Versions Compared

Version Old Version 1 New Version Current
Changes made by

Shivank Shukla

Virginia Camuñas Núñez

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

<any_directory> └── devo-collectors/ └── <product_name>/ ├── certs/ │ ├── chain.crt
Rw ui tabs macro
Rw tab
titleOn-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block
Cloud collector

We use a piece of software called Collector Server to host and manage all our available collectors.

To enable the collector for a customer:

  1. In the Collector Server GUI, access the domain in which you want this instance to be created

  2. Click Add Collector and find the one you wish to add.

  3. In the Version field, select the latest value.

  4. In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).

  5. In the sending method select Direct Send. Direct Send configuration is optional for collectors that create Table events, but mandatory for those that create Lookups.

  6. In the Parameters section, establish the Collector Parameters as follows below:

Editing the JSON configuration

Code Block
{
  "global_overrides": {
    "debug": false
  },
  "inputs": {
    "prisma_cloud": {
      "id": "<short_unique_id>",
      │   ├── <your_domain>.key"enabled": "<input_status>",
        │   └── <your_domain>.crt"base_url": "<base_url>",
      "autoconfig": {
├── state/       "refresh_interval_in_seconds":  └── config/"<refresh_interval_in_seconds>",
        "creation_timeout_in_second": "<creation_timeout_in_seconds>"
     └── config.yaml
Note

Replace <product_name> with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Image Removed
Note

Replace <product_name> with the proper value.

Editing the config.yaml file

Code Block
globals:
  debug: false
  id: not_used
  name: prisma_cloud_collector
  persistence:
    type: filesystem
    config:
      directory_name: state

outputs:
  devo_1:
    type: devo_platform
    config:
 },
      "credentials": {
        "access_key_id": "<access_key_id>",
        "secret_key": "<secret_key>"
      },
      "services": {
     address: <devo_address>  "alert": {
   port: 443       type: SSL"initial_start_time_in_utc": "<initial_start_time_in_utc>",
      chain: <chain_filename>.cert    "request_period_in_seconds" : "<request_period_in_seconds>",
  cert: <cert_filename>.crt       key: <key_filename>.key

inputs:"limit": "<limit>",
     prisma_cloud:     id"override_tag": <short"<override_uniquedevo_id>tag>"
     enabled: <input_status>  },
  base_url: <base_url>     autoconfig:"audit": {
          refresh_interval"initial_start_time_in_secondutc": <refresh_interval"<initial_start_time_in_seconds>utc>",
        creation_timeout  "request_period_in_secondseconds" : <creation"<request_timeoutperiod_in_seconds>",
       credentials:   "limit": "<limit>",
  access_key_id: <access_key_id>       secret"override_keytag": <secret_key>"<override_devo_tag>"
    services:    },
  alert:         initial_start_time_in_utc: <initial_start_time_in_utc_value>"inventory_view": {
          refresh"request_timeperiod_in_seconds" : <refresh"<request_timeperiod_in_seconds>",
        limit: <limit>
        override "override_tag": "<override_devo_tag>"
      audit:  },
        initial_start_time_in_utc: <initial_start_time_in_utc_value>"inventory_trend": {
          refresh"request_timeperiod_in_seconds" : <refresh"<request_timeperiod_in_seconds>",
        limit: <limit>
         "override_tag": "<override_devo_tag>"
      inventory_view:  }
      refresh_time_in_seconds: <refresh_time_in_seconds>}
    }
    override_tag: <override_devo_tag>
      inventory_trend:
        refresh_time_in_seconds: <refresh_time_in_seconds>
        override_tag: <override_devo_tag>
Info
All defined service entities will 
}
}
Info

All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the services object.

Replace Please replace the placeholders with your required real world values following the description table below:

Parameter

Data type

Type

Value range / Format

Details

<devo

<short_unique_

address>

id>

str

int

Mandatory

collector-us.devo.io, collector-eu.devo.io

Minimum length: 5

Use this param to

identify the Devo Cloud where the events will be sent

<chain_filename>

str

Mandatory

Minimum length: 4, Maximum length: 20

give a unique id to this input service.

Note

This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision.

<input_status>

bool

Mandatory

false / true

Use this param to

identify the chain.cert file downloaded from your Devo domain. Usually this file's name is: chain.crt

<cert_filename>

str

Mandatory

Minimum length: 4, Maximum length: 20

Use this param to identify the file.cert downloaded from your Devo domain.

