[INTPLAT-462] DDS: Orca Security: integration V1.0.0 #19164

surabhipatel-crest · 2024-11-29T07:59:11Z

What does this PR do?

This is a initial release PR of Orca Security integration including all the required assets.

Additional Notes

This integration is based on in-built datadog integration for orca and so Crawler will not be used.
The assets are available in our sandbox and can be shared separately with the required teams.

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

aliciascott · 2024-12-05T16:38:13Z

Thank you @surabhipatel-crest I've created an Editorial card for someone on our team to review this further

aliciascott

Hi @bhargavnariyanicrest looks good just a few small suggestions.

aliciascott · 2024-12-06T22:03:05Z

orca_security/README.md

+
+## Overview
+
+[Orca Security][1] a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like Real-time visibility, vulnerability management, workload protection, cloud security posture management, compliance management.


Suggested change

[Orca Security][1] a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like Real-time visibility, vulnerability management, workload protection, cloud security posture management, compliance management.

[Orca Security][1] is a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like real-time visibility, vulnerability management, workload protection, cloud security posture management, and compliance management.

aliciascott · 2024-12-06T22:03:51Z

orca_security/README.md

+
+- Alert: Represents details such as the state of alert, account details, asset in which the alert was found, and more.
+
+The Orca Security integration seamlessly ingests the data of alert logs using the in-built integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.


Suggested change

The Orca Security integration seamlessly ingests the data of alert logs using the in-built integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.

The Orca Security integration seamlessly ingests the data of alert logs using the built-in integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format, and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.

aliciascott · 2024-12-06T22:04:33Z

orca_security/README.md

+
+   The Datadog Configuration window opens.
+4. Specify the following settings:
+   - **API Key** - Add API key of Datadog platform.


Suggested change

- **API Key** - Add API key of Datadog platform.

- **API Key** - Add the API key of your Datadog platform.

aliciascott · 2024-12-06T22:06:44Z

orca_security/README.md

+9. In the **Trigger Query** section, select all the values for alert state in the query. The query should look as below:
+
+    ```When an alert Alert State is open,in_progress,snoozed,dismissed,closed```
+10. In the **Define Results** section, please enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog or disable it to forward newly generated/updated alerts. (**Note:** As per Datadog Log Ingestion behavior, alerts updated older than 18 hours cannot be ingested to Datadog.)


Suggested change

10. In the **Define Results** section, please enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog or disable it to forward newly generated/updated alerts. (**Note:** As per Datadog Log Ingestion behavior, alerts updated older than 18 hours cannot be ingested to Datadog.)

10. In the **Define Results** section, please enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog, or disable it to forward newly generated/updated alerts.

**Note**: Alerts that were updated more than 18 hours ago cannot be ingested into Datadog.

aliciascott · 2024-12-06T22:08:19Z

orca_security/README.md

+
+    ```When an alert Alert State is open,in_progress,snoozed,dismissed,closed```
+10. In the **Define Results** section, please enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog or disable it to forward newly generated/updated alerts. (**Note:** As per Datadog Log Ingestion behavior, alerts updated older than 18 hours cannot be ingested to Datadog.)
+11. In the **SEIM/SOAR** under the **Define Results** section, check the **Datadog** and select **Logs** as the datadog type.


Suggested change

11. In the **SEIM/SOAR** under the **Define Results** section, check the **Datadog** and select **Logs** as the datadog type.

11. In the **SIEM/SOAR** section under the **Define Results** section, check **Datadog** and select **Logs** as the Datadog type.

thibaultkrebs · 2024-12-16T13:50:25Z

orca_security/assets/logs/orca-security_tests.yaml

@@ -0,0 +1,240 @@
+id: "orca-security"


The indentation for this file does not look correct. You have an example here. Could you try make sure the message respect the same indentation. Custom should not be empty is done correctly

For the log pipeline example, we usually receive the correct output with a custom tag from the validate-log action in the CI/CD pipeline, which we include in the results for all integrations. However, for Orca security, the custom tag appears empty, and despite this, the CI/CD pipeline still passes. We attempted to manually add values to the custom tag and adjusted the indentation according to the given reference. Unfortunately, this led to an internal server error with the message An internal error occurred while assets were being validated. and Contact Datadog to find out how to resolve the problem.

the correct output with a custom tag
Indeed you should receive the correct response, but the sample need to properly formatted and I believe we struggle to make it work here. I believe how you committed here, should be the good way. Can you try again and I will follow up to help

Thanks. We have updated its format and added output with custom tag.

Looks good now, thank you!

thibaultkrebs · 2025-01-03T09:56:59Z

orca_security/assets/logs/orca-security_tests.yaml

+      "rule_id" : "r4c1559f2e0",
+      "asset_category" : "Encryption and Secrets",
+      "asset_state" : "enabled",
+      "service" : "Orca Alerts",


Could we add a service remapper for this property?
https://docs.datadoghq.com/logs/log_configuration/processors/?tab=api#service-remapper

We have added it.

codecov · 2025-01-03T09:57:45Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 88.01%. Comparing base (96c2b3d) to head (7bbc286).
Report is 351 commits behind head on master.

