Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[INTPLAT-467] DDS: Bitdefender Integration v1.0.0. #19037

Open
wants to merge 18 commits into
base: master
Choose a base branch
from

Conversation

madhavpandya-crest
Copy link
Contributor

What does this PR do?

PR for a new integration Bitdefender 1.0.0

Additional Notes

-- OOTB detection rules JSON would be shared separately with the required teams as a part of separate repository .
-- Since during the standard attribute remapping we are not preserving the source attributes as per suggested best practices, it would result in filters using these standard attributes populating the values of other integrations as well as per current datadog behavior.

Review checklist (to be filled by reviewers)

  • Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
  • Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
  • If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

Copy link
Contributor

@janine-c janine-c left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey there, I went through and made some suggestions for readability and to fix some typos. You might also want to update the file names that say phising instead of phishing if that matters to you :) Happy to re-review or answer questions as needed!


***Added***:

* Initial Release
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
* Initial Release
* Initial release

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an automatically generated file.

@@ -0,0 +1,97 @@
# Bitdefender Integration For Datadog
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
# Bitdefender Integration For Datadog
# Bitdefender integration for Datadog

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated as Suggested.


## Overview

[Bitdefender][1] provides cybersecurity solutions with leading security efficacy, performance and ease of use to small and medium businesses, mid-market enterprises and consumers. Bitdefender EDR effectively stops ransomware and breaches with automated cross-endpoint correlation and seamlessly integrated prevention, protection, detection and response.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
[Bitdefender][1] provides cybersecurity solutions with leading security efficacy, performance and ease of use to small and medium businesses, mid-market enterprises and consumers. Bitdefender EDR effectively stops ransomware and breaches with automated cross-endpoint correlation and seamlessly integrated prevention, protection, detection and response.
[Bitdefender][1] provides cybersecurity solutions with leading security efficacy, performance, and ease of use to small and medium businesses, mid-market enterprises, and consumers. Bitdefender EDR effectively stops ransomware and breaches with automated cross-endpoint correlation and seamlessly integrated prevention, protection, detection, and response.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated as Suggested.

Comment on lines 7 to 22
The Bitdefender integration utilizes a webhook to ingest Bitdefender EDR logs. Following are the event types for which integration provides OOTB dashboards and detection rules:

