[AI-5441] DDS: ESET Protect: Integration v1.0.0 #20349

savandalasaniya-crest · 2025-05-21T15:06:35Z

What does this PR do?

This is a initial release PR of ESET Protect integration including all the required assets.

Motivation

OOTB detection rules JSON would be shared separately with the required teams as a part of separate repository.
Since during the standard attribute remapping we are not preserving the source attributes as per suggested best practices, it would result in filters using these standard attributes populating the values of other integrations as well as per current Datadog behavior.

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

sarah-witt

Hi @savandalasaniya-crest, thanks for the PR! I left some initial comments.

eset_protect/pyproject.toml

eset_protect/README.md

sarah-witt

Looks good for agent integrations 👍

buraizu

Suggesting some minor documentation edits

buraizu · 2025-05-30T22:24:59Z

eset_protect/README.md

+
+- **Threat_Event**: Records detections involving identified security threats like malware, viruses, and suspicious behavior. It includes information on the threat type, its location, and the response or action performed.
+- **FirewallAggregated_Event**: Records network traffic filtered by the firewall, including blocked or allowed connections. It tracks protocols, IP addresses, ports, and the status of network connections.
+- **FilteredWebsites_Event**: Records website access attempts blocked by the web filtering feature based on security or policy rules. It includes details about the website category and the action taken (allowed/blocked).


Suggested change

- **FilteredWebsites_Event**: Records website access attempts blocked by the web filtering feature based on security or policy rules. It includes details about the website category and the action taken (allowed/blocked).

- **FilteredWebsites_Event**: Records website access attempts blocked by the web filtering feature based on security or policy rules. It includes details about the website category and the action taken (allowed or blocked).

buraizu · 2025-05-30T22:25:55Z

eset_protect/README.md

+- **Threat_Event**: Records detections involving identified security threats like malware, viruses, and suspicious behavior. It includes information on the threat type, its location, and the response or action performed.
+- **FirewallAggregated_Event**: Records network traffic filtered by the firewall, including blocked or allowed connections. It tracks protocols, IP addresses, ports, and the status of network connections.
+- **FilteredWebsites_Event**: Records website access attempts blocked by the web filtering feature based on security or policy rules. It includes details about the website category and the action taken (allowed/blocked).
+- **Audit_Event**: Records user or system actions within the management console, such as configuration changes, logins, or task executions, for auditing and accountability.


Suggested change

- **Audit_Event**: Records user or system actions within the management console, such as configuration changes, logins, or task executions, for auditing and accountability.

- **Audit_Event**: Records user or system actions within the management console for auditing and accountability, such as configuration changes, logins, or task executions.

buraizu · 2025-05-31T02:30:49Z

eset_protect/README.md

+
+### Installation
+
+To install the ESET Protect integration, run the following Agent installation command and the following steps. For more information, see the [Integration Management][5] documentation.


Suggested change

To install the ESET Protect integration, run the following Agent installation command and the following steps. For more information, see the [Integration Management][5] documentation.

To install the ESET Protect integration, run the following Agent installation command. Afterward, follow the steps in the [configuration](#configuration) section to set up log collection. For more information, see the [Integration Management][5] documentation.

buraizu · 2025-05-31T02:40:32Z

eset_protect/README.md

+   - **Host**: Provide IP address or hostname of the destination for Syslog messages.
+   - **Port**: Provide port number.
+   - **Format**: Select Syslog.
+   - **Transport**: Select Protocol for sending messages to Syslog. Select TCP or UDP.


Suggested change

- **Transport**: Select Protocol for sending messages to Syslog. Select TCP or UDP.

- **Transport**: Select Protocol for sending messages to Syslog (TCP or UDP).

buraizu · 2025-05-31T02:43:49Z

eset_protect/README.md

+
+### Logs
+
+The ESET Protect integration collects Threat_Event, FirewallAggregated_Event, FilteredWebsites_Event, and Audit_Event logs.


Suggested change

The ESET Protect integration collects Threat_Event, FirewallAggregated_Event, FilteredWebsites_Event, and Audit_Event logs.

The ESET Protect integration collects `Threat_Event`, `FirewallAggregated_Event`, `FilteredWebsites_Event`, and `Audit_Event` logs.

buraizu · 2025-05-31T02:52:18Z

eset_protect/assets/dashboards/eset_protect_audit_events.json

@@ -0,0 +1,1798 @@
+{
+    "title": "ESET Protect - Audit Events",
+    "description": "This dashboard provides information about the Audit events.",


Suggested change

"description": "This dashboard provides information about the Audit events.",

"description": "This dashboard provides information about Audit events.",

buraizu · 2025-05-31T02:59:38Z

eset_protect/assets/dashboards/eset_protect_filtered_websites_events.json

@@ -0,0 +1,1632 @@
+{
+    "title": "ESET Protect - Filtered Websites Events",
+    "description": "This dashboard offers insights into the ESET Protect Filtered Websites events.",


Suggested change

"description": "This dashboard offers insights into the ESET Protect Filtered Websites events.",

