Skip to content

Commit 0063d9b

Browse files
surabhipatel-crestestherk15
surabhipatel-crest
and
estherk15
authored
[AI-5112] DDS: Delinea Secret Server v1.0.0 (#19857)
* Add delinea secret server integration * Updated file name of changelog.d * Fixed pipeline suggestion for changelog.md * Fixed pipeline error for filename * Fixed pipeline suggestion for facets * Added suggested sample result * Fixed pipeline suggestion * Updated dashboard and images * fixed pipeline suggestion * Updated Readme * Update delinea_secret_server/README.md Co-authored-by: Esther Kim <esther.kim@datadoghq.com> * Updated README.md Co-authored-by: Esther Kim <esther.kim@datadoghq.com> * Update delinea_secret_server/README.md Co-authored-by: Esther Kim <esther.kim@datadoghq.com> * Updated dashboard and log pipeline * Made minor change in log pipeline * Updated SIEM panels --------- Co-authored-by: Esther Kim <esther.kim@datadoghq.com>
1 parent 32f385a commit 0063d9b

19 files changed

+7631
-0
lines changed

‎.github/workflows/config/labeler.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,8 @@ integration/dcgm:
176176
- dcgm/**/*
177177
integration/delinea_privilege_manager:
178178
- delinea_privilege_manager/**/*
179+
integration/delinea_secret_server:
180+
- delinea_secret_server/**/*
179181
integration/directory:
180182
- directory/**/*
181183
integration/disk:

‎delinea_secret_server/CHANGELOG.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
# CHANGELOG - delinea_secret_server
2+
3+
<!-- towncrier release notes start -->

