Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SIEMINT-118] DDS: Trellix Endpoint Security: Crawler Integration v1.0.0 #18673

Conversation

shubhamvekariya-crest
Copy link
Contributor

What does this PR do?

This is a initial release PR of Trellix Endpoint Security integration including all the required assets.

Additional Notes

  • Crawler code for this integration has been committed in its respective repo
  • Pipeline and Facet group created for this integration are available in our sandbox and would be shared separately with the required teams.
  • Samples for the pipeline review would also be shared separately with the required teams.
  • OOTB detection rules JSON would be shared separately with the required teams as a part of separate repository.
  • Since during the standard attribute remapping we are not preserving the source attributes as per suggested best practices, it would result in filters using these standard attributes populating the values of other integrations as well as per current Datadog behaviour.

Review checklist (to be filled by reviewers)

  • Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
  • Changelog entries must be created for modifications to shipped code
  • Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
  • If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

brett0000FF
brett0000FF previously approved these changes Sep 27, 2024
#### Get Credentials of Trellix Endpoint Security

1. Log in to the Trellix ePO Saas.
2. Navigate to the **Trellix Developer Portal** using [this][2] link.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
2. Navigate to the **Trellix Developer Portal** using [this][2] link.
2. Navigate to the **[Trellix Developer Portal][2]**.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

- **Method Types**: Select **GET**.
5. Click **Request** to submit the request. It typically takes 2-3 days to process. You will be notified once your credentials are ready.
6. When your credentials are available, generate your Client credentials by clicking **Generate** under **Create Client Credentials**.
7. Copy and securely store the API key from **Access Management**, along with the Client ID and Client Secret from **Create Client Credentials**.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
7. Copy and securely store the API key from **Access Management**, along with the Client ID and Client Secret from **Create Client Credentials**.
7. Copy and securely store the API key from **Access Management**, along with the Client ID and Client Secret, from **Create Client Credentials**.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

!!! Add steps to validate integration is functioning as expected !!!
Configure the Datadog endpoint to forward Trellix Endpoint Security logs to Datadog.

1. Navigate to `Trellix Endpoint Security`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
1. Navigate to `Trellix Endpoint Security`.
1. Navigate to **Trellix Endpoint Security**.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

@dj0well dj0well requested a review from a team October 2, 2024 11:01
@mathieu-charbonnel mathieu-charbonnel added the assets/deploy-logs-staging ONLY USED BY Logs Backend - Validates that a PR is OK to go to staging label Oct 28, 2024
brett0000FF
brett0000FF previously approved these changes Oct 29, 2024
@nathanmadams
Copy link
Contributor

@jnhunsberger looks like this one just needs product sign-off

@nathanmadams nathanmadams removed the request for review from a team November 21, 2024 14:26
Copy link

@jnhunsberger jnhunsberger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Need to update dashboard layout per my comment.

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This dashboard does not align with our design standards. Please update to include the product and company logo and adjust layout accordingly.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi @jnhunsberger, To better showcase more of our use cases in the image, we’ve removed the product logo and description widgets from the dashboard. However, the product logo and description are still available in the dashboard as per Datadog standards, and everything remains the same from a code perspective.

@torosmassa torosmassa dismissed jnhunsberger’s stale review February 26, 2025 16:11

Requested updates were made on Dec 19, dismissing this review.

@nathanmadams nathanmadams added this pull request to the merge queue Feb 26, 2025
Merged via the queue into DataDog:master with commit d196b77 Feb 26, 2025
40 of 41 checks passed
github-actions bot pushed a commit that referenced this pull request Feb 26, 2025
…0.0 (#18673)

* Add Trellix Endpoint Security integration with assets

* Resolve CI failures

* Update log pipeline sample

* Update log pipeline sample

* Resolve CI Failures

* Update log pipeline

* Update log pipeline

* Update Dashboard

* Update dashboard widget

* Update readme and dashboard

* Update screenshot

* Address review comments

* Update setup section of readme

* Update setup section of README d196b77
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants