[SIEMINT-85] DDS: Trend Micro Vision One XDR: Crawler Integration v1.0.0 #18208

tirthrajchaudhari-crest · 2024-08-06T09:48:29Z

What does this PR do?

This is a initial release PR of Trend Micro Vision One XDR integration including all the required assets.

Additional Notes

Crawler code for this integration has been committed in its respective repo
Pipeline and Facet group created for this integration are available in our sandbox and would be shared separately with the required teams.
Samples for the pipeline review would also be shared separately with the required teams.
OOTB detection rules JSON would be shared separately with the required teams as a part of separate repository.
Since during the standard attribute remapping we are not preserving the source attributes as per suggested best practices, it would result in filters using these standard attributes populating the values of other integrations as well as per current Datadog behaviour
We have live data for Workbench Alerts, endpointActivity, and Detections from the OAT event type. However, for activities like cloudActivity, networkActivity, mobileActivity, containerActivity, emailActivity, and identityActivity, we do not have live data. Therefore, we have created data samples from the API documentation.

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Changelog entries must be created for modifications to shipped code
Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

buraizu · 2024-08-07T19:47:19Z

Thanks, created DOCS-8655 to review

cswatt

Just a few small edits

cswatt · 2024-08-08T21:01:47Z

trend_micro_vision_one_xdr/README.md

@@ -0,0 +1,65 @@
+## Overview
+
+[Trend Micro Vision One XDR][1] collects and automatically correlates data across multiple security layers - email, endpoint, server, cloud workload, and network. This allows for faster detection of threats and improved investigation and response times through security analysis.


Suggested change

[Trend Micro Vision One XDR][1] collects and automatically correlates data across multiple security layers - email, endpoint, server, cloud workload, and network. This allows for faster detection of threats and improved investigation and response times through security analysis.

[Trend Micro Vision One XDR][1] collects and automatically correlates data across multiple security layers: email, endpoint, server, cloud workload, and network. This allows for faster detection of threats and improved investigation and response times through security analysis.

cswatt · 2024-08-08T21:02:51Z

trend_micro_vision_one_xdr/README.md

+- Workbench Alerts
+- Observed Attack Techniques
+
+This integration seamlessly collects all the above listed logs, channeling them into Datadog for analysis. Leveraging the built-in logs pipeline, these logs are parsed and enriched, enabling effortless search and analysis. The integration provides insight into workbench alerts and observed attack techniques through the out-of-the-box dashboards.


Suggested change

This integration seamlessly collects all the above listed logs, channeling them into Datadog for analysis. Leveraging the built-in logs pipeline, these logs are parsed and enriched, enabling effortless search and analysis. The integration provides insight into workbench alerts and observed attack techniques through the out-of-the-box dashboards.

This integration collects all the above listed logs and sends them to Datadog for analysis. Datadog uses the built-in logs pipeline to parse and enrich these logs, enabling effortless search and analysis. The integration provides insight into workbench alerts and observed attack techniques through the out-of-the-box dashboards.

cswatt · 2024-08-08T21:03:37Z

trend_micro_vision_one_xdr/README.md

+## Data Collected
+
+### Logs
+The Trend Micro Vision One XDR integration collects and forwards Workbench Alerts and Observed Attack Techniques logs to Datadog.


Is there any setup required here?

We have added the setup configurations steps above. Can you please let us know the exact requirement here?

cswatt · 2024-08-08T21:10:22Z

..._vision_one_xdr/assets/dashboards/trend_micro_vision_one_xdr_observed_attack_techniques.json

+                        "id": 5872268233797356,
+                        "definition": {
+                            "type": "note",
+                            "content": "This dashboard offers a comprehensive view of detected attack patterns across various data sources, including network traffic, application logs, and endpoint activities. \n\nThis allows you to visualize and analyze attack techniques in real time, enhancing their ability to identify and respond to threats quickly. \n\nFor more information, see the [Trend Micro Vision One XDR Integration Documentation](https://docs.datadoghq.com/integrations/trend_micro_vision_one_xdr).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.\n",


