[INTPLAT-462] DDS: Orca Security: integration V1.0.0 #19164

surabhipatel-crest · 2024-11-29T07:59:11Z

What does this PR do?

This is a initial release PR of Orca Security integration including all the required assets.

Additional Notes

This integration is based on in-built datadog integration for orca and so Crawler will not be used.
The assets are available in our sandbox and can be shared separately with the required teams.

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

aliciascott · 2024-12-05T16:38:13Z

Thank you @surabhipatel-crest I've created an Editorial card for someone on our team to review this further

aliciascott

Hi @bhargavnariyanicrest looks good just a few small suggestions.

aliciascott · 2024-12-06T22:03:05Z

orca_security/README.md

+
+## Overview
+
+[Orca Security][1] a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like Real-time visibility, vulnerability management, workload protection, cloud security posture management, compliance management.


Suggested change

[Orca Security][1] a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like Real-time visibility, vulnerability management, workload protection, cloud security posture management, compliance management.

[Orca Security][1] is a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like real-time visibility, vulnerability management, workload protection, cloud security posture management, and compliance management.

aliciascott · 2024-12-06T22:03:51Z

orca_security/README.md

+
+- Alert: Represents details such as the state of alert, account details, asset in which the alert was found, and more.
+
+The Orca Security integration seamlessly ingests the data of alert logs using the in-built integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.


Suggested change

The Orca Security integration seamlessly ingests the data of alert logs using the in-built integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.

The Orca Security integration seamlessly ingests the data of alert logs using the built-in integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format, and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.

aliciascott · 2024-12-06T22:04:33Z

orca_security/README.md

+
+   The Datadog Configuration window opens.
+4. Specify the following settings:
+   - **API Key** - Add API key of Datadog platform.


Suggested change

- **API Key** - Add API key of Datadog platform.

- **API Key** - Add the API key of your Datadog platform.

aliciascott · 2024-12-06T22:06:44Z

orca_security/README.md

+9. In the **Trigger Query** section, select all the values for alert state in the query. The query should look as below:
+
+    ```When an alert Alert State is open,in_progress,snoozed,dismissed,closed```
+10. In the **Define Results** section, please enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog or disable it to forward newly generated/updated alerts. (**Note:** As per Datadog Log Ingestion behavior, alerts updated older than 18 hours cannot be ingested to Datadog.)


Suggested change

10. In the **Define Results** section, please enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog or disable it to forward newly generated/updated alerts. (**Note:** As per Datadog Log Ingestion behavior, alerts updated older than 18 hours cannot be ingested to Datadog.)

10. In the **Define Results** section, please enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog, or disable it to forward newly generated/updated alerts.

**Note**: Alerts that were updated more than 18 hours ago cannot be ingested into Datadog.

aliciascott · 2024-12-06T22:08:19Z

orca_security/README.md

+
+    ```When an alert Alert State is open,in_progress,snoozed,dismissed,closed```
+10. In the **Define Results** section, please enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog or disable it to forward newly generated/updated alerts. (**Note:** As per Datadog Log Ingestion behavior, alerts updated older than 18 hours cannot be ingested to Datadog.)
+11. In the **SEIM/SOAR** under the **Define Results** section, check the **Datadog** and select **Logs** as the datadog type.


Suggested change

11. In the **SEIM/SOAR** under the **Define Results** section, check the **Datadog** and select **Logs** as the datadog type.

11. In the **SIEM/SOAR** section under the **Define Results** section, check **Datadog** and select **Logs** as the Datadog type.

thibaultkrebs · 2025-01-03T09:56:59Z

orca_security/assets/logs/orca-security_tests.yaml

+      "rule_id" : "r4c1559f2e0",
+      "asset_category" : "Encryption and Secrets",
+      "asset_state" : "enabled",
+      "service" : "Orca Alerts",


Could we add a service remapper for this property?
https://docs.datadoghq.com/logs/log_configuration/processors/?tab=api#service-remapper

We have added it.

codecov · 2025-01-03T09:57:45Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 88.01%. Comparing base (96c2b3d) to head (7bbc286).
Report is 351 commits behind head on master.

Additional details and impacted files

Flag	Coverage Δ
activemq	`?`
cassandra	`?`
hive	`?`
hivemq	`?`
ignite	`?`
jboss_wildfly	`?`
kafka	`?`
presto	`?`
solr	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

thibaultkrebs

LGTM for logs file, approved 👍

aliciascott

Hi @surabhipatel-crest just a couple small suggestions for wording! Let me know when fixed and i'll do a re-review

aliciascott · 2025-01-29T19:54:15Z

orca_security/README.md

+[Orca Security][1] is a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like real-time visibility, vulnerability management, workload protection, cloud security posture management, and compliance management.
+This integration ingests the following log:
+
+- Alert: Represents details such as the state of alert, account details, asset in which the alert was found, and more.