<key_filename>

str

Mandatory

Minimum length: 4, Maximum length: 20

Use this param to identify the file.key downloaded from your Devo domain.

<short_unique_id>

int

Mandatory

Minimum length: 5

Use this param to give a unique id to this input service.

Note

This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision.

<input_status>

bool

Mandatory

false / true

Use this param to enable or disable the given input logic when running the collector. If the value is true, the input will be run. If the value is false, it will be ignored.

<base_url>

str

Mandatory

Api base url

Use this param to Provide base URL for API calls.

<refresh_interval_in_seconds>

int

Mandatory

Maximum value 300

Use this param to set refresh interval for authentication, collector will check if auth is valid every time after mentioned seconds. Recommended value is 60.

<creation_timeout

enable or disable the given input logic when running the collector. If the value is true, the input will be run. If the value is false, it will be ignored.

<base_url>

str

Mandatory

Api base url

Use this param to Provide base URL for API calls.

<refresh_interval_in_seconds>

int

Mandatory

Maximum value 300

Use this param to set refresh interval for authentication, collector will check if auth is valid every time after mentioned seconds. Recommended value is 60.

<creation_timeout_in_seconds>

int

Mandatory

Maximum value 120

Use this param to set puller creation timeout. Collector will throw error if Puller is not created in mentioned seconds. Recommended value is 60.

<access_key_id>

str

Madatory

Minimum Length 1

The Access Key ID is your unique identifier used as the Authorization:{key}.

<secret_key>

str

Mandatory

Minimum Length 1

The Secret Key is your unique token used to authenticate the Access Key ID.

<initial_start_time_in_utc>

str

Mandatory

Minimum Length 1

The Initial start time is the time from when the logs will be fetched, it needs to be in UTC format and is mandatory for alert/audit service, optional for inventory services.

<request_period_in_seconds>

int

Mandatory

Optional

Maximum

Minimum value

120

Use this param to set puller creation timeout. Collector will throw error if Puller is not created in mentioned seconds. Recommended value is 60.

<access_key_id>

str

Madatory

Minimum Length 1

The Access Key ID is your unique identifier used as the Authorization:{key}.

<secret_key>

str

Mandatory

Minimum Length 1

The Secret Key is your unique token used to authenticate the Access Key ID.

<initial_start_time_in_utc>

str

Mandatory

Minimum Length 1

The Initial start time is the time from when the logs will be fetched, it needs to be in UTC format and is mandatory for alert/audit service, optional for inventory services.

<request_period_in_seconds>

int

Optional

Minimum value 60

Period in seconds used between each data pulling, default value for alert/audit services is 300 seconds and 3600 seconds for inventory services.

<limit>

int

Optional

Maximum value 10000

This value sets the maximum number of events per page. If not provided the default value from API endpoint will be used which is 10000.

<override_devo_tag>

str

Optional

Table tag

This value is used to override the tag of services. Ex: my.app.devo.alert

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image

SHA-256 hash

collector-prisma_cloud_if-docker-image-2.0.0

a400de24fd991296b1b56189411ad4ce6ecef83f10eacdb6d96174e90a6df5bb

Use the following command to add the Docker image to the system:

Code Block
gunzip -c <image_file>-<version>.tgz | docker load
Note

Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace <image_file> and <version> with a proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

Code Block
docker run 
--name collector-<product_name> 
--volume $PWD/certs:/devo-collector/certs 
--volume $PWD/config:/devo-collector/config 
--volume $PWD/state:/devo-collector/state 
--env CONFIG_FILE=config.yaml 
--rm 
--interactive 
--tty 
<image_name>:<version>
Note

Replace <product_name>, <image_name> and <version> with the proper values.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

Code Block
version: '3'
services:
  collector-<product_name>:
    image: <image_name>:${IMAGE_VERSION:-latest}
    container_name: collector-<product_name>
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./credentials:/devo-collector/credentials
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-config.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d
Note

Replace <product_name>, <image_name> and <version> with the proper values.

Rw tab
titleCloud collector

We use a piece of software called Collector Server to host and manage all our available collectors.

To enable the collector for a customer:

  1. In the Collector Server GUI, access the domain in which you want this instance to be created

  2. Click Add Collector and find the one you wish to add.

  3. In the Version field, select the latest value.

  4. In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).

  5. In the sending method select Direct Send. Direct Send configuration is optional for collectors that create Table events, but mandatory for those that create Lookups.