Additional details and impacted files

Flag	Coverage Δ
activemq	`?`
cassandra	`?`
hive	`?`
hivemq	`?`
ignite	`?`
jboss_wildfly	`?`
kafka	`?`
presto	`?`
solr	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

Add Orca Security assets

b583476

datadog-assets bot added docs/review-requested ecosystems/review-requested product/review-requested labels Nov 29, 2024

surabhipatel-crest added 13 commits November 29, 2024 13:36

Made minor change in the log pipeline

11923c3

Fixed pipeline suggestion

5a8ebf0

Fixed pipeline suggestion

568e321

Fixed pipeline suggestion

afe4462

Fixed pipeline suggestion

dc833b5

Updated appi-id to orca_security

850e57f

Made minor change in manifest file

d3ea2c3

Updated app-id and made minor changes in logs files

83e2727

Added installation_sources in orca-security file

f6b0eff

Updated installation_sources in orca-security file

fae8b61

fixed pipeline suggestion for installation_sources

14e6b05

Added result sample as per pipeline suggestion

eaa03dd

Updated dashboard

efdb152

surabhipatel-crest marked this pull request as ready for review December 5, 2024 11:15

surabhipatel-crest requested review from a team as code owners December 5, 2024 11:15

aliciascott added the editorial review Waiting on a more in-depth review from a docs team editor label Dec 5, 2024

torosmassa changed the title ~~DDS: Orca Security: integration V1.0.0~~ [INTPLAT-462] DDS: Orca Security: integration V1.0.0 Dec 5, 2024

aliciascott requested changes Dec 6, 2024

View reviewed changes

datadog-assets bot added docs/requested-changes and removed docs/review-requested labels Dec 6, 2024

Updated Readme

5222e63

surabhipatel-crest requested a review from aliciascott December 9, 2024 07:05

aliciascott previously approved these changes Dec 12, 2024

View reviewed changes

thibaultkrebs reviewed Dec 16, 2024

View reviewed changes

Made indentation changes in log sample file

a3e51cd

surabhipatel-crest dismissed aliciascott’s stale review via a3e51cd December 17, 2024 07:13

surabhipatel-crest added 5 commits December 17, 2024 22:54

Fixed pipeline suggestion

560524d

Made minor change

d5bd38f

Added sample as per pipeline

d8acc5a

Added values in custom tag manually in log pipeline

6df1c27

Updated smaple indetation per pipeline suggestion

45bb226

surabhipatel-crest requested a review from thibaultkrebs December 23, 2024 06:32

surabhipatel-crest added 3 commits December 27, 2024 17:54

Updated orca-security_tests for sample indentation

1e987e7

Updated the orca-security_tests.yaml file for indentation

cf4013c

Updated sample result as per pipeline suggestion

7bbc286

thibaultkrebs reviewed Jan 3, 2025

View reviewed changes

thibaultkrebs added the assets/deploy-logs-staging ONLY USED BY Logs Backend - Validates that a PR is OK to go to staging label Jan 3, 2025

surabhipatel-crest added 3 commits January 7, 2025 12:04

Updated log pipeline

dd12258

Updated pipeline

8011990

Fixed pipeline suggestion

551597d

surabhipatel-crest requested a review from thibaultkrebs January 8, 2025 05:32

Merge branch 'master' into orca-security-assets-v1.0.0

6f07e37

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[INTPLAT-462] DDS: Orca Security: integration V1.0.0 #19164

[INTPLAT-462] DDS: Orca Security: integration V1.0.0 #19164

surabhipatel-crest commented Nov 29, 2024 •

edited

Loading

aliciascott commented Dec 5, 2024

aliciascott left a comment

aliciascott Dec 6, 2024

aliciascott Dec 6, 2024

aliciascott Dec 6, 2024

aliciascott Dec 6, 2024

aliciascott Dec 6, 2024

thibaultkrebs Dec 16, 2024

surabhipatel-crest Dec 23, 2024

thibaultkrebs Dec 26, 2024

surabhipatel-crest Dec 30, 2024

thibaultkrebs Jan 3, 2025

thibaultkrebs Jan 3, 2025

surabhipatel-crest Jan 7, 2025

codecov bot commented Jan 3, 2025


		## Overview

		[Orca Security][1] a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like Real-time visibility, vulnerability management, workload protection, cloud security posture management, compliance management.

	[Orca Security][1] a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like Real-time visibility, vulnerability management, workload protection, cloud security posture management, compliance management.
	[Orca Security][1] is a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like real-time visibility, vulnerability management, workload protection, cloud security posture management, and compliance management.


		- Alert: Represents details such as the state of alert, account details, asset in which the alert was found, and more.

		The Orca Security integration seamlessly ingests the data of alert logs using the in-built integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.

	- API Key - Add API key of Datadog platform.
	- API Key - Add the API key of your Datadog platform.

	10. In the Define Results section, please enable Apply to Existing Alerts if existing alerts in the Orca Security platform need to be forwarded to Datadog or disable it to forward newly generated/updated alerts. (Note: As per Datadog Log Ingestion behavior, alerts updated older than 18 hours cannot be ingested to Datadog.)
	10. In the Define Results section, please enable Apply to Existing Alerts if existing alerts in the Orca Security platform need to be forwarded to Datadog, or disable it to forward newly generated/updated alerts.
	Note: Alerts that were updated more than 18 hours ago cannot be ingested into Datadog.

	11. In the SEIM/SOAR under the Define Results section, check the Datadog and select Logs as the datadog type.
	11. In the SIEM/SOAR section under the Define Results section, check Datadog and select Logs as the Datadog type.

[INTPLAT-462] DDS: Orca Security: integration V1.0.0 #19164

Are you sure you want to change the base?

[INTPLAT-462] DDS: Orca Security: integration V1.0.0 #19164

Conversation

surabhipatel-crest commented Nov 29, 2024 • edited Loading

What does this PR do?

Additional Notes

Review checklist (to be filled by reviewers)

aliciascott commented Dec 5, 2024

aliciascott left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Jan 3, 2025

Codecov Report

surabhipatel-crest commented Nov 29, 2024 •

edited

Loading