Suggested change

- Alert: Represents details such as the state of alert, account details, asset in which the alert was found, and more.

- Alert: Includes information such as the alert state, account details, the asset where the alert was detected, and additional details.

Just suggest to reword this slightly.

aliciascott · 2025-01-29T19:55:08Z

orca_security/README.md

+
+- Alert: Represents details such as the state of alert, account details, asset in which the alert was found, and more.
+
+The Orca Security integration seamlessly ingests the data of alert logs using the built-in integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format, and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.


Suggested change

The Orca Security integration seamlessly ingests the data of alert logs using the built-in integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format, and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.

The Orca Security integration seamlessly ingests alert logs data using the built-in integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensures a consistent data format, and enhances information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.

aliciascott · 2025-01-29T19:56:04Z

orca_security/README.md

+9. In the **Trigger Query** section, select all the values for alert state in the query. The query should look as below:
+
+    ```When an alert Alert State is open,in_progress,snoozed,dismissed,closed```
+10. In the **Define Results** section, please enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog, or disable it to forward newly generated/updated alerts.  


Suggested change

10. In the **Define Results** section, please enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog, or disable it to forward newly generated/updated alerts.

10. In the **Define Results** section, enable **Apply to Existing Alerts** if existing alerts in the Orca Security platform need to be forwarded to Datadog, or disable it to forward newly generated/updated alerts.

savandalasaniya-crest · 2025-01-30T13:03:19Z

@aliciascott, We have implemented the suggested changes. Could you please review them ?

aliciascott

looks good!

Add Orca Security assets

b583476

datadog-assets bot added docs/review-requested ecosystems/review-requested product/review-requested labels Nov 29, 2024

surabhipatel-crest added 13 commits November 29, 2024 13:36

Made minor change in the log pipeline

11923c3

Fixed pipeline suggestion

5a8ebf0

Fixed pipeline suggestion

568e321

Fixed pipeline suggestion

afe4462

Fixed pipeline suggestion

dc833b5

Updated appi-id to orca_security

850e57f

Made minor change in manifest file

d3ea2c3

Updated app-id and made minor changes in logs files

83e2727

Added installation_sources in orca-security file

f6b0eff

Updated installation_sources in orca-security file

fae8b61

fixed pipeline suggestion for installation_sources

14e6b05

Added result sample as per pipeline suggestion

eaa03dd

Updated dashboard

efdb152

surabhipatel-crest marked this pull request as ready for review December 5, 2024 11:15

surabhipatel-crest requested review from a team as code owners December 5, 2024 11:15

aliciascott added the editorial review Waiting on a more in-depth review from a docs team editor label Dec 5, 2024

torosmassa changed the title ~~DDS: Orca Security: integration V1.0.0~~ [INTPLAT-462] DDS: Orca Security: integration V1.0.0 Dec 5, 2024

aliciascott requested changes Dec 6, 2024

View reviewed changes

datadog-assets bot added docs/requested-changes and removed docs/review-requested labels Dec 6, 2024

Updated Readme

5222e63

surabhipatel-crest added 5 commits December 17, 2024 22:54

Fixed pipeline suggestion

560524d

Made minor change

d5bd38f

Added sample as per pipeline

d8acc5a

Added values in custom tag manually in log pipeline

6df1c27

Updated smaple indetation per pipeline suggestion

45bb226

surabhipatel-crest requested a review from thibaultkrebs December 23, 2024 06:32

surabhipatel-crest added 3 commits December 27, 2024 17:54

Updated orca-security_tests for sample indentation

1e987e7

Updated the orca-security_tests.yaml file for indentation

cf4013c

Updated sample result as per pipeline suggestion

7bbc286

thibaultkrebs reviewed Jan 3, 2025

View reviewed changes

thibaultkrebs added the assets/deploy-logs-staging ONLY USED BY Logs Backend - Validates that a PR is OK to go to staging label Jan 3, 2025

surabhipatel-crest added 3 commits January 7, 2025 12:04

Updated log pipeline

dd12258

Updated pipeline

8011990

Fixed pipeline suggestion

551597d

surabhipatel-crest requested a review from thibaultkrebs January 8, 2025 05:32

Merge branch 'master' into orca-security-assets-v1.0.0

6f07e37

thibaultkrebs previously approved these changes Jan 13, 2025

View reviewed changes

urseberry requested a review from aliciascott January 29, 2025 19:32

aliciascott requested changes Jan 29, 2025

View reviewed changes