Suggested change

"content": "This dashboard offers a comprehensive view of detected attack patterns across various data sources, including network traffic, application logs, and endpoint activities. \n\nThis allows you to visualize and analyze attack techniques in real time, enhancing their ability to identify and respond to threats quickly. \n\nFor more information, see the [Trend Micro Vision One XDR Integration Documentation](https://docs.datadoghq.com/integrations/trend_micro_vision_one_xdr).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations.\n",

"content": "This dashboard offers a comprehensive view of detected attack patterns across various data sources, including network traffic, application logs, and endpoint activities. \n\nThis allows you to visualize and analyze attack techniques in real time, enhancing your ability to identify and respond to threats quickly. \n\nFor more information, see the [Trend Micro Vision One XDR Integration Documentation](https://docs.datadoghq.com/integrations/trend_micro_vision_one_xdr).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify, and add widgets and visualizations.\n",

…into trend-micro-vision-one-xdr-assets-v1.0.0

…thub.com/bhargavnariyanicrest/integrations-core into trend-micro-vision-one-xdr-assets-v1.0.0

jnhunsberger

A couple small changes are needed to the tile copy.

jnhunsberger · 2024-09-03T16:11:55Z

trend_micro_vision_one_xdr/README.md


-### Installation
+- Workbench Alerts
+- Observed Attack Techniques


Please provide a description of what is contained in each endpoint

jnhunsberger · 2024-09-03T16:14:38Z

trend_micro_vision_one_xdr/README.md


-The trend-micro-vision-one-xdr check is included in the [Datadog Agent][2] package.
-No additional installation is needed on your server.
+This integration collects all the above listed logs and sends them to Datadog for analysis. Datadog uses the built-in logs pipeline to parse and enrich these logs, enabling effortless search and analysis. The integration provides insight into workbench alerts and observed attack techniques through the out-of-the-box dashboards.


Please add that we also offer out of the box detection rules for Ccloud SIEM customers.

jnhunsberger

Looks good!

apiazza-dd · 2024-09-23T14:51:41Z

trend_micro_vision_one_xdr/README.md


-### Installation
+- Workbench Alerts: This endpoint contains information about all the standalone alerts triggered by detection models.


[nit] Can we bold "Workbench Alerts "and "Observed Attack Techniques"

apiazza-dd · 2024-09-23T14:52:40Z

trend_micro_vision_one_xdr/README.md


-The trend-micro-vision-one-xdr check is included in the [Datadog Agent][2] package.
-No additional installation is needed on your server.
+This integration collects all the above listed logs and sends them to Datadog for analysis. Datadog uses the built-in logs pipeline to parse and enrich these logs, enabling effortless search and analysis. The integration provides insight into workbench alerts and observed attack techniques through the out-of-the-box dashboards. Also, This integration provides out of the box detection rules.


[nit] This integration collects logs from the sources listed above and sends them to Datadog for analysis with our Log Explorer and Cloud SIEM products

https://docs.datadoghq.com/logs/explorer/

https://www.datadoghq.com/product/cloud-siem/

apiazza-dd · 2024-09-23T14:53:23Z

trend_micro_vision_one_xdr/README.md

-!!! Add list of steps to set up this integration !!!
+#### Create API KEY from Trend Micro Vision One XDR
+
+1. On the Trend Vision One console, go to **Administration > API Keys** .


apiazza-dd · 2024-09-23T14:53:52Z

trend_micro_vision_one_xdr/README.md

+#### Create API KEY from Trend Micro Vision One XDR
+
+1. On the Trend Vision One console, go to **Administration > API Keys** .
+2. Generate a new authentication token. Click **Add API key**. Specify the settings of the new API key.


"Specify the settings of the new API key." > "Specify the settings of the new API key with the following:"

apiazza-dd · 2024-09-23T14:54:03Z

trend_micro_vision_one_xdr/README.md

+
+1. On the Trend Vision One console, go to **Administration > API Keys** .
+2. Generate a new authentication token. Click **Add API key**. Specify the settings of the new API key.
+    - Name: A meaningful name that can help you identify the API key


Please bold headings.

apiazza-dd · 2024-09-23T14:54:49Z

trend_micro_vision_one_xdr/README.md

+Configure the Datadog endpoint to forward Trend Micro Vision One XDR logs to Datadog.
+
+1. Navigate to `Trend Micro Vision One XDR`.
+2. Add your Trend Micro Vision One XDR credentials.


Can we be more specific about which credentials, are they admin credentials?

Updated message with more specific details

Add trend micro vision one xdr assets

7053b1e

datadog-agent-integrations-bot bot added documentation changelog/no-changelog qa/skip-qa Automatically skip this PR for the next QA labels Aug 6, 2024

tirthrajchaudhari-crest added 2 commits August 6, 2024 16:00

Add images and update readme

71c1c92

Add integration in labeler.yaml file

ddd1938

datadog-agent-integrations-bot bot added dev/testing dev/tooling labels Aug 6, 2024

tirthrajchaudhari-crest added 5 commits August 6, 2024 16:31

Update pipeline yaml

e2eb2c8

Add service in test yaml file

951398e

Update sample in test yaml file

f40499a

Update test yaml sample

e072c39

Update test results

947dfe2

tirthrajchaudhari-crest changed the title ~~Add trend micro vision one xdr assets~~ DDS: Trend Micro Vision One XDR with Assets Aug 6, 2024

tirthrajchaudhari-crest changed the title ~~DDS: Trend Micro Vision One XDR with Assets~~ DDS: Trend Micro Vision One XDR: Crawler integration v1.0.0 Aug 6, 2024

tirthrajchaudhari-crest changed the title ~~DDS: Trend Micro Vision One XDR: Crawler integration v1.0.0~~ DDS: Trend Micro Vision One XDR: Crawler Integration v1.0.0 Aug 6, 2024

Update dashboards

d140ea0

tirthrajchaudhari-crest marked this pull request as ready for review August 7, 2024 13:07

tirthrajchaudhari-crest requested review from a team as code owners August 7, 2024 13:07

datadog-agent-integrations-bot bot added team/agent-integrations team/documentation team/logs-backend labels Aug 7, 2024

buraizu added the editorial review Waiting on a more in-depth review from a docs team editor label Aug 7, 2024

Minor README change

261976c

cswatt reviewed Aug 8, 2024

View reviewed changes

Address review comments

6d80ffe

tirthrajchaudhari-crest requested a review from cswatt August 9, 2024 09:14

mathieu-charbonnel previously approved these changes Aug 16, 2024

View reviewed changes

tirthrajchaudhari-crest added 3 commits August 20, 2024 12:05

Resolve merge conflicts

bfbadaf

Merge branch 'master' of https://github.com/DataDog/integrations-core …

2fe687f

…into trend-micro-vision-one-xdr-assets-v1.0.0

Merge branch 'trend-micro-vision-one-xdr-assets-v1.0.0' of https://gi…

db4aef1

…thub.com/bhargavnariyanicrest/integrations-core into trend-micro-vision-one-xdr-assets-v1.0.0

tirthrajchaudhari-crest dismissed mathieu-charbonnel’s stale review via db4aef1 August 20, 2024 06:41

tirthrajchaudhari-crest requested a review from a team as a code owner August 20, 2024 06:41

datadog-agent-integrations-bot bot added integration/trend_micro_vision_one_xdr team/saas-integrations labels Aug 20, 2024

tirthrajchaudhari-crest added 2 commits August 21, 2024 10:44

Revert app_uuid to it's original value in manifest

fa87545

Update display_on_public_website to false in manifest

f6dd080

jnhunsberger requested changes Sep 3, 2024

View reviewed changes

Address review comments

a09dd09

tirthrajchaudhari-crest requested a review from jnhunsberger September 4, 2024 05:58

