Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

Darktrace Self-Learning AI delivers precise information about what’s not normal to your organization. Darktrace RESPOND takes precise action to neutralize threats against any and every asset, no matter where data resides.

Devo collector features

Feature

Details

Allow parallel downloading (multipod)

not allowed

Running environments

  • collector server

  • on-premise

Populated Devo events

table

Flattening preprocessing

yes

Allowed source events obfuscation

yes

Data sources

Data source

Description

API endpoint

Collector service name

Devo table

Available from release

Antigena Actions

Gives information about current and past Darktrace RESPOND/Network (formerly Antigena Network) actions.

/antigena

antigena

edr.darktrace.respond.antigena

v1.0.0

AiAnalyst Incident Events

Provides access to AI Analyst events - a group of anomalies or network activity investigated by Cyber AI Analyst.

/aianalyst/incidentevents

aianalyst_incidentevents

edr.darktrace.respond.incident_event

v1.0.0

Summary Statistics

Returns simple statistics on device counts, processed bandwidth and the number of active Darktrace RESPOND actions.

/summarystatistics

summarystatistics

edr.darktrace.respond.summary

v1.0.0

Status

Detailed system health information from the Status page .

/status

status

edr.darktrace.respond.status

v1.0.0

Modelbreaches

Returns a time-sorted list of model breaches, filtered by the specified parameters.

/modelbreaches

modelbreaches

edr.darktrace.respond.model_breach

v1.0.1

For more information on how the events are parsed, visit our page.

Flattening preprocessing

Data source

Collector service

Optional

Flattening details

Status

status

Yes

Original :

Code Block
"time":"2023-05-31 09:37",
   "installed":"2022-06-15",
   "mobileAppConfigured":false,
   "version":"6.0.32 (a1c388)",
   "ipAddress":"172.27.24.26",
   "modelsUpdated":"2023-05-30 18:46:46",
   "modelPackageVersion":"6.0.23-1019~20230530170515~g6d5204",
   "bundleVersion":"60076",
"instances":{
      "1":{
         "id":1,
         "downCount":1,
         "upCount":1,
         "downTimeMs":1685514150000000,
         "downTime":"2023-05-31 06:22:30",
         "version":"6.0.32 (a1c388)",
         "ipAddress":"172.27.24.26",

     }
"2":{
         "id":2,
         "downCount":8,
         "upCount":8,
         "downTimeMs":1685516996000000,
         "downTime":"2023-05-31 07:09:56",
         "version":"6.0.32 (a1c388)",
         "ipAddress":"10.32.1.99",
     }
}

Result:

Code Block
"time":"2023-05-31 09:37",
   "installed":"2022-06-15",
   "mobileAppConfigured":false,
   "version":"6.0.32 (a1c388)",
   "ipAddress":"172.27.24.26",
   "modelsUpdated":"2023-05-30 18:46:46",
   "modelPackageVersion":"6.0.23-1019~20230530170515~g6d5204",
   "bundleVersion":"60076",
'instance_info': {'id': 2, 'downCount': 8, 'upCount': 8, 'downTimeMs': 1685516996000000, 'downTime': '2023-05-31 07:09:56', 'version': '6.0.32 (a1c388)', 'ipAddress': '10.32.1.99'}

Vendor setup

A Darktrace user with Unrestricted Devices and Visualizer role.

Action

Steps

Obtain an API-Token Pair

  1. Login to the Darktrace portal with your email and password.

  2. Navigate to the System Config page on the Threat Visualizer of the instance you wish to request data from. Select “Settings” from the left-hand menu.

  3. Locate the ‘API Token’ subsection and click ‘New’.

  4. Two values will be displayed, a Public and Private token, the Private token will not be displayed again.

Note

Both tokens are required to generate the DT-API-Signature value, which must be passed with every API request made to the appliance, so make sure you record them securely.

Minimum configuration required for basic pulling

...

Info

This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.

Setting

Details

base_url

The Darktrace Respond API base URL (for example, https://euw1-1234-01.cloud.darktrace.com ). 

public_token

The token obtained from Daktrace Respond for authentication.

private_token

The token obtained from Daktrace Respond for authentication.

Accepted authentication methods

Authentication method

Public token

Private token

Base URL

API-token pair

Required

Required

Required

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

Rw ui tabs macro
Rw tab
titleCloud collector

We use a piece of software called Collector Server to host and manage all our available collectors. If you want us to host this collector for you, get in touch with us and we will guide you through the configuration.

Rw tab
titleOn-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block
<any_directory>
└── devo-collectors/
    └── <product_name>/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        ├── state/
        └── config/ 
            └── config.yaml 
Note

Replace <product_name> with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Note

Replace <product_name> with the proper value.