‎delinea_secret_server/README.md

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,144 @@
1+
## Overview
2+
3+
[Delinea Secret Server][4] is an enterprise-grade password management solution designed to help organizations securely store, manage, and control access to privileged credentials. It aims to improve the security of sensitive data, reduce the risk of data breaches, and streamline the password management process.
4+
5+
This integration enriches and ingests the following logs:
6+
7+
- **Secret Server Logs**: Represents an event where a user performs an action (such as viewing, adding, or modifying) on a stored secret, folder, group, or user. It provides details including the user's identity, the source of the action, and the item the action was performed.
8+
9+
After it collects the logs, Delinea Secret Server channels them into Datadog for analysis. Using the built-in logs pipeline, these logs are parsed and enriched, allowing for effortless search and analysis. The integration provides insights into secret server logs through out-of-the-box dashboards and includes ready-to-use Cloud SIEM detection rules for improved monitoring and security.
10+
11+
## Setup
12+
13+
### Installation
14+
15+
To install the Delinea Secret Server integration, run the following Agent installation command and the following steps. For more information, see the [Integration Management][5] documentation.
16+
17+
**Note**: This step is not necessary for Agent version >= 7.65.0.
18+
19+
Linux command:
20+
21+
```shell
22+
sudo -u dd-agent -- datadog-agent integration install datadog-delinea-secret-server==1.0.0
23+
```
24+
25+
### Configuration
26+
27+
#### Log collection
28+
29+
1. Collecting logs is disabled by default in the Datadog Agent. Enable it in the `datadog.yaml` file:
30+
31+
```yaml
32+
logs_enabled: true
33+
```
34+
35+
2. Add this configuration block to your `delinea_secret_server.d/conf.yaml` file to start collecting your Delinea Secret Server logs.
36+
37+
```yaml
38+
logs:
39+
- type: tcp/udp
40+
port: <PORT>
41+
source: delinea-secret-server
42+
service: delinea-secret-server
43+
```
44+
45+
For available configuration options, see the [sample delinea_secret_server.d/conf.yaml][7]. Choose the appropriate protocol (either TCP or UDP) based on your Delinea Secret Server syslog forwarding configuration.
46+
47+
**Note**: Do not change the service and source values, as these parameters are integral to the pipeline's operation.
48+
49+
3. [Restart the Agent][1].
50+
51+
#### Configure syslog message forwarding from Delinea Secret Server
52+
53+
1. Log in to the **Delinea Secret Server** platform.
54+
2. Navigate to **Settings** > **All Settings**.
55+
3. Navigate to **Configuration** > **General** > **Application**.
56+
4. Click **Edit**.
57+
5. Check **Enable Syslog/CEF Log Output**.
58+
6. Fill out the following information:
59+
60+
- **Syslog/CEF Server**: Enter Syslog/CEF Server Address.
61+
- **Syslog/CEF Port**: Enter Syslog/CEF Server Port.
62+
- **Syslog/CEF Protocol**: Select TCP or UDP.
63+
- **Syslog/CEF Time Zone**: Select UTC Time.
64+
- **Syslog/CEF DateTime Format**: Select ISO 8601.
65+
- **Syslog/CEF Site**: Select the site that the CEF/Syslogs will run on.
66+
67+
7. Click **Save**.
68+
69+
### Validation
70+
71+
[Run the Agent's status subcommand][2] and look for `delinea_secret_server` under the Checks section.
72+
73+
## Data Collected
74+
75+
### Logs
76+
77+
The Delinea Secret Server integration collects Secret Server Logs.
78+
79+
### Metrics
80+
81+
The Delinea Secret Server integration does not include any metrics.
82+
83+
### Events
84+
85+
The Delinea Secret Server integration does not include any events.
86+
87+
### Service Checks
88+
89+
The Delinea Secret Server integration does not include any service checks.
90+
91+
## Troubleshooting
92+
93+
### Permission denied while port binding
94+
95+
If you see a **Permission denied** error while port binding in the Agent logs, see the following instructions:
96+
97+
1. Binding to a port number under 1024 requires elevated permissions. Grant access to the port using the `setcap` command:
98+
99+
- Grant access to the port using the `setcap` command:
100+
101+
```shell
102+
sudo setcap CAP_NET_BIND_SERVICE=+ep /opt/datadog-agent/bin/agent/agent
103+
```
104+
105+
- Verify the setup is correct by running the `getcap` command:
106+
107+
```shell
108+
sudo getcap /opt/datadog-agent/bin/agent/agent
109+
```
110+
111+
With the expected output:
112+
113+
```shell
114+
/opt/datadog-agent/bin/agent/agent = cap_net_bind_service+ep
115+
```
116+
117+
**Note**: Re-run this `setcap` command every time you upgrade the Agent.
118+
119+
2. [Restart the Agent][1].
120+
121+
### Data is not being collected
122+
123+
Make sure that traffic is bypassed from the configured port if the firewall is enabled.
124+
125+
### Port already in use
126+
127+
If you see the **Port <PORT-NO\> Already in Use** error, see the following instructions. The example below is for PORT-NO = 514:
128+
129+
On systems using Syslog, if the Agent listens for Delinea Secret Server logs on port 514, the following error can appear in the Agent logs: `Can't start UDP forwarder on port 514: listen udp :514: bind: address already in use`.
130+
131+
By default, Syslog listens on port 514. To resolve this error, take **one** of the following steps:
132+
133+
- Disable Syslog.
134+
- Configure the Agent to listen on a different, available port.
135+
136+
Need help? Contact [Datadog support][3].
137+
138+
[1]: https://docs.datadoghq.com/agent/guide/agent-commands/#start-stop-and-restart-the-agent
139+
[2]: https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information
140+
[3]: https://docs.datadoghq.com/help/
141+
[4]: https://delinea.com/products/secret-server
142+
[5]: https://docs.datadoghq.com/agent/guide/integration-management/?tab=linux#install
143+
[6]: https://docs.delinea.com/online-help/secret-server/start.htm
144+
[7]: https://github.com/DataDog/integrations-core/blob/master/delinea_secret_server/datadog_checks/delinea_secret_server/data/conf.yaml.example

‎delinea_secret_server/assets/configuration/spec.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: Delinea Secret Server
2+
files:
3+
- name: delinea_secret_server.yaml
4+
options:
5+
- template: logs
6+
example:
7+
- type: tcp/udp
8+
port: <PORT>
9+
source: delinea-secret-server
10+
service: delinea-secret-server

0 commit comments

Comments
 (0)