Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[SIEMINT-118] DDS: Trellix Endpoint Security: Crawler Integration v1.0.0 #18673

Open
wants to merge 14 commits into
base: master
Choose a base branch
from

Conversation

shubhamvekariya-crest
Copy link
Contributor

What does this PR do?

This is a initial release PR of Trellix Endpoint Security integration including all the required assets.

Additional Notes

  • Crawler code for this integration has been committed in its respective repo
  • Pipeline and Facet group created for this integration are available in our sandbox and would be shared separately with the required teams.
  • Samples for the pipeline review would also be shared separately with the required teams.
  • OOTB detection rules JSON would be shared separately with the required teams as a part of separate repository.
  • Since during the standard attribute remapping we are not preserving the source attributes as per suggested best practices, it would result in filters using these standard attributes populating the values of other integrations as well as per current Datadog behaviour.

Review checklist (to be filled by reviewers)

  • Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
  • Changelog entries must be created for modifications to shipped code
  • Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
  • If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

brett0000FF
brett0000FF previously approved these changes Sep 27, 2024
#### Get Credentials of Trellix Endpoint Security

1. Log in to the Trellix ePO Saas.
2. Navigate to the **Trellix Developer Portal** using [this][2] link.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
2. Navigate to the **Trellix Developer Portal** using [this][2] link.
2. Navigate to the **[Trellix Developer Portal][2]**.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

- **Method Types**: Select **GET**.
5. Click **Request** to submit the request. It typically takes 2-3 days to process. You will be notified once your credentials are ready.
6. When your credentials are available, generate your Client credentials by clicking **Generate** under **Create Client Credentials**.
7. Copy and securely store the API key from **Access Management**, along with the Client ID and Client Secret from **Create Client Credentials**.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
7. Copy and securely store the API key from **Access Management**, along with the Client ID and Client Secret from **Create Client Credentials**.
7. Copy and securely store the API key from **Access Management**, along with the Client ID and Client Secret, from **Create Client Credentials**.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

!!! Add steps to validate integration is functioning as expected !!!
Configure the Datadog endpoint to forward Trellix Endpoint Security logs to Datadog.

1. Navigate to `Trellix Endpoint Security`.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
1. Navigate to `Trellix Endpoint Security`.
1. Navigate to **Trellix Endpoint Security**.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done.

brett0000FF
brett0000FF previously approved these changes Sep 30, 2024
@dj0well dj0well changed the title DDS: Trellix Endpoint Security: Crawler Integration v1.0.0 [SIEMINT-118] DDS: Trellix Endpoint Security: Crawler Integration v1.0.0 Oct 2, 2024
@dj0well dj0well requested a review from a team October 2, 2024 11:01
@mathieu-charbonnel mathieu-charbonnel added the assets/deploy-logs-staging ONLY USED BY Logs Backend - Validates that a PR is OK to go to staging label Oct 28, 2024
@nathanmadams
Copy link
Contributor

@jnhunsberger looks like this one just needs product sign-off

@nathanmadams nathanmadams removed the request for review from a team November 21, 2024 14:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants