Skip to content

Commit 9d7327c

Browse files
shubhamvekariya-crestshubhamvekariya-crest
authored
[AI-5069] DDS: Juniper SRX Firewall Integration v1.0.0 (#19749)
* Added juniper srx firewall integration * Resolve CI Failure * Resolve CI Failure * Update dashboard and pipeline * Update dashboard and readme * Update overview dashboard * Address review comments * Remove service checks * Review address comments * Address review comments * Update anchors link to full url * Update dashboard query * Update Cloud SIEM Panels
1 parent 0063d9b commit 9d7327c

22 files changed

+12970
-0
lines changed

‎.github/workflows/config/labeler.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -316,6 +316,8 @@ integration/jmeter:
316316
- jmeter/**/*
317317
integration/journald:
318318
- journald/**/*
319+
integration/juniper_srx_firewall:
320+
- juniper_srx_firewall/**/*
319321
integration/kafka:
320322
- kafka/**/*
321323
integration/kafka_consumer:

‎juniper_srx_firewall/CHANGELOG.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# CHANGELOG - juniper_srx_firewall
2+
3+
<!-- towncrier release notes start -->
4+

‎juniper_srx_firewall/README.md

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
## Overview
2+
3+
[Juniper SRX Firewall][3] secures your network edge, data center, and cloud applications by detecting and mitigating intrusions, malware, and other threats.
4+
5+
This integration parses the following log types:
6+
7+
- **Session Logs**: Track network traffic and session activities, including initiated and denied sessions, application-related traffic, and dropped packets.
8+
- **Security Logs**: Monitor security events such as malware detections, intrusion attempts, DoS attacks, and content filtering activities.
9+
- **Authentication Logs**: Capture authentication activities, including successful and failed login attempts.
10+
11+
Get detailed visibility into these logs with out-of-the-box dashboards, and strengthen security with prebuilt Cloud SIEM detection rules for proactive threat monitoring and response.
12+
13+
## Setup
14+
15+
### Installation
16+
17+
To install the Juniper SRX Firewall integration, run the following Agent installation command in your terminal. For more information, see the [Integration Management][4] documentation.
18+
19+
**Note**: This step is not necessary for Agent version >= 7.64.0.
20+
21+
```shell
22+
sudo -u dd-agent -- datadog-agent integration install datadog-juniper_srx_firewall==1.0.0
23+
```
24+
25+
### Configuration
26+
27+
#### Configure log collection
28+
29+
1. Log collection is disabled by default in the Datadog Agent. Enable it in `datadog.yaml`:
30+
31+
```yaml
32+
logs_enabled: true
33+
```
34+
35+
2. Add the following configuration block to your `juniper_srx_firewall.d/conf.yaml` file to start collecting logs. See the [sample `conf.yaml`][6] for available configuration options.
36+
37+
```yaml
38+
logs:
39+
- type: udp
40+
port: <PORT>
41+
source: juniper-srx-firewall
42+
service: juniper-srx-firewall
43+
```
44+
45+
**Note**:
46+
47+
- `PORT`: Specify the UDP port that Datadog will listen on (default: 514).
48+
- Do not change the `service` and `source` values, as they are integral to proper log pipeline processing.
49+
50+
3. [Restart the Agent][2].
51+
52+
#### Configure syslog message forwarding from Juniper SRX Firewall
53+
54+
1. Log in to the Juniper SRX Firewall CLI.
55+
56+
2. Enter configuration mode:
57+
```shell
58+
configure
59+
```
60+
61+
3. To send logs to the Datadog Agent, execute the following commands:
62+
```shell
63+
set system syslog host <IP-ADDRESS> any any
64+
set system syslog host <IP-ADDRESS> port <PORT>
65+
set system syslog host <IP-ADDRESS> structured-data brief
66+
```
67+
**Note**:
68+
- Replace `<IP-ADDRESS>` with the Datadog Agent's IP address.
69+
- Replace `<PORT>` with the same port configured in [Log Collection][7].
70+
71+
4. Verify if `Security Logging` is enabled:
72+
```shell
73+
show security log mode
74+
```
75+
If enabled, the output will display either `mode stream;` or `mode event-stream;`
76+
77+
5. If `Security Logging` is enabled, configure log streaming:
78+
```shell
79+
set security log stream <NAME> format sd-syslog
80+
set security log stream <NAME> category all
81+
set security log stream <NAME> host <IP-ADDRESS>
82+
set security log stream <NAME> host port <PORT>
83+
set security log transport protocol udp
84+
```
85+
86+
6. Apply and exit the configuration:
87+
```
88+
commit
89+
exit
90+
```
91+
92+
### Validation
93+
94+
[Run the Agent's status subcommand][5] and look for `juniper_srx_firewall` under the **Checks** section.
95+
96+
## Data Collected
97+
98+
### Log
99+
100+
| Format | Event Types |
101+
| ------------------------- | ------------------------------------------------ |
102+
| Structured-Data(RFC 5424) | Session Logs, Security Logs, Authentication Logs |
103+
104+
### Metrics
105+
106+
The Juniper SRX Firewall integration does not include any metrics.
107+
108+
### Events
109+
110+
The Juniper SRX Firewall integration does not include any events.
111+
112+
### Service Checks
113+
114+
The Juniper SRX Firewall integration does not include any service checks.
115+
116+
## Troubleshooting
117+
118+
### Permission denied while port binding
119+
120+
If you see a **Permission denied** error while port binding in the Agent logs:
121+
122+
1. Binding to a port number under 1024 requires elevated permissions. Grant access to the port using the `setcap` command:
123+
124+
```shell
125+
sudo setcap CAP_NET_BIND_SERVICE=+ep /opt/datadog-agent/bin/agent/agent
126+
```
127+
128+
2. Verify the setup is correct by running the `getcap` command:
129+
130+
```shell
131+
sudo getcap /opt/datadog-agent/bin/agent/agent
132+
```
133+
134+
With the expected output:
135+
136+
```shell
137+
/opt/datadog-agent/bin/agent/agent = cap_net_bind_service+ep
138+
```
139+
140+
**Note**: Re-run this `setcap` command every time you upgrade the Agent.
141+
142+
3. [Restart the Agent][2].
143+
144+
### Data is not being collected
145+
146+
Ensure firewall settings allow traffic through the configured port.
147+
148+
### Port already in use
149+
150+
On systems running Syslog, the Agent may fail to bind to port 514 and display the following error:
151+
152+
Can't start UDP forwarder on port 514: listen udp :514: bind: address already in use
153+
154+
This error occurs because Syslog uses port 514 by default.
155+
156+
To resolve:
157+
- Disable Syslog, OR
158+
- Configure the Agent to listen on a different, available port.
159+
160+
For further assistance, contact [Datadog support][1].
161+
162+
[1]: https://docs.datadoghq.com/help/
163+
[2]: https://docs.datadoghq.com/agent/guide/agent-commands/#start-stop-and-restart-the-agent
164+
[3]: https://www.juniper.net/us/en/products/security/srx-series.html
165+
[4]: https://docs.datadoghq.com/agent/guide/integration-management/?tab=linux#install
166+
[5]: https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information
167+
[6]: https://github.com/DataDog/integrations-core/blob/master/juniper_srx_firewall/datadog_checks/juniper_srx_firewall/data/conf.yaml.example
168+
[7]: https://docs.datadoghq.com/integrations/juniper_srx_firewall/#configure-log-collection

‎juniper_srx_firewall/assets/configuration/spec.yaml

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
name: Juniper SRX Firewall
2+
files:
3+
- name: juniper_srx_firewall.yaml
4+
options:
5+
- template: logs
6+
example:
7+
- type: udp
8+
port: <port>
9+
source: juniper-srx-firewall
10+
service: juniper-srx-firewall

0 commit comments

Comments
 (0)