  6. In the Parameters section, establish the Collector Parameters as follows below:

Editing the JSON configuration

Code Block{ "global_overrides": { "debug": false }, "inputs": { "prisma_cloud": { "id": "<short_unique_id>", "enabled": "<input_status>", "base_url": "<base_url>", "autoconfig": {

60

Period in seconds used between each data pulling, default value for alert/audit services is 300 seconds and 3600 seconds for inventory services.

<limit>

int

Optional

Maximum value 10000

This value sets the maximum number of events per page. If not provided the default value from API endpoint will be used which is 10000.

<override_devo_tag>

str

Optional

Table tag

This value is used to override the tag of services. Ex: my.app.devo.alert

Rw tab
titleOn-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block
<any_directory>
└── devo-collectors/
    └── <product_name>/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        ├── state/
        └── config/ 
            └── config.yaml
Note

Replace <product_name> with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Image Added
Note

Replace <product_name> with the proper value.

Editing the config.yaml file

Code Block
globals:
  debug: false
  id: not_used
  name: prisma_cloud_collector
  persistence:
    type: filesystem
    config:
      directory_name: state

outputs:
  devo_1:
    type: devo_platform
    config:
      address: <devo_address>
      port: 443
      type: SSL
      chain: <chain_filename>.cert
      cert: <cert_filename>.crt
      key: <key_filename>.key

inputs:
  prisma_cloud:
    id: <short_unique_id>
    enabled: <input_status>
    base_url: <base_url>
    autoconfig:
      refresh_interval_in_second: <refresh_interval_in_seconds>
      creation_timeout_in_second: <creation_timeout_in_seconds>
    credentials:
      access_key_id: <access_key_id>
      secret_key: <secret_key>
    services:
      alert:
        initial_start_time_in_utc: <initial_start_time_in_utc_value>
        refresh_time_in_seconds: <refresh_time_in_seconds>
        limit: <limit>
        override_tag: <override_devo_tag>
      audit:
        initial_start_time_in_utc: <initial_start_time_in_utc_value>
        refresh_time_in_seconds: <refresh_time_in_seconds>
        limit: <limit>
        override_tag: <override_devo_tag>
      inventory_view:
        refresh_time_in_seconds: <refresh_time_in_seconds>
        override_tag: <override_devo_tag>
      inventory_trend:
        "refresh_intervaltime_in_seconds": "<refresh_intervaltime_in_seconds>",
        "creation_timeout_in_second"override_tag: "<creation<override_timeout_in_seconds>"
      },
      "credentials": {
        "access_key_id": "<access_key_id>",
        "secret_key": "<secret_key>"
      },
      "services": {
        "alert": {
          "initial_start_time_in_utc": "<initial_start_time_in_utc>",
          "request_period_in_seconds" : "<request_period_in_seconds>",
          "limit": "<limit>",
          "override_tag": "<override_devo_tag>"
        },
        "audit": {
          "initial_start_time_in_utc": "<initial_start_time_in_utc>",
          "request_period_in_seconds" : "<request_period_in_seconds>",
          "limit": "<limit>",
          "override_tag": "<override_devo_tag>"
        },
        "inventory_view": {
          "request_period_in_seconds" : "<request_period_in_seconds>",
          "override_tag": "<override_devo_tag>"
        },
        "inventory_trend": {
          "request_period_in_seconds" : "<request_period_in_seconds>",
          "override_tag": "<override_devo_tag>"
        }
      }
    }
  }
}
Info

All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the services object.

Please replace the placeholders with real world values following the description table below:

Parameter

Data type

Type

Value range / Format

Details

<short_unique_id>

int

Mandatory

Minimum length: 5

Use this param to give a unique id to this input service.

Note

This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision.

<input_status>

bool

Mandatory

false / true

Use this param to enable or disable the given input logic when running the collector. If the value is true, the input will be run. If the value is false, it will be ignored.

<base_url>

str

Mandatory

Api base url

Use this param to Provide base URL for API calls.

<refresh_interval_in_seconds>

int

Mandatory

Maximum value 300

Use this param to set refresh interval for authentication, collector will check if auth is valid every time after mentioned seconds. Recommended value is 60.

<creation_timeout_in_seconds>

int

Mandatory

Maximum value 120

Use this param to set puller creation timeout. Collector will throw error if Puller is not created in mentioned seconds. Recommended value is 60.

