Skip to content

Commit bfe2447

Browse files
surabhipatel-crestshubhamvekariya-crestaliciascott
authored
[SAASINT-3635] DDS: Symantec VIP: Crawler Integration v1.0.0 (#19414)
* Add Symantec VIP integration with assets * Fixed pipeline suggetion * Fixed pipeline suggetion for source * Fixed pipeline suggetion for sample * Fixed pipeline suggestion for readme * Update dashboard, pipeline and image * Resolve CI failure * Address review comments --------- Co-authored-by: Shubham Vekariya <shubham.vekariya@crestdata.ai> Co-authored-by: shubhamvekariya-crest <157569826+shubhamvekariya-crest@users.noreply.github.com> Co-authored-by: Alicia Scott <aliciascott@users.noreply.github.com>
1 parent 17a97b3 commit bfe2447

File tree

8 files changed

+3338
-21
lines changed

8 files changed

+3338
-21
lines changed

‎symantec_vip/README.md

Lines changed: 38 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,42 +1,63 @@
1-
# Agent Check: symantec-vip
1+
# Symantec VIP
22

33
## Overview
44

5-
This check monitors [symantec-vip][1].
5+
[Symantec VIP][1] (Validation and ID Protection Service) is a cloud-based authentication service that helps enterprises secure access to networks and applications while maintaining productivity.
6+
7+
This integration ingests the following logs:
8+
9+
- Event: Represents user management operations such as user creation, password setting, user group management, and batch operations, including transaction details and result statuses.
10+
11+
This integration seamlessly collects all the above listed logs, channeling them into Datadog for analysis. Leveraging the built-in logs pipeline, these logs are parsed and enriched, enabling effortless search and analysis. The integration provides insight into event logs through the out-of-the-box dashboards.
612

713
## Setup
814

9-
### Installation
15+
### Generate API credentials in Symantec VIP
16+
17+
**Obtaining VIP certificate**:
18+
Follow the steps in the official documentation: [Obtaining VIP certificate.][2]
1019

11-
The symantec-vip check is included in the [Datadog Agent][2] package.
12-
No additional installation is needed on your server.
20+
**Activating the VIP Report Streaming Service using VIP Certificate**:
21+
- Before integrating the VIP Report Streaming Service, you must enable the service with Symantec. Contact your Symantec representative to enable the service. Once the service is enabled, activate the VIP Report Streaming Service for your VIP account using the activate API.
22+
- Follow the steps mentioned in the official documentation to activate API: [Activate VIP Report Streaming Service][3]
1323

14-
### Configuration
24+
**Jurisdiction hash**:
25+
The jurisdiction hash of the user account is available on the **Account Information** tab of the **Account** page in VIP Manager.
1526

16-
!!! Add list of steps to set up this integration !!!
27+
### Connect your Symantec VIP Account to Datadog
1728

18-
### Validation
29+
1. Add your Symantec VIP credentials.
1930

20-
!!! Add steps to validate integration is functioning as expected !!!
31+
| Parameters | Description |
32+
| ------------------------------------- | ------------------------------------------------------------ |
33+
| Jurisdiction Hash | Jurisdiction hash of your account. |
34+
| VIP Cert Pem File Content | Content of VIP Certificate (.pem) file that will be used to connect to streaming endpoint |
35+
36+
2. Click the Save button to save your settings.
2137

2238
## Data Collected
2339

40+
### Logs
41+
42+
The Symantec VIP integration collects and forwards event logs to Datadog.
43+
2444
### Metrics
2545

26-
symantec-vip does not include any metrics.
46+
The Symantec VIP integration does not include any metrics.
2747

2848
### Service Checks
2949

30-
symantec-vip does not include any service checks.
50+
The Symantec VIP integration does not include any service checks.
3151

3252
### Events
3353

34-
symantec-vip does not include any events.
54+
The Symantec VIP integration does not include any events.
3555

36-
## Troubleshooting
56+
## Support
3757

38-
Need help? Contact [Datadog support][3].
58+
Need help? Contact [Datadog support][4].
3959

