Page Comparison

...

Use the following command to add the Docker image to the system:

Rw ui tabs macro

Rw tab

title	Cloud collector

The Collector Server is a managed platform that allows running sets of different collectors grouped by Devo domain destinations.

To run an instance of this data collector, the next steps must be followed:

In the Collector Server GUI, access the domain where you want to create this instance, click Add Collector, search for “Cortex XDR - Integrations Factory”, then click on the result.
In the Version field, select the latest value.
In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).
In the Parameters section, establish the Collector Parameters as follows below:Collector services detail

Info
Please, replace the placeholders `<api_key_value>,` `<api_key_id_value>`, and `<api_fqdn_value>` in the next section with the values obtained in previous sections of this document, except the `<short_unique_identifier>` that can have the value you choose. Do not substitute the occurrences of `{api_fqdn}`.

Code Block

{
  "cortex_xdr": {
    "id": 1,
    "enabled": true,
    "credentials": {
      "api_key": "<api_key_value>",
      "api_key_id": "<api_key_id_value>"
    },
    "services": {
       "incidents": {
        "request_period_in_seconds": "<request_period_in_seconds_value>",
        "api_fqdn": "<api_fqdn_value>",
        "api_endpoint": "{api_fqdn}/public_api/v1/incidents/get_incidents",
        "incident_extra_data_endpoint": "{api_fqdn}/public_api/v1/incidents/get_incident_extra_data",
        "tag": "<tag<opt_tag_value>",
        "alert_tag": "<alert<opt_alert_tag_value>"
 ,
    },       "alerts"request_period_in_seconds": {
        "request_period_in_seconds": "<request"<opt_request_period_in_seconds_value>",
        "start_time": "<start<opt_start_time>"
      },
      "alerts": {
        "api_fqdn": "<api_fqdn_value>",
        "api_endpoint": "{api_fqdn}/public_api/v1/alerts/get_alerts_multi_events",
        "alert_tag": "<alert<opt_alert_tag_value>",
        "event_tag": "<event<opt_event_tag_value>",
        "request_period_in_seconds": "<opt_request_period_in_seconds_value>",
        "start_time": "<opt_start_time>"
   }     }
    }
  }
}

Info
The value chosen for the `id` field will be used internally for having independent persistence areas.This section is intended to explain how to proceed with specific actions for services.

Rw tab

title	On-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block

<any_directory>
└── devo-collectors/
    └── <product_name>/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        ├── state/
        └── config/ 
            └── config.yaml

Note
Replace `<product_name>` with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Note
Replace `<product_name>` with the proper value.

Editing the config.yaml file

Code Block

globals:
  debug: false
  id: not_used
  name: cortex_xdr
  persistence:
    type: filesystem
    config:
      directory_name: state

outputs:
  consoledevo_1:
    type: consoledevo_platform
 inputs:   cortex_xdrconfig:
     id: <short_unique_id> address: collector-us.devo.io
      enabledport: 443
true      credentialstype: SSL
      api_keychain: <api_key_value>chain.crt
      api_key_idcert: <api_key_id_value><devo_domain>.crt
    services:  key: <devo_domain>.key
   incidentsconsole_1:
    type: console

 request_period_in_seconds : <request_period_in_seconds_value>inputs:
  cortex_xdr:
    id: <short_unique_id>
    api_fqdn: <api_fqdn_value>
 enabled: true
    credentials:
      api_endpointkey: <api_endpointkey_value>
        incidentapi_extrakey_data_endpointid: <incident<api_extrakey_data_endpointid_value>
    services:
      alertsincidents:
        start_time: <start_timerequest_period_in_seconds : <request_period_in_seconds_value> # Example 2024-01-01T01:50:00Z#optional
         request_period_in_secondsstart_time: <request_period_in_seconds_value><start_time> #optional
        api_fqdn: <api_fqdn_value>
        api_endpoint: <api_endpoint_value>

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image

SHA-256 hash

collector-cortex_xdr_if-docker-image-1.3.0

36d14118f0e5877c7da4493d2d0d00cc6ec0743d9357b895dcabb69e1a2f3cd0

Code Block
gunzip -c <image_file>-<version>.tgz \| docker load

Note
Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace `<image_file>` and `<version>` with a proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