"description": "This dashboard offers insights into ESET Protect Filtered Website events.",

It looks like both Websites events and Website events are used in this file. Suggesting to make this usage consistent throughout the file.

buraizu · 2025-05-31T03:14:55Z

eset_protect/assets/dashboards/eset_protect_overview.json

+                        "id": 666821597255175,
+                        "definition": {
+                            "type": "note",
+                            "content": "Datadog Cloud SIEM analyzes and correlates the ESET Protect logs to detect threats to your environment in real time. If you don't see signals please make sure you've enabled [Datadog Cloud SIEM](/security).",


Suggested change

"content": "Datadog Cloud SIEM analyzes and correlates the ESET Protect logs to detect threats to your environment in real time. If you don't see signals please make sure you've enabled [Datadog Cloud SIEM](/security).",

"content": "Datadog Cloud SIEM analyzes and correlates ESET Protect logs to detect threats to your environment in real time. If you don't see signals, ensure you've enabled [Datadog Cloud SIEM](/security).",

buraizu · 2025-06-02T23:16:26Z

eset_protect/assets/dashboards/eset_protect_threat_events.json

@@ -0,0 +1,1329 @@
+{
+    "title": "ESET Protect - Threat Events",
+    "description": "This dashboard offers insights into the ESET Protect Threat events.",


Suggested change

"description": "This dashboard offers insights into the ESET Protect Threat events.",

"description": "This dashboard offers insights into ESET Protect Threat events.",

buraizu · 2025-06-02T23:18:05Z

eset_protect/assets/dashboards/eset_protect_threat_events.json

+            "id": 3076471816303785,
+            "definition": {
+                "type": "note",
+                "content": "ESET Protect is an application that lets you manage ESET products on workstations and servers in a networked environment from one central location. Using the ESET PROTECT Web Console, you can deploy ESET Solutions, manage tasks, enforce security policies, monitor system status, and quickly respond to problems or detections on remote computers.\n\nThe Threat dashboard provides events generated by ESET antivirus system when it detects potential threats, such as malware, viruses, or suspicious files. It shows when the antivirus has identified a security risk and possibly taken action on a file, application, or network traffic.\n\nFor more information, see the [ESET Protect Integration Documentation](https://docs.datadoghq.com/integrations/eset_protect).\n\n**Tips**\n- Use the timeframe selector in the upper-right corner of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify, and add widgets and visualizations.",


Suggested change

"content": "ESET Protect is an application that lets you manage ESET products on workstations and servers in a networked environment from one central location. Using the ESET PROTECT Web Console, you can deploy ESET Solutions, manage tasks, enforce security policies, monitor system status, and quickly respond to problems or detections on remote computers.\n\nThe Threat dashboard provides events generated by ESET antivirus system when it detects potential threats, such as malware, viruses, or suspicious files. It shows when the antivirus has identified a security risk and possibly taken action on a file, application, or network traffic.\n\nFor more information, see the [ESET Protect Integration Documentation](https://docs.datadoghq.com/integrations/eset_protect).\n\n**Tips**\n- Use the timeframe selector in the upper-right corner of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify, and add widgets and visualizations.",

"content": "ESET Protect is an application that lets you manage ESET products on workstations and servers in a networked environment from one central location. Using the ESET PROTECT Web Console, you can deploy ESET Solutions, manage tasks, enforce security policies, monitor system status, and quickly respond to problems or detections on remote computers.\n\nThe Threat dashboard provides events generated by the ESET antivirus system when it detects potential threats, such as malware, viruses, or suspicious files. It shows when the antivirus has identified a security risk and possibly taken action on a file, application, or network traffic.\n\nFor more information, see the [ESET Protect Integration Documentation](https://docs.datadoghq.com/integrations/eset_protect).\n\n**Tips**\n- Use the timeframe selector in the upper-right corner of the dashboard to change the default timeframe.\n- Clone this dashboard to rearrange, modify, and add widgets and visualizations.",

Review from sarah-witt is dismissed. Related teams and files:

agent-integrations
- eset_protect/README.md
- eset_protect/assets/dashboards/eset_protect_audit_events.json
- eset_protect/assets/dashboards/eset_protect_filtered_websites_events.json
- eset_protect/assets/dashboards/eset_protect_overview.json
- eset_protect/assets/dashboards/eset_protect_threat_events.json

savandalasaniya-crest added 2 commits May 21, 2025 20:25

Add ESET Protect integration with assets

9b51f7c

adding codeowners and labeler

0237d8e

temporal-github-worker-1 bot added docs/review-requested ecosystems/review-requested product/review-requested labels May 21, 2025

datadog-agent-integrations-bot bot added documentation dev/testing dev/tooling qa/skip-qa Automatically skip this PR for the next QA labels May 21, 2025

savandalasaniya-crest changed the title ~~DDS: ESET Protect: Crawler Integration v1.0.0~~ DDS: ESET Protect: Integration v1.0.0 May 21, 2025