Resolved Readme review changes

00c7988

savandalasaniya-crest dismissed thibaultkrebs’s stale review via 00c7988 January 30, 2025 11:11

Kyle-Neale approved these changes Jan 30, 2025

View reviewed changes

temporal-github-worker-1 bot added the agent/approved label Jan 30, 2025

aliciascott approved these changes Jan 30, 2025

View reviewed changes

temporal-github-worker-1 bot added docs/approved and removed docs/requested-changes labels Jan 30, 2025

Wyrine requested a review from thibaultkrebs January 30, 2025 19:18

torosmassa requested a review from jnhunsberger January 30, 2025 19:39

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[INTPLAT-462] DDS: Orca Security: integration V1.0.0 #19164

[INTPLAT-462] DDS: Orca Security: integration V1.0.0 #19164

surabhipatel-crest commented Nov 29, 2024 •

edited

Loading

aliciascott commented Dec 5, 2024

aliciascott left a comment

aliciascott Dec 6, 2024

aliciascott Dec 6, 2024

aliciascott Dec 6, 2024

aliciascott Dec 6, 2024

aliciascott Dec 6, 2024

thibaultkrebs Jan 3, 2025

surabhipatel-crest Jan 7, 2025

codecov bot commented Jan 3, 2025

thibaultkrebs left a comment

aliciascott left a comment

aliciascott Jan 29, 2025

aliciascott Jan 29, 2025

aliciascott Jan 29, 2025

savandalasaniya-crest commented Jan 30, 2025

aliciascott left a comment


		## Overview

		[Orca Security][1] a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like Real-time visibility, vulnerability management, workload protection, cloud security posture management, compliance management.

	[Orca Security][1] a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like Real-time visibility, vulnerability management, workload protection, cloud security posture management, compliance management.
	[Orca Security][1] is a cloud security platform that identifies, prioritizes, and remediates security risks and compliance. It provides features like real-time visibility, vulnerability management, workload protection, cloud security posture management, and compliance management.


		- Alert: Represents details such as the state of alert, account details, asset in which the alert was found, and more.

		The Orca Security integration seamlessly ingests the data of alert logs using the in-built integration of Orca with Datadog. Before ingestion of the data, it normalizes and enriches the logs, ensuring a consistent data format and enhancing information content for downstream processing and analysis. The integration provides insights into alert logs through the out-of-the-box dashboards.

	- API Key - Add API key of Datadog platform.
	- API Key - Add the API key of your Datadog platform.

	10. In the Define Results section, please enable Apply to Existing Alerts if existing alerts in the Orca Security platform need to be forwarded to Datadog or disable it to forward newly generated/updated alerts. (Note: As per Datadog Log Ingestion behavior, alerts updated older than 18 hours cannot be ingested to Datadog.)
	10. In the Define Results section, please enable Apply to Existing Alerts if existing alerts in the Orca Security platform need to be forwarded to Datadog, or disable it to forward newly generated/updated alerts.
	Note: Alerts that were updated more than 18 hours ago cannot be ingested into Datadog.

	11. In the SEIM/SOAR under the Define Results section, check the Datadog and select Logs as the datadog type.
	11. In the SIEM/SOAR section under the Define Results section, check Datadog and select Logs as the Datadog type.

	- Alert: Represents details such as the state of alert, account details, asset in which the alert was found, and more.
	- Alert: Includes information such as the alert state, account details, the asset where the alert was detected, and additional details.

	10. In the Define Results section, please enable Apply to Existing Alerts if existing alerts in the Orca Security platform need to be forwarded to Datadog, or disable it to forward newly generated/updated alerts.
	10. In the Define Results section, enable Apply to Existing Alerts if existing alerts in the Orca Security platform need to be forwarded to Datadog, or disable it to forward newly generated/updated alerts.

[INTPLAT-462] DDS: Orca Security: integration V1.0.0 #19164

Are you sure you want to change the base?

[INTPLAT-462] DDS: Orca Security: integration V1.0.0 #19164

Conversation

surabhipatel-crest commented Nov 29, 2024 • edited Loading

What does this PR do?

Additional Notes

Review checklist (to be filled by reviewers)

aliciascott commented Dec 5, 2024

aliciascott left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Jan 3, 2025

Codecov Report

thibaultkrebs left a comment

Choose a reason for hiding this comment

aliciascott left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

savandalasaniya-crest commented Jan 30, 2025

aliciascott left a comment

Choose a reason for hiding this comment

surabhipatel-crest commented Nov 29, 2024 •

edited

Loading