40-
[1]: **LINK_TO_INTEGRATION_SITE**
41-
[2]: https://app.datadoghq.com/account/settings/agent/latest
42-
[3]: https://docs.datadoghq.com/help/
60+
[1]: https://vip.symantec.com/
61+
[2]: https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/vip/cloud/vip-web-services-and-apis-v127046027-d2278e2328/VIP-Reporting-Streaming-Service/about-the-api-v109910792-d2376e278/obtaining-the-certificate-v109910553-d2376e636.html#v109910553
62+
[3]: https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/vip/cloud/vip-web-services-and-apis-v127046027-d2278e2328/VIP-Reporting-Streaming-Service/about-the-api-v109910792-d2376e278/activating-the-v133376930-d2376e309.html
63+
[4]: https://docs.datadoghq.com/help/

‎symantec_vip/assets/dashboards/symantec_vip_events.json

Lines changed: 3042 additions & 0 deletions
Large diffs are not rendered by default.

‎symantec_vip/assets/logs/symantec-vip.yaml

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
id: symantec-vip
2+
metric_id: symantec-vip
3+
backend_only: false
4+
facets:
5+
- groups:
6+
- Geoip
7+
name: City Name
8+
path: network.client.geoip.city.name
9+
source: log
10+
- groups:
11+
- Geoip
12+
name: Continent Code
13+
path: network.client.geoip.continent.code
14+
source: log
15+
- groups:
16+
- Geoip
17+
name: Continent Name
18+
path: network.client.geoip.continent.name
19+
source: log
20+
- groups:
21+
- Geoip
22+
name: Country ISO Code
23+
path: network.client.geoip.country.iso_code
24+
source: log
25+
- groups:
26+
- Geoip
27+
name: Country Name
28+
path: network.client.geoip.country.name
29+
source: log
30+
- groups:
31+
- Geoip
32+
name: Subdivision ISO Code
33+
path: network.client.geoip.subdivision.iso_code
34+
source: log
35+
- groups:
36+
- Geoip
37+
name: Subdivision Name
38+
path: network.client.geoip.subdivision.name
39+
source: log
40+
- groups:
41+
- Web Access
42+
name: Client IP
43+
path: network.client.ip
44+
source: log
45+
- groups:
46+
- User
47+
name: User Name
48+
path: usr.name
49+
source: log
50+
pipeline:
51+
type: pipeline
52+
name: Symantec VIP
53+
enabled: true
54+
filter:
55+
query: source:symantec-vip
56+
processors:
57+
- type: grok-parser
58+
name: Parsing the `ts` attribute to convert it into UNIX timestamp
59+
enabled: true
60+
source: ts
61+
samples:
62+
- 2025-02-07 03:22:37.051 +0000
63+
grok:
64+
supportRules: ""
65+
matchRules: convert_to_millisecond (%{date("yyyy-MM-dd HH:mm:ss.SSS
66+
Z"):ts}|%{date("yyyy-M-d H:m:s.SSS Z"):ts})
67+
- type: date-remapper
68+
name: Define `ts` as the official date of the log
69+
enabled: true
70+
sources:
71+
- ts
72+
- type: attribute-remapper
73+
name: Map `clientIp` to `network.client.ip`
74+
enabled: true
75+
sources:
76+
- clientIp
77+
sourceType: attribute
78+
target: network.client.ip
79+
targetType: attribute
80+
preserveSource: false
81+
overrideOnConflict: false
82+
- type: attribute-remapper
83+
name: Map `extUserId` to `usr.name`
84+
enabled: true
85+
sources:
86+
- extUserId
87+
sourceType: attribute
88+
target: usr.name
89+
targetType: attribute
90+
preserveSource: false
91+
overrideOnConflict: false
92+
- type: geo-ip-parser
93+
name: GeoIp Parser for `network.client.ip`
94+
enabled: true
95+
sources:
96+
- network.client.ip
97+
target: network.client.geoip
98+
ip_processing_behavior: do-nothing

‎symantec_vip/assets/logs/symantec-vip_tests.yaml

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
id: "symantec-vip"
2+
tests:
3+
-
4+
sample: |-
5+
{
6+
"wsdlVersion" : "1_1",
7+
"extUserId" : "7cc34F6DC",
8+
"durationMillis" : "60",
9+
"credId" : "VSME1673472",
10+
"result" : {
11+
"credType" : "STANDARD_OTP",
12+
"statusMessage" : "Success",
13+
"status" : "0000"
14+
},
15+
"jurHash" : "1459689",
16+
"requestId" : "abcd456",
17+
"_nestedCalls" : [ {
18+
"result" : {
19+
"credType" : "STANDARD_OTP",
20+
"statusMessage" : "Success",
21+
"status" : "0000"
22+
},
23+
"jurHash" : "1459689",
24+
"extUserId" : "7cc34F6DC",
25+
"newBindStatus" : "ENABLED",
26+
"credId" : "VSME16734672",
27+
"operation" : "addCredential"
28+
}, {
29+
"result" : {
30+
"detail" : "0000",
31+
"detailMessage" : "Success",
32+
"statusMessage" : "Success",
33+
"status" : "0000"
34+
},
35+
"operation" : "activateToken"
36+
} ],
37+
"newBindStatus" : "ENABLED",
38+
"_id" : "coloss4be-d2-tc.149132321663.2235348",
39+
"operation" : "addCredential",
40+
"txnId" : "vipus7E94583921D0EA",
41+
"ts" : "2017-04-04 16:39:23.090 +0000"
42+
}
43+
service: "event-logs"
44+
result:
45+
custom:
46+
_id: "coloss4be-d2-tc.149132321663.2235348"
47+
_nestedCalls:
48+
-
49+
result:
50+
credType: "STANDARD_OTP"
51+
statusMessage: "Success"
52+
status: "0000"
53+
jurHash: "1459689"
54+
extUserId: "7cc34F6DC"
55+
newBindStatus: "ENABLED"
56+
credId: "VSME16734672"
57+
operation: "addCredential"
58+
-
59+
result:
60+
detail: "0000"
61+
detailMessage: "Success"
62+
statusMessage: "Success"
63+
status: "0000"
64+
operation: "activateToken"
65+
credId: "VSME1673472"
66+
durationMillis: "60"
67+
jurHash: "1459689"
68+
newBindStatus: "ENABLED"
69+
operation: "addCredential"
70+
requestId: "abcd456"
71+
result:
72+
credType: "STANDARD_OTP"
73+
status: "0000"
74+
statusMessage: "Success"
75+
ts: 1491323963090
76+
txnId: "vipus7E94583921D0EA"
77+
usr:
78+
name: "7cc34F6DC"
79+
wsdlVersion: "1_1"
80+
message: |-
81+
{
82+
"wsdlVersion" : "1_1",
83+
"extUserId" : "7cc34F6DC",
84+
"durationMillis" : "60",
85+
"credId" : "VSME1673472",
86+
"result" : {
87+
"credType" : "STANDARD_OTP",
88+
"statusMessage" : "Success",
89+
"status" : "0000"
90+
},
91+
"jurHash" : "1459689",
92+
"requestId" : "abcd456",
93+
"_nestedCalls" : [ {
94+
"result" : {
95+
"credType" : "STANDARD_OTP",
96+
"statusMessage" : "Success",
97+
"status" : "0000"
98+
},
99+
"jurHash" : "1459689",
100+
"extUserId" : "7cc34F6DC",
101+
"newBindStatus" : "ENABLED",
102+
"credId" : "VSME16734672",
103+
"operation" : "addCredential"
104+
}, {
105+
"result" : {
106+
"detail" : "0000",
107+
"detailMessage" : "Success",
108+
"statusMessage" : "Success",
109+
"status" : "0000"
110+
},
111+
"operation" : "activateToken"
112+
} ],
113+
"newBindStatus" : "ENABLED",
114+
"_id" : "coloss4be-d2-tc.149132321663.2235348",
115+
"operation" : "addCredential",
116+
"txnId" : "vipus7E94583921D0EA",
117+
"ts" : "2017-04-04 16:39:23.090 +0000"
118+
}
119+
service: "event-logs"
120+
tags:
121+
- "source:LOGS_SOURCE"
122+
timestamp: 1491323963090

‎symantec_vip/assets/service_checks.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
[]
1+
[]

0 commit comments

Comments
 (0)