Adding datadog checks and configuration files

973037c

temporal-github-worker-1 bot added the agent/review-requested label May 21, 2025

datadog-agent-integrations-bot bot added the release label May 21, 2025

savandalasaniya-crest added 9 commits May 22, 2025 10:59

Updated log pipeline

a55f104

Updating log pipeline

bd718ad

Updating about file version

6ec0b65

Updating log pipeline for 1 sample

997e3a7

Updating code owner details

18314f5

Updating dashboard and pipeline

5494a09

Updating log pipeline

f7b45da

updating logs result

1a8bfcb

Merge branch 'master' into eset-protect-v1.0.0

c772483

savandalasaniya-crest marked this pull request as ready for review May 23, 2025 06:20

savandalasaniya-crest requested review from a team as code owners May 23, 2025 06:20

datadog-agent-integrations-bot bot added team/agent-integrations team/documentation labels May 23, 2025

datadog-agent-integrations-bot bot added team/documentation team/logs-backend team/logs-integrations-reviewers team/saas-integrations labels May 23, 2025

jhgilbert added the editorial review Waiting on a more in-depth review from a docs team editor label May 23, 2025

torosmassa changed the title ~~DDS: ESET Protect: Integration v1.0.0~~ [AI-5441] DDS: ESET Protect: Integration v1.0.0 May 27, 2025

sarah-witt requested changes May 28, 2025

View reviewed changes

eset_protect/pyproject.toml Outdated Show resolved Hide resolved

eset_protect/pyproject.toml Show resolved Hide resolved

eset_protect/README.md Outdated Show resolved Hide resolved

temporal-github-worker-1 bot added agent/requested-changes and removed agent/review-requested labels May 28, 2025

Updating versions as per suggestion

f144ff3

savandalasaniya-crest requested a review from sarah-witt May 29, 2025 15:20

sarah-witt previously approved these changes Jun 2, 2025

View reviewed changes

temporal-github-worker-1 bot added agent/approved and removed agent/requested-changes labels Jun 2, 2025

buraizu reviewed Jun 2, 2025

View reviewed changes

Resolved review comments and updated content

58fdf22

temporal-github-worker-1 bot added agent/review-requested and removed agent/approved labels Jun 3, 2025

savandalasaniya-crest requested a review from buraizu June 3, 2025 13:57

Wyrine added the assets/no-dry-run Run asset publishing github checks in staging label Jun 3, 2025

Merge branch 'master' into eset-protect-v1.0.0

08a833d

Wyrine added assets/no-dry-run Run asset publishing github checks in staging and removed assets/no-dry-run Run asset publishing github checks in staging labels Jun 3, 2025

Merge branch 'master' into eset-protect-v1.0.0

ccbcfae

	- FilteredWebsites_Event: Records website access attempts blocked by the web filtering feature based on security or policy rules. It includes details about the website category and the action taken (allowed/blocked).
	- FilteredWebsites_Event: Records website access attempts blocked by the web filtering feature based on security or policy rules. It includes details about the website category and the action taken (allowed or blocked).

	- Audit_Event: Records user or system actions within the management console, such as configuration changes, logins, or task executions, for auditing and accountability.
	- Audit_Event: Records user or system actions within the management console for auditing and accountability, such as configuration changes, logins, or task executions.


		### Installation

		To install the ESET Protect integration, run the following Agent installation command and the following steps. For more information, see the [Integration Management][5] documentation.

	- Transport: Select Protocol for sending messages to Syslog. Select TCP or UDP.
	- Transport: Select Protocol for sending messages to Syslog (TCP or UDP).


		### Logs

		The ESET Protect integration collects Threat_Event, FirewallAggregated_Event, FilteredWebsites_Event, and Audit_Event logs.

	The ESET Protect integration collects Threat_Event, FirewallAggregated_Event, FilteredWebsites_Event, and Audit_Event logs.
	The ESET Protect integration collects `Threat_Event`, `FirewallAggregated_Event`, `FilteredWebsites_Event`, and `Audit_Event` logs.

	"description": "This dashboard provides information about the Audit events.",
	"description": "This dashboard provides information about Audit events.",

	"description": "This dashboard offers insights into the ESET Protect Filtered Websites events.",
	"description": "This dashboard offers insights into ESET Protect Filtered Website events.",

	"content": "Datadog Cloud SIEM analyzes and correlates the ESET Protect logs to detect threats to your environment in real time. If you don't see signals please make sure you've enabled [Datadog Cloud SIEM](/security).",
	"content": "Datadog Cloud SIEM analyzes and correlates ESET Protect logs to detect threats to your environment in real time. If you don't see signals, ensure you've enabled [Datadog Cloud SIEM](/security).",

[AI-5441] DDS: ESET Protect: Integration v1.0.0 #20349

Are you sure you want to change the base?

[AI-5441] DDS: ESET Protect: Integration v1.0.0 #20349

Uh oh!

Conversation

savandalasaniya-crest commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Motivation

Review checklist (to be filled by reviewers)

Uh oh!

sarah-witt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sarah-witt left a comment

Choose a reason for hiding this comment

Uh oh!

buraizu left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

savandalasaniya-crest commented May 21, 2025 •

edited

Loading