<access_key_id>

str

Madatory

Minimum Length 1

The Access Key ID is your unique identifier used as the Authorization:{key}.

<secret_key>

str

Mandatory

Minimum Length 1

The Secret Key is your unique token used to authenticate the Access Key ID.

<initial_start_time_in_utc>

str

Mandatory

Minimum Length 1

The Initial start time is the time from when the logs will be fetched, it needs to be in UTC format and is mandatory for alert/audit service, optional for inventory services.

<request_period_in_seconds>

int

Optional

Minimum value 60

Period in seconds used between each data pulling, default value for alert/audit services is 300 seconds and 3600 seconds for inventory services.

<limit>

int

Optional

Maximum value 10000

This value sets the maximum number of events per page. If not provided the default value from API endpoint will be used which is 10000.

<override_devo_tag>

str

Optional

Table tag

This value is used to override the tag of services. Ex: my.app.devo.alert
devo_tag>
Info

All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the services object.

Replace the placeholders with your required values following the description table below:

Parameter

Data type

Type

Value range / Format

Details

<devo_address>

str

Mandatory

collector-us.devo.io, collector-eu.devo.io

Use this param to identify the Devo Cloud where the events will be sent

<chain_filename>

str

Mandatory

Minimum length: 4, Maximum length: 20

Use this param to identify the chain.cert file downloaded from your Devo domain. Usually this file's name is: chain.crt

<cert_filename>

str

Mandatory

Minimum length: 4, Maximum length: 20

Use this param to identify the file.cert downloaded from your Devo domain.

<key_filename>

str

Mandatory

Minimum length: 4, Maximum length: 20

Use this param to identify the file.key downloaded from your Devo domain.

<short_unique_id>

int

Mandatory

Minimum length: 5

Use this param to give a unique id to this input service.

Note

This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision.

<input_status>

bool

Mandatory

false / true

Use this param to enable or disable the given input logic when running the collector. If the value is true, the input will be run. If the value is false, it will be ignored.

<base_url>

str

Mandatory

Api base url

Use this param to Provide base URL for API calls.

<refresh_interval_in_seconds>

int

Mandatory

Maximum value 300

Use this param to set refresh interval for authentication, collector will check if auth is valid every time after mentioned seconds. Recommended value is 60.

<creation_timeout_in_seconds>

int

Mandatory

Maximum value 120

Use this param to set puller creation timeout. Collector will throw error if Puller is not created in mentioned seconds. Recommended value is 60.

<access_key_id>

str

Madatory

Minimum Length 1

The Access Key ID is your unique identifier used as the Authorization:{key}.

<secret_key>

str

Mandatory

Minimum Length 1

The Secret Key is your unique token used to authenticate the Access Key ID.

<initial_start_time_in_utc>

str

Mandatory

Minimum Length 1

The Initial start time is the time from when the logs will be fetched, it needs to be in UTC format and is mandatory for alert/audit service, optional for inventory services.

<request_period_in_seconds>

int

Optional

Minimum value 60

Period in seconds used between each data pulling, default value for alert/audit services is 300 seconds and 3600 seconds for inventory services.

<limit>

int

Optional

Maximum value 10000

This value sets the maximum number of events per page. If not provided the default value from API endpoint will be used which is 10000.

<override_devo_tag>

str

Optional

Table tag

This value is used to override the tag of services. Ex: my.app.devo.alert

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image

SHA-256 hash

collector-prisma_cloud_if-docker-image-2.0.0

a400de24fd991296b1b56189411ad4ce6ecef83f10eacdb6d96174e90a6df5bb

Use the following command to add the Docker image to the system:

Code Block
gunzip -c <image_file>-<version>.tgz | docker load
Note

Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace <image_file> and <version> with a proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

Code Block
docker run 
--name collector-<product_name> 
--volume $PWD/certs:/devo-collector/certs 
--volume $PWD/config:/devo-collector/config 
--volume $PWD/state:/devo-collector/state 
--env CONFIG_FILE=config.yaml 
--rm 
--interactive 
--tty 
<image_name>:<version>
Note

Replace <product_name>, <image_name> and <version> with the proper values.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

Code Block
version: '3'
services:
  collector-<product_name>:
    image: <image_name>:${IMAGE_VERSION:-latest}
    container_name: collector-<product_name>
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./credentials:/devo-collector/credentials
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-config.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d
Note

Replace <product_name>, <image_name> and <version> with the proper values.

Collector services detail

...