Editing the config.yaml file

Code Block
globals:
  debug: false
  id: <collector_id>
  name: <collector_name>
  persistence:
    type: filesystem
    config:
      directory_name: state
outputs:
  devo_1:
    type: devo_platform
    config:
      address: <devo_address>
      port: 443
      type: SSL
      chain: <chain_filename>
      cert: <cert_filename>
      key: <key_filename>
inputs:
  darktrace:
    id: <short_unique_id>
    enabled: true
    environment: dev
    credentials:
      public_token: <public_token_value>
      private_token: <private_token_value>
      instance: <instance_value>
    requests_limits:
      - period: 1d
        number_of_requests: -1
      - period: 1h
        number_of_requests: -1
      - period: 1m
        number_of_requests: -1
      - period: 1s
        number_of_requests: -1
    services:
      antigena:
        override_devo_tag: <override_devo_tag>
        start_time_in_utc_format: <start_time_in_utc_format>
        override_time_window_interval_in_minutes: <override_time_window_interval_in_minutes>
        request_period_in_seconds: <request_period_in_seconds>
      aianalyst_incidentevents:
        override_devo_tag: <override_devo_tag>
        start_time_in_utc_format: <start_time_in_utc_format>
        override_time_window_interval_in_minutes: <override_time_window_interval_in_minutes>
        request_period_in_seconds: <request_period_in_seconds>
      summarystatistics:
        override_devo_tag: <override_devo_tag>
        start_time_in_utc_format: <start_time_in_utc_format>
        override_time_window_interval_in_minutes: <override_time_window_interval_in_minutes>
        request_period_in_seconds: <request_period_in_seconds>
    status:
        override_devo_tag: <override_devo_tag>
        start_time_in_utc_format: <start_time_in_utc_format>
        override_time_window_interval_in_minutes: <override_time_window_interval_in_minutes>
        request_period_in_seconds: <request_period_in_seconds>
    modelbreaches:
        override_devo_tag: <override_devo_tag>
        start_time_in_utc_format: <start_time_in_utc_format>
        override_time_window_interval_in_minutes: <override_time_window_interval_in_minutes>
        request_period_in_seconds: <request_period_in_seconds>
Info

All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the services object.

Replace the placeholders with your required values following the description table below:

Parameter

Data type

Type

Value range

Details

collector_id

int

Mandatory

Minimum length: 1

Maximum length: 5

Use this param to give an unique id to this collector.

collector_name

str

Mandatory

Minimum length: 1

Maximum length: 10

Use this param to give a valid name to this collector.

devo_address

str

Mandatory

collector-us.devo.io

collector-eu.devo.io

Use this param to identify the Devo Cloud where the events will be sent.

chain_filename

str

Mandatory

Minimum length: 4

Maximum length: 20

Use this param to identify the chain.cert file downloaded from your Devo domain. Usually this file's name is: chain.crt

cert_filename

str

Mandatory

Minimum length: 4

Maximum length: 20

Use this param to identify the file.cert downloaded from your Devo domain.

key_filename

str

Mandatory

Minimum length: 4

Maximum length: 20

Use this param to identify the file.key downloaded from your Devo domain.

input_id

int

Mandatory

Minimum length: 1

Maximum length: 5

Use this param to give an unique id to this input service.

This parameter is used to build the persistence address, do not use the same value for multiple collectors. It could cause a collision.

input_status

bool

Mandatory

false / true

If the value is true, the input definition will be executed. If the value is false, the service will be ignored.

public_token

str

Mandatory

Minimum length: 1

Public Token of the Darktrace server

private_token

str

Mandatory

Minimum length: 1

Private Token of the Darktrace server

instance

str

Mandatory

Minimum length: 1

Instance value for the Darktrace server. Suppose the base URL is https://azeus1-75836-01.cloud.darktrace.com/ , so instance value will be azeus1-75836-01.cloud.darktrace.com

request_period_in_seconds

int

Optional

Minimum length: 1

Period in seconds used between each data pulling, this value will overwrite the default value (60 seconds)

override_devo_tag

str

Optional

A devo tag

This parameter allows to define a custom devo tag.

start_time_in_utc_format

str

Optional

Minimum length: 1

This configuration allows you to set a custom date as the beginning of the period to download. This allows downloading historical data (one month back for example) before downloading new events.

override_time_window_interval_in_minutes

int

Optional

Minimum length: 1

This value allows you to set the intervals in which the data pulling will be divided, starting from the start date. This will overwrite the default value (60 minutes)

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image

SHA-256 hash

collector-darktrace_respond-docker-image-1.0.0

c93371c66624db6c50e2fd164c8ccc207b6c219699c102e8bd7ccd787e2fe6dd

Use the following command to add the Docker image to the system:

Code Block
gunzip -c <image_file>-<version>.tgz | docker load
Note

Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace <image_file> and <version> with a proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

Code Block
docker run 
--name collector-<product_name> 
--volume $PWD/certs:/devo-collector/certs 
--volume $PWD/config:/devo-collector/config 
--volume $PWD/state:/devo-collector/state 
--env CONFIG_FILE=config.yaml 
--rm 
--interactive 
--tty 
<image_name>:<version>
Note

Replace <product_name>, <image_name> and <version> with the proper values.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

Code Block
version: '3'
services:
  collector-<product_name>:
    image: <image_name>:${IMAGE_VERSION:-latest}
    container_name: collector-<product_name>
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./credentials:/devo-collector/credentials
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-config.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d
Note

Replace <product_name>, <image_name> and <version> with the proper values.

Rw tab
titleCloud collector
We use a piece of software called Collector Server to host and manage all our available collectors. If you want us to host this collector for you, get in touch with us and we will guide you through the configuration

.

Collector services detail

...

Expand
titleCheck memory usage

To check the memory usage of this collector, look for the following log records in the collector which are displayed every 5 minutes by default, always after running the memory-free process.

  • The used memory is displayed by running processes and the sum of both values will give the total used memory for the collector.

  • The global pressure of the available memory is displayed in the global value.

  • All metrics (Global, RSS, VMS) include the value before freeing and after previous -> after freeing memory

Code Block
2023-03-27T16:22:09.311    INFO InputProcess::MainThread -> [GC] global: 66.6% -> 66.6%, process: RSS(44.88MiB -> 44.88MiB), VMS(32.80GiB -> 32.80GiB)
2023-03-27T16:22:09.350    INFO OutputProcess::MainThread -> [GC] global: 66.6% -> 66.6%, process: RSS(45.21MiB -> 45.34MiB), VMS(32.89GiB -> 32.89GiB)

Change log

...

Release

Released on

Release type

Details

Recommendations

v1.0.0

Status
colourPurple
titleFIRST RELEASE


Released the first version of the Darktrace Respond collector.

Recommended version