jnhunsberger previously approved these changes Sep 23, 2024

View reviewed changes

apiazza-dd reviewed Sep 23, 2024

View reviewed changes

BoyangHuang previously approved these changes Sep 23, 2024

View reviewed changes

apiazza-dd reviewed Sep 23, 2024

View reviewed changes

apiazza-dd previously approved these changes Sep 23, 2024

View reviewed changes

mathieu-charbonnel self-requested a review September 23, 2024 17:59

mathieu-charbonnel previously approved these changes Sep 23, 2024

View reviewed changes

Address review comments

e047aec

tirthrajchaudhari-crest dismissed stale reviews from mathieu-charbonnel, apiazza-dd, BoyangHuang, and jnhunsberger via e047aec September 24, 2024 05:31

tirthrajchaudhari-crest requested a review from apiazza-dd September 24, 2024 05:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[SIEMINT-85] DDS: Trend Micro Vision One XDR: Crawler Integration v1.0.0 #18208

[SIEMINT-85] DDS: Trend Micro Vision One XDR: Crawler Integration v1.0.0 #18208

tirthrajchaudhari-crest commented Aug 6, 2024 •

edited

Loading

buraizu commented Aug 7, 2024

cswatt left a comment

cswatt Aug 8, 2024

tirthrajchaudhari-crest Aug 9, 2024

cswatt Aug 8, 2024

tirthrajchaudhari-crest Aug 9, 2024

cswatt Aug 8, 2024

tirthrajchaudhari-crest Aug 9, 2024

cswatt Aug 8, 2024

tirthrajchaudhari-crest Aug 9, 2024

jnhunsberger left a comment

jnhunsberger Sep 3, 2024

tirthrajchaudhari-crest Sep 4, 2024

jnhunsberger Sep 3, 2024

tirthrajchaudhari-crest Sep 4, 2024

jnhunsberger left a comment

apiazza-dd Sep 23, 2024

tirthrajchaudhari-crest Sep 24, 2024

apiazza-dd Sep 23, 2024 •

edited

Loading

tirthrajchaudhari-crest Sep 24, 2024

apiazza-dd Sep 23, 2024

tirthrajchaudhari-crest Sep 24, 2024

apiazza-dd Sep 23, 2024

tirthrajchaudhari-crest Sep 24, 2024

apiazza-dd Sep 23, 2024

tirthrajchaudhari-crest Sep 24, 2024

apiazza-dd Sep 23, 2024

tirthrajchaudhari-crest Sep 24, 2024

		@@ -0,0 +1,65 @@
		## Overview

		[Trend Micro Vision One XDR][1] collects and automatically correlates data across multiple security layers - email, endpoint, server, cloud workload, and network. This allows for faster detection of threats and improved investigation and response times through security analysis.

	This integration seamlessly collects all the above listed logs, channeling them into Datadog for analysis. Leveraging the built-in logs pipeline, these logs are parsed and enriched, enabling effortless search and analysis. The integration provides insight into workbench alerts and observed attack techniques through the out-of-the-box dashboards.
	This integration collects all the above listed logs and sends them to Datadog for analysis. Datadog uses the built-in logs pipeline to parse and enrich these logs, enabling effortless search and analysis. The integration provides insight into workbench alerts and observed attack techniques through the out-of-the-box dashboards.


		### Installation
		- Workbench Alerts: This endpoint contains information about all the standalone alerts triggered by detection models.

[SIEMINT-85] DDS: Trend Micro Vision One XDR: Crawler Integration v1.0.0 #18208

Are you sure you want to change the base?

[SIEMINT-85] DDS: Trend Micro Vision One XDR: Crawler Integration v1.0.0 #18208

Conversation

tirthrajchaudhari-crest commented Aug 6, 2024 • edited Loading

What does this PR do?

Additional Notes

Review checklist (to be filled by reviewers)

buraizu commented Aug 7, 2024

cswatt left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jnhunsberger left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jnhunsberger left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

apiazza-dd Sep 23, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

tirthrajchaudhari-crest commented Aug 6, 2024 •

edited

Loading

apiazza-dd Sep 23, 2024 •

edited

Loading