Merge pull request #1342 from SEKOIA-IO/add/stormshield_endpoint

StormShield SES documentation

docs/xdr/features/collect/integrations/endpoint/stormshield_endpoint.md

@@ -0,0 +1,60 @@
+uuid: f5e6cf5e-bd9f-4caf-9098-fe4a9e0aeaa0
+name: Stormshield SES
+type: intake
+
+## Overview
+
+Stormshield SES is a comprehensive cybersecurity solution designed to protect individual devices, such as computers and servers, from various cyber threats and attacks. It encompasses advanced features like antivirus, firewall, intrusion detection and prevention, application control, and data encryption. This solution aims to safeguard endpoints from malware, ransomware, phishing, and other malicious activities, while providing centralized management and real-time threat visibility for enhanced security posture.
+
+!!! warning
+    Important note - This format is currently in beta. We highly value your feedback to improve its performance.
+
+{!_shared_content/operations_center/detection/generated/suggested_rules_f5e6cf5e-bd9f-4caf-9098-fe4a9e0aeaa0_do_not_edit_manually.md!}
+
+{!_shared_content/operations_center/integrations/generated/f5e6cf5e-bd9f-4caf-9098-fe4a9e0aeaa0.md!}
+
+## Configure
+
+This section will guide you to forward Stormshield SES logs to SEKOIA.IO
+
+### Create the intake
+
+Go to the [intake page](https://app.sekoia.io/operations/intakes) and create a new intake from the format Stormshield Endpoint Security.
+
+### Configure the Agent handler
+
+1. Log on out Stormshield SES console
+2. Go to `Backoffice > Agent handlers`
+3. Select an Agent handler group or create a new one
+4. On the Agent handler group, in the `Syslog servers`, click `+ Add a server`
+   ![Agent handlers](/assets/operation_center/integration_catalog/endpoint/stormshield/stormshield_ses_01.png){: style="max-width:100%"} 
+5. In the syslog server configuration:
+
+   1. Set the address of the syslog destination to `intake.sekoia.io`
+   2. Select `TCP/TLS` as the protocol
+   3. Define the syslog destination port to 10514
+   4. Select `Raw Json` as message Content
+   5. Select `Non-Transparent-Framing` as transfert-type
+   6. In the `Structured data` input, add `[SEKOIA@53288 intake_key="<YOUR_INTAKE_KEY>"]` with our intake key as replacement of the placeholder
+   7. Save the configuration
+   ![Configuration](/assets/operation_center/integration_catalog/endpoint/stormshield/stormshield_ses_02.png){: style="max-width:100%"} 
+
+## Troubleshooting
+
+### The SES Agent handler cannot authenticate the Sekoia.io syslog endpoint
+
+The Sekoia.io syslog endpoint is secured with a [Letsencrypt](https://letsencrypt.org) certificate.
+
+According to our SES Agent handler installation, it may be necessary to install `ISRG ROOT X1` certificate in our **trusted root certification authorities certificate store**:
+
+On the SES Agent handler machines: 
+
+1. Download the `ISRG ROOT X1` certificate: <https://letsencrypt.org/certs/isrgrootx1.pem>
+2. Rename the downloaded certificate by suffixing it with the extension`.crt`
+3. Import the certificate in the trusted root certification authorities certificate store of the machine
+   ![Certificate store](/assets/operation_center/integration_catalog/endpoint/stormshield/stormshield_ses_03.png){: style="max-width:100%"} 
+
+
+## Further Readings
+
+You can read all documentation [here](https://documentation.stormshield.eu/SES/v7.2/en/Content/PDF/ses-en-administration_guide-v7.2.pdf)

mkdocs.yml

@@ -163,6 +163,7 @@ nav:
           - SentinelOne Cloud Funnel 1.0 [Deprecated]: xdr/features/collect/integrations/endpoint/sentinelone_deepvisibility.md
           - SentinelOne Cloud Funnel 2.0: xdr/features/collect/integrations/endpoint/sentinelone_cloudfunnel2.0.md
           - Sophos EDR: xdr/features/collect/integrations/endpoint/sophos_edr.md
+          - Stormshield Endpoint Security: xdr/features/collect/integrations/endpoint/stormshield_endpoint.md
           - Symantec/Broadcom Endpoint Security: xdr/features/collect/integrations/endpoint/symantec_epp.md
           - Tanium: xdr/features/collect/integrations/endpoint/tanium.md
           - TEHTRIS EDR: xdr/features/collect/integrations/endpoint/tehtris_edr.md
@@ -588,6 +589,7 @@ plugins:
       integrations/spamassassin.md: xdr/features/collect/integrations/email/spamassassin.md
       integrations/squid.md: xdr/features/collect/integrations/network/squid.md
       integrations/stormshield_network_security.md: xdr/features/collect/integrations/network/stormshield_network_security.md
+      integrations/stormshield_endpoint.md: xdr/features/collect/integrations/network/stormshield_endpoint.md
       integrations/suricata.md: xdr/features/collect/integrations/network/suricata.md
       integrations/symantec-endpoint-protection.md: xdr/features/collect/integrations/endpoint/symantec_epp.md
       integrations/symantec_endpoint_protection.md: xdr/features/collect/integrations/endpoint/symantec_epp.md