Integration v1.0.0 Jul 8, 2024
alai97
alai97 suggested changes Jul 9, 2024
View reviewed changes
Copy link
Contributor

@alai97 alai97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, some copy suggestions.

cisco_secure_endpoint/assets/dashboards/cisco_secure_endpoint_event.json Outdated
@@ -0,0 +1,1949 @@
{
"title": "Cisco Secure Endpoint - Event",
"description": " This dashboard provides detailed insights into the event logs generated by Cisco Secure Endpoint.",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"description": " This dashboard provides detailed insights into the event logs generated by Cisco Secure Endpoint.",
"description": "This dashboard provides detailed insights into the event logs generated by Cisco Secure Endpoint.",

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the comment. Have made the changes.

cisco_secure_endpoint/README.md Outdated
| API Host URL |The API Host URL for Cisco Secure Endpoint Cloud is "https://api.\<region\>.apm.cisco.com". Adjust the "region" part based on the region of the Cisco Secure Endpoint server. If Cisco Secure Endpoint is hosted on VPC(Virtual Private Cloud), directly provide the API Host URL. |
| Client ID | Client ID from Cisco Secure Endpoint. |
| API Key | API Key from Cisco Secure Endpoint. |
| Get Endpoint Details | Keep it "true" to collect endpoint metadata for Cisco Secure Endpoint Event Logs, otherwise "false". |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| Get Endpoint Details | Keep it "true" to collect endpoint metadata for Cisco Secure Endpoint Event Logs, otherwise "false". |
| Get Endpoint Details | Keep it "true" to collect endpoint metadata for Cisco Secure Endpoint Event Logs, otherwise "false". |

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the comment. Have made the changes.

cisco_secure_endpoint/README.md Outdated

| Cisco Secure Endpoint Parameters | Description |
| -------------------- | ------------ |
| API Host URL |The API Host URL for Cisco Secure Endpoint Cloud is "https://api.\<region\>.apm.cisco.com". Adjust the "region" part based on the region of the Cisco Secure Endpoint server. If Cisco Secure Endpoint is hosted on VPC(Virtual Private Cloud), directly provide the API Host URL. |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| API Host URL |The API Host URL for Cisco Secure Endpoint Cloud is "https://api.\<region\>.apm.cisco.com". Adjust the "region" part based on the region of the Cisco Secure Endpoint server. If Cisco Secure Endpoint is hosted on VPC(Virtual Private Cloud), directly provide the API Host URL. |
| API Host URL |The API Host URL for Cisco Secure Endpoint Cloud is "https://api.\<region\>.apm.cisco.com". Adjust the "region" part based on the region of the Cisco Secure Endpoint server. If Cisco Secure Endpoint is hosted on VPC (Virtual Private Cloud), directly provide the API Host URL. |

cisco_secure_endpoint/README.md Outdated
@@ -0,0 +1,65 @@
## Overview

[Cisco Secure Endpoint][1] is a single-agent solution that provides comprehensive protection, detection, response, and user access coverage to defend against threats to your endpoints. Using cutting-edge technology, it detects and neutralizes malicious activity in real-time, ensuring robust protection for your digital assets.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
[Cisco Secure Endpoint][1] is a single-agent solution that provides comprehensive protection, detection, response, and user access coverage to defend against threats to your endpoints. Using cutting-edge technology, it detects and neutralizes malicious activity in real-time, ensuring robust protection for your digital assets.
[Cisco Secure Endpoint][1] is a single-agent solution that provides comprehensive protection, detection, response, and user access coverage to defend against threats to your endpoints. Cisco Secure Endpoint can detect and neutralize malicious activity in real time, ensuring robust protection of your digital assets.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the comment. Have made the changes.

cisco_secure_endpoint/README.md Outdated
[Cisco Secure Endpoint][1] is a single-agent solution that provides comprehensive protection, detection, response, and user access coverage to defend against threats to your endpoints. Using cutting-edge technology, it detects and neutralizes malicious activity in real-time, ensuring robust protection for your digital assets.

This integration ingests the following logs:
- Audit: Audit logs provide activities performed by user in Cisco Secure Endpoint console.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- Audit: Audit logs provide activities performed by user in Cisco Secure Endpoint console.
- Audit: Audit logs provide activities performed by a user in the Cisco Secure Endpoint console.

cisco_secure_endpoint/README.md Outdated
--> Refer the below Steps to create Client ID and API Key:
1. Log in to your Cisco Secure Endpoint Console. Click on the Left side Menu Panel.
2. Select `Administration`, Inside that select `Organization Settings`.
3. Click `Configure API Credentials` under `Features` section, to generate the new API Credentials.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
3. Click `Configure API Credentials` under `Features` section, to generate the new API Credentials.
3. Click `Configure API Credentials` under the `Features` section to generate new API credentials.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the comment. Have made the changes.

cisco_secure_endpoint/README.md Outdated
1. Log in to your Cisco Secure Endpoint Console. Click on the Left side Menu Panel.
2. Select `Administration`, Inside that select `Organization Settings`.
3. Click `Configure API Credentials` under `Features` section, to generate the new API Credentials.
4. Click on the `New API Credentials` button located at the right side under section `Legacy API Credentials (version 0 and 1)`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
4. Click on the `New API Credentials` button located at the right side under section `Legacy API Credentials (version 0 and 1)`.
4. Click on the `New API Credentials` button located at the right side under the `Legacy API Credentials (version 0 and 1)` section.

cisco_secure_endpoint/README.md Outdated
2. Select `Administration`, Inside that select `Organization Settings`.
3. Click `Configure API Credentials` under `Features` section, to generate the new API Credentials.
4. Click on the `New API Credentials` button located at the right side under section `Legacy API Credentials (version 0 and 1)`.
5. Add the below details in the pop-up:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
5. Add the below details in the pop-up:
5. Add the following information in the pop-up modal:

cisco_secure_endpoint/README.md Outdated
Comment on lines 25 to 29
- Application Name: Any preferable name
- Scope: Select `Read-only`
- Click on `Create`.
- Once you click on create, the redirected page will display the client ID(i.e: 3rd Party API client ID) and API Key values.
- NOTE: Please make a note of the API Key, as it will only be displayed once.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
- Application Name: Any preferable name
- Scope: Select `Read-only`
- Click on `Create`.
- Once you click on create, the redirected page will display the client ID(i.e: 3rd Party API client ID) and API Key values.
- NOTE: Please make a note of the API Key, as it will only be displayed once.
- Application Name: Any preferable name.
- Scope: Select `Read-only`.
- Click `Create`.
- Once you click **Create**, the redirected page will display the client ID (like a third party API client ID) and API Key values.
- **Note:** Make a note of the API Key, as it will only be displayed once.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the comment. Have made the changes.

cisco_secure_endpoint/README.md Outdated

### Logs

The Cisco Secure Endpoint integration collects and forwards Cisco Secure Endpoint Audit and Event logs to Datadog.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The Cisco Secure Endpoint integration collects and forwards Cisco Secure Endpoint Audit and Event logs to Datadog.
The Cisco Secure Endpoint integration collects and forwards Cisco Secure Endpoint audit and event logs to Datadog.

alai97
alai97 previously approved these changes Jul 11, 2024
View reviewed changes
Copy link
Contributor

@alai97 alai97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good, two small suggestions.

cisco_secure_endpoint/README.md Outdated
| API Host URL |The API Host URL for Cisco Secure Endpoint Cloud is "https://api.\<region\>.apm.cisco.com". Adjust the "region" part based on the region of the Cisco Secure Endpoint server. If Cisco Secure Endpoint is hosted on VPC (Virtual Private Cloud), directly provide the API Host URL. |
| Client ID | Client ID from Cisco Secure Endpoint. |
| API Key | API Key from Cisco Secure Endpoint. |
| Get Endpoint Details | Keep it "true" to collect endpoint metadata for Cisco Secure Endpoint Event Logs, otherwise "false". |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| Get Endpoint Details | Keep it "true" to collect endpoint metadata for Cisco Secure Endpoint Event Logs, otherwise "false". |
| Get Endpoint Details | Keep it "true" to collect endpoint metadata for Cisco Secure Endpoint event logs, otherwise "false". |