- **Antiphishing:** This event is generated each time the endpoint agent detects a known phishing attempt when accessing a web page.
- **Antimalware:** This event is generated each time Bitdefender detects malware on an endpoint in your network.
- **Advanced Threat Control (ATC):** This event is created whenever a potentially dangerous applications is detected and blocked on an endpoint.
- **Data Protection:** This event is generated each time the data traffic is blocked on an endpoint, according to data protection rules.
- **Exchange Malware Detection:** This event is created when Bitdefender detects malware on an Exchange server in your network.
- **Firewall:** This event is generated when the endpoint agent blocks a port scan or an application from accessing the network, according to the applied policy.
- **Hyper Detect event:** This event is generated when a malware is detected by the Hyper Detect module.
- **Sandbox Analyzer Detection:** This event is generated each time Sandbox Analyzer detects a new threat among the submitted files.
- **Antiexploit Event:** This event is generated when Advanced Anti-Exploit triggers a detection.
- **Network Attack Defense Event:** This event is generated when the Network Attack Defense module triggers a detection.
- **User Control/Content Control:** This event is generated when a user activity such as web browsing of software application is blocked on the endpoint according to the applied policy.
- **Storage Antimalware Event:** This event is generated each time SVA detects a new threat among the protected storage (NAS).
- **Ransomware activity detection:** This event occurs when the endpoint agent blocks ransomware attack.
- **New Incident:** This event is generated every time a new Root Cause Analysis (RCA) is displayed under the Incidents section of Control Center. The event contains a list of relevant items extracted from the RCA JSON.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
The Bitdefender integration utilizes a webhook to ingest Bitdefender EDR logs. Following are the event types for which integration provides OOTB dashboards and detection rules:
- **Antiphishing:** This event is generated each time the endpoint agent detects a known phishing attempt when accessing a web page.
- **Antimalware:** This event is generated each time Bitdefender detects malware on an endpoint in your network.
- **Advanced Threat Control (ATC):** This event is created whenever a potentially dangerous applications is detected and blocked on an endpoint.
- **Data Protection:** This event is generated each time the data traffic is blocked on an endpoint, according to data protection rules.
- **Exchange Malware Detection:** This event is created when Bitdefender detects malware on an Exchange server in your network.
- **Firewall:** This event is generated when the endpoint agent blocks a port scan or an application from accessing the network, according to the applied policy.
- **Hyper Detect event:** This event is generated when a malware is detected by the Hyper Detect module.
- **Sandbox Analyzer Detection:** This event is generated each time Sandbox Analyzer detects a new threat among the submitted files.
- **Antiexploit Event:** This event is generated when Advanced Anti-Exploit triggers a detection.
- **Network Attack Defense Event:** This event is generated when the Network Attack Defense module triggers a detection.
- **User Control/Content Control:** This event is generated when a user activity such as web browsing of software application is blocked on the endpoint according to the applied policy.
- **Storage Antimalware Event:** This event is generated each time SVA detects a new threat among the protected storage (NAS).
- **Ransomware activity detection:** This event occurs when the endpoint agent blocks ransomware attack.
- **New Incident:** This event is generated every time a new Root Cause Analysis (RCA) is displayed under the Incidents section of Control Center. The event contains a list of relevant items extracted from the RCA JSON.
The Bitdefender integration uses a webhook to ingest Bitdefender EDR logs. The integration provides OOTB dashboards and detection rules for the following event types:
| Event | Trigger |
|-------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Antiphishing | Endpoint agent detects a known phishing attempt when accessing a web page |
| Antimalware | Bitdefender detects malware on an endpoint in your network |
| Advanced Threat Control (ATC) | Potentially dangerous application is detected and blocked on an endpoint |
| Data Protection | Data traffic is blocked on an endpoint, according to data protection rules |
| Exchange Malware Detection | Bitdefender detects malware on an Exchange server in your network |
| Firewall | Endpoint agent blocks a port scan or an application from accessing the network, according to the applied policy |
| Hyper Detect event | Hyper Detect module detects malware |
| Sandbox Analyzer Detection | Sandbox Analyzer detects a new threat among the submitted files |
| Antiexploit Event | Advanced Anti-Exploit triggers a detection |
| Network Attack Defense Event | Network Attack Defense module triggers a detection |
| User Control/Content Control | User activity, such as web browsing of software application, is blocked on the endpoint according to the applied policy |
| Storage Antimalware Event | SVA detects a new threat among the protected storage (NAS) |
| Ransomware activity detection | Endpoint agent blocks ransomware attack |
| New Incident | New Root Cause Analysis (RCA) is displayed under the Incidents section of Control Center. The event contains a list of relevant items extracted from the RCA JSON |

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated as Suggested.

Comment on lines 26 to 30
### Configuration

#### Bitdefender Configuration

##### Steps to Create API Key on Bitdefender Business Security Enterprise Portal:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
### Configuration
#### Bitdefender Configuration
##### Steps to Create API Key on Bitdefender Business Security Enterprise Portal:
### Create a Bitdefender API Key

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated as Suggested.

"id": 2723456080788240,
"definition": {
"type": "note",
"content": "**Dashboard Overview**\n\n- Bitdefender Ransomware Activity Detection Event Details dashboard provides insights about detected ransomware.\n\nFor more information, see the [Bitdefender Integration Documentation](https://docs.datadoghq.com/integrations/bitdefender/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations. ",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"content": "**Dashboard Overview**\n\n- Bitdefender Ransomware Activity Detection Event Details dashboard provides insights about detected ransomware.\n\nFor more information, see the [Bitdefender Integration Documentation](https://docs.datadoghq.com/integrations/bitdefender/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations. ",
"content": "**Dashboard Overview**\n\nThe Bitdefender Ransomware Activity Detection Event Details dashboard provides insights about detected ransomware.\n\nFor more information, see the [Bitdefender Integration Documentation](https://docs.datadoghq.com/integrations/bitdefender/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify, and add widgets and visualizations.",

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated as Suggested.

@@ -0,0 +1,576 @@
{
"title": "Bitdefender - User Control Event Details",
"description": "Bitdefender User Control Event Details dashboard provides insights about blocked user activity on the endpoint according to the applied policy.",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"description": "Bitdefender User Control Event Details dashboard provides insights about blocked user activity on the endpoint according to the applied policy.",
"description": "The Bitdefender User Control Event Details dashboard provides insights about endpoint user activity that has been blocked according to your applied policy.",

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated as Suggested.