Code Block

docker run 
--name collector-<product_name> 
--volume $PWD/certs:/devo-collector/certs 
--volume $PWD/config:/devo-collector/config 
--volume $PWD/state:/devo-collector/state 
--env CONFIG_FILE=config.yaml 
--rm 
--interactive 
--tty 
<image_name>:<version>

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

Code Block

version: '3'
services:
  collector-<product_name>:
    image: <image_name>:${IMAGE_VERSION:-latest}
    container_name: collector-<product_name>
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./credentials:/devo-collector/credentials
      - .
        incident_extra_data_endpoint: <incident_extra_data_endpoint_value>
      alerts:
        start_time: <start_time_value> # Example 2024-01-01T01:50:00Z
        request_period_in_seconds: <request_period_in_seconds_value> #optional
        api_fqdn: <api_fqdn_value>
        api_endpoint: <api_endpoint_value>

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image	SHA-256 hash
collector-cortex_xdr_if-docker-image-1.4.0	`84f0a7a60aa6c771d103e577070494d39068dc73c9f1d962aebce92f9db7c248`

Use the following command to add the Docker image to the system:

Code Block
gunzip -c <image_file>-<version>.tgz \| docker load

Note
Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace `<image_file>` and `<version>` with a proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

Code Block

docker run 
--name collector-<product_name> 
--volume $PWD/certs:/devo-collector/certs 
--volume $PWD/config:/devo-collector/config 
--volume $PWD/state:/devo-collector/state 
--env CONFIG_FILE=config.yaml 
environment:--rm 
--interactive 
   - CONFIG_FILE=${CONFIG_FILE:-config.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

Change log

...

Release

...

Released on

...

Release type

...

Details

...

--tty 
<image_name>:<version>

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

Code Block

version: '3'
services:
  collector-<product_name>:
    image: <image_name>:${IMAGE_VERSION:-latest}
    container_name: collector-<product_name>
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./credentials:/devo-collector/credentials
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-config.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

Change log

Release

Released on

Release type

Details

Recommendations

v1.4.0

23 Aug 2024

Status

colour	Yellow
title	IMPROVEMENT

Improvements:

Added start_time as an optional parameters for both of the services.
Added deduplication logic for both services
Updated Docker image base to version v1.3.0 in Dockerfile
Updated DCSDK from v1.11.1 to v1.12.4
- Added new sender for relay in house + TLS
- Added persistence functionality for gzip sending buffer
- Added Automatic activation of gzip sending
- Improved behaviour when persistence fails
- Upgraded DevoSDK dependency
- Fixed console log encoding
- Restructured python classes
- Improved behaviour with non-utf8 characters
- Decreased defaut size value for internal queues (Redis limitation, from 1GiB to 256MiB)
- New persistence format/structure (compression in some cases)
- Removed dmesg execution (It was invalid for docker execution)
- Applied changes to make DCSDK compatible with MacOS
- Improved behavior with non-utf8 characters
- Decreased defaut size value for internal queues (Redis limitation, from 1GiB to 256MiB)
- New persistence format/structure (compression in some cases)
- Removed dmesg execution (It was invalid for docker execution)
- DevoSDK has been updated to version 5.4.0

Recommended version

v1.3.0

23 May 2024

Status

colour	Yellow
title	IMPROVEMENT

Improvements:

Upgrade DC SDK to the latest version 1.11.1
Upgrade the Docker base image to 1.2.0

Recommended version

Upgrade

v1.2.0

20 Mar 2024

Status

colour	Yellow
title	IMPROVEMENT

Improvements:

Added 'start_time' in config file for alerts service
Added logs

Initial version

Version	Old Version 4	New Version 5
Changes made by	Juan Tomás Alonso Nieto (Deactivated)	Juan Tomás Alonso Nieto (Deactivated)
Saved on	Aug 01, 2024	Aug 27, 2024

Versions Compared

Key

Structure

Devo credentials

Editing the config.yaml file

Download the Docker image

Docker

Docker Compose

Download the Docker image

Docker

Change log

Docker Compose

Change log