cisco_secure_endpoint/README.md Outdated

| Cisco Secure Endpoint Parameters | Description |
| -------------------- | ------------ |
| API Host URL |The API Host URL for Cisco Secure Endpoint Cloud is "https://api.\<region\>.apm.cisco.com". Adjust the "region" part based on the region of the Cisco Secure Endpoint server. If Cisco Secure Endpoint is hosted on VPC (Virtual Private Cloud), directly provide the API Host URL. |
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| API Host URL |The API Host URL for Cisco Secure Endpoint Cloud is "https://api.\<region\>.apm.cisco.com". Adjust the "region" part based on the region of the Cisco Secure Endpoint server. If Cisco Secure Endpoint is hosted on VPC (Virtual Private Cloud), directly provide the API Host URL. |
| API Host URL | The API Host URL for Cisco Secure Endpoint Cloud is "https://api.\<region\>.apm.cisco.com". Adjust the "region" part based on the region of the Cisco Secure Endpoint server. If Cisco Secure Endpoint is hosted on VPC (Virtual Private Cloud), directly provide the API Host URL. |

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Have made the changes.

jnhunsberger
jnhunsberger previously approved these changes Aug 28, 2024
View reviewed changes
Copy link

@jnhunsberger jnhunsberger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@madhavpandya-crest madhavpandya-crest dismissed stale reviews from jnhunsberger and alai97 via 46f6ee1 August 29, 2024 10:50
alai97
alai97 previously approved these changes Sep 3, 2024
View reviewed changes
alai97
alai97 previously approved these changes Sep 3, 2024
View reviewed changes
@nathanmadams nathanmadams requested review from thibaultkrebs and removed request for a team, jnhunsberger and alai97 September 16, 2024 17:30
@thibaultkrebs
Copy link
Contributor

I rechecked the log file and it looks good for me, I have reapproved the PR 👍

@nathanmadams nathanmadams merged commit aa565a1 into DataDog:master Sep 24, 2024
43 of 44 checks passed
github-actions bot pushed a commit that referenced this pull request Sep 24, 2024
@nathanmadams @manan-crest @madhavpandya-crest
[SIEMINT-69] DDS: Cisco Secure Endpoint: Crawler Integration v1.0.0 (#…
4dce59b 
…17958)

* Cisco Secure Endpoint: Crawler Integration v1.0.0

* Made changes for validation checks failure

* Changed images folder path

* Updated dashboard

* Renamed log files

* Resolved validate log errors

* Updated README and manifest

* Updated as per PR review comments

* Added changes as per PR comments

* Updated title as per Cisco Secure Endpoint without Assets PR

* Updated as per PR review

* Updated test.yaml

* made changes for event type in test.yaml

* Added changes in test pipeline

* Updated test pipeline file

* Update: display_on_public_website from False to True

* Update: Review comments for dashboards

* Update: change dashboard images as per updated dashboards.

* Update: dashboard and pipeline

* Update: Add pipeline results

* updated menifest.json file.

* One More

* Added disclaimer and changed title

---------

Co-authored-by: manan-crest <[email protected]>
Co-authored-by: madhavpandya-crest <[email protected]>
Co-authored-by: Austin Lai <[email protected]> aa565a1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@thibaultkrebs thibaultkrebs thibaultkrebs approved these changes

@alai97 alai97 alai97 approved these changes

@ZacharyAnderson ZacharyAnderson ZacharyAnderson approved these changes

@jnhunsberger jnhunsberger jnhunsberger left review comments

Assignees
No one assigned
Labels
assets/deploy-logs-staging ONLY USED BY Logs Backend - Validates that a PR is OK to go to staging changelog/no-changelog crest/asset-pr dev/testing dev/tooling docs/review-requested documentation ecosystems/review-requested editorial review Waiting on a more in-depth review from a docs team editor integration/cisco_secure_endpoint phase2 product/review-requested qa/skip-qa Automatically skip this PR for the next QA team/agent-integrations team/documentation team/integrations-platform team/logs-backend team/saas-integrations team/siem-logs-reviewers
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
10 participants
@ankitarajput-crest @nathanmadams @thibaultkrebs @madhavpandya-crest @manan-crest @ZacharyAnderson @jnhunsberger @alai97 @hestonhoffman @dj0well