"id": 6106324979267452,
"definition": {
"type": "note",
"content": "**Dashboard Overview**\n\n- Bitdefender User Control Event Details dashboard provides insights about blocked user activity on the endpoint according to the applied policy.\n\nFor more information, see the [Bitdefender Integration Documentation](https://docs.datadoghq.com/integrations/bitdefender/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations. ",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"content": "**Dashboard Overview**\n\n- Bitdefender User Control Event Details dashboard provides insights about blocked user activity on the endpoint according to the applied policy.\n\nFor more information, see the [Bitdefender Integration Documentation](https://docs.datadoghq.com/integrations/bitdefender/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify and add widgets and visualizations. ",
"content": "**Dashboard Overview**\n\nThe Bitdefender User Control Event Details dashboard provides insights about endpoint user activity that has been blocked according to your applied policy.\n\nFor more information, see the [Bitdefender Integration Documentation](https://docs.datadoghq.com/integrations/bitdefender/).\n\n**Tips**\n- Use the timeframe selector in the top right of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify, and add widgets and visualizations.",

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated as Suggested.

"configuration": "README.md#Setup",
"support": "README.md#Support",
"changelog": "CHANGELOG.md",
"description": "Provides overall insights of the bitdefender logs generated by bitdefender agent",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"description": "Provides overall insights of the bitdefender logs generated by bitdefender agent",
"description": "Provides insights about the logs Bitdefender Agent generated.",

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated as Suggested.

"id": 161897206113872,
"definition": {
"type": "note",
"content": "Datadog Cloud SIEM analyzes and correlates Bitdefender logs to detect threats to your environment in real time. If you don't see signals please make sure you've enabled [Datadog Cloud SIEM](/security). ",
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
"content": "Datadog Cloud SIEM analyzes and correlates Bitdefender logs to detect threats to your environment in real time. If you don't see signals please make sure you've enabled [Datadog Cloud SIEM](/security). ",
"content": "Datadog Cloud SIEM analyzes Bitdefender logs to detect threats to your environment in real time. If you don't see signals, please make sure you've enabled [Datadog Cloud SIEM](/security).",

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated as Suggested.

@BoyangHuang BoyangHuang added assets/deploy-logs-staging ONLY USED BY Logs Backend - Validates that a PR is OK to go to staging and removed assets/deploy-logs-staging ONLY USED BY Logs Backend - Validates that a PR is OK to go to staging labels Dec 18, 2024
preserveSource: false
overrideOnConflict: false
- type: pipeline
name: Processing of Netwrok Attack Defense logs
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can't make a suggestion for some reason, but "Netwrok" should be "Network" here

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

BoyangHuang
BoyangHuang previously approved these changes Jan 3, 2025
Copy link

@jnhunsberger jnhunsberger left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Dashboards need to not use URLs for images not hosted on Datadog servers. "https://fieldtrust.be/wp-content/uploads/2023/09/Bitdefender_Masterbrand_Logo_Positive-1-1024x236.png"

@ankitarajput-crest
Copy link
Contributor

Dashboards need to not use URLs for images not hosted on Datadog servers. "https://fieldtrust.be/wp-content/uploads/2023/09/Bitdefender_Masterbrand_Logo_Positive-1-1024x236.png"

@jnhunsberger Let us check and get back to you.

Copy link
Contributor

@Wyrine Wyrine left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please add the codeowners file

@manan-crest manan-crest requested a review from a team as a code owner February 13, 2025 09:39
@temporal-github-worker-1 temporal-github-worker-1 bot dismissed BoyangHuang’s stale review February 13, 2025 09:39

Review from BoyangHuang is dismissed.
Related teams and files:

  • saas-integrations
    • .github/workflows/config/labeler.yml
@manan-crest
Copy link
Contributor

please add the codeowners file

Sure, We have added the CODEOWNERS file

@manan-crest
Copy link
Contributor

Dashboards need to not use URLs for images not hosted on Datadog servers. "https://fieldtrust.be/wp-content/uploads/2023/09/Bitdefender_Masterbrand_Logo_Positive-1-1024x236.png"

Hello @jnhunsberger,

As per the conversation going on in slack(https://crestdatasystems.slack.com/archives/C067GU53VEW/p1739186736156249), we will keep using external links for now. Datadog team will soon find a better way for this.

Copy link
Contributor

@Wyrine Wyrine left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thank you

@Wyrine
Copy link
Contributor

Wyrine commented Feb 19, 2025

@madhavpandya-crest please fix the conflicts

BoyangHuang
BoyangHuang previously approved these changes Feb 19, 2025
@temporal-github-worker-1 temporal-github-worker-1 bot dismissed BoyangHuang’s stale review February 20, 2025 05:08

Review from BoyangHuang is dismissed.
Related teams and files:

  • saas-integrations
    • .github/CODEOWNERS
    • .github/workflows/config/labeler.yml
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

8 participants