Page Comparison

Table of Contents

minLevel	2
maxLevel	2
type	flat

...

For more information on how the events are parsed, visit our page ← LINK TO THE PARSER ARTICLE IF EXISTS.

Vendor setup

Getting Credentials

...

Accepted authentication methods

Authentication Method	Client ID	Client Secret	Signature Secret	User Email
Signature-based Access Token	Required	Required	Required	Required

Run the collector

Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (Cloud collector), or deploy and host the collector in your own machine using a Docker image (On-premise collector).

Rw ui tabs macro

Rw tab

title	Cloud collector

We use a piece of software called Collector Server to host and manage all our available collectors.

To enable the collector for a customer:

In the Collector Server GUI, access to the domain in which you want this instance to be created in, click on Add Collector and search for “Mimecast Collector - Integrations Factory”, then click on the result.
In the Version field, select the latest value.
In the Collector Name field, set the value you prefer (this name must be unique inside the same Collector Server domain).
In the Parameters section, establish the Collector Parameters as follows below:

Editing the JSON configuration

Code Block

{
  "global_overrides": {
    "debug": false
  },
 "inputs": {
    "kiteworks": {
      "id": "short-id",
      "enabled": true,
      "credentials": {
        "client_id": "",
        "client_secret": "",
        "signature_secret": "",
        "user_email": ""
      },
      "base_url": "https://{domain}.kiteworks.com",
      "token_url": "https://{domain}.kiteworks.com/oauth/token",
      "services": {
        "admin": {
          "request_period_in_seconds": 60,
          "start_time_in_utc": "1899-11-30T00:00:00.000Z",
          "compact": false
        }
      }
    }
  }
}

Parameter	Data Type	Requirement	Value Range / Format	Description
`short_unique_id`	`str`	Mandatory	Min length: 1, Max length: 5	Short, unique ID for the input service, used in persistence addressing. Avoid duplicates to prevent collisions.
`client_id`	`str`	Mandatory	Min length: 1	Client ID for Kiteworks authentication.
`client_secret`	`str`	Mandatory	Min length: 1	Client secret for Kiteworks authentication.
`signature_secret`	`str`	Mandatory	Min length: 1	Signature secret for Kiteworks authentication.
`user_email`	`str`	Mandatory	Email (e.g. "user@kiteworks.com")	User email used to set up
`base_url`	`str`	Mandatory	Standard domain (e.g. "https://{domain}.kiteworks.com")
`token_url`	`str`	Mandatory	Standard domain (e.g. "https://{domain}.kiteworks.com")
`request_period_in_seconds`	`int`	Optional	Min: 60	Custom period in seconds between data pulls, overriding the default (60s).
`start_time_in_utc`	`str`	Optional	UTC datetime format: `%Y-%m-%dT%H:%M:%SZ`	Custom start date for data retrieval, used for historical data download. Max historical date is 30 days prior.
`compact`	`bool`	Optional	true/false	Setting to false will add more fields to the data (default is false)
`override_tag`	`str`	Optional	Devo tag string or tag map object	An optional tag that will override the default tag destination.

Rw tab

title	On-premise collector

This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.

Structure

The following directory structure should be created for being used when running the collector:

Code Block

<any_directory>
└── devo-collectors/
    └── <product_name>/
        ├── certs/
        │   ├── chain.crt
        │   ├── <your_domain>.key
        │   └── <your_domain>.crt
        ├── state/
        └── config/ 
            └── config.yaml

Note
Replace `<product_name>` with the proper value.

Devo credentials

In Devo, go to Administration → Credentials → X.509 Certificates, download the Certificate, Private key and Chain CA and save them in <product_name>/certs/. Learn more about security credentials in Devo here.

Note
Replace `<product_name>` with the proper value.

Editing the config.yaml file

Code Block

globals:
  debug: false
  id: <collector_id_value>
  name: <collector_name_value>
  persistence:
    type: filesystem
    config:
      directory_name: state
outputs:
  devo_us_1:
    type: devo_platform
    config:
      address: <devo_address>
      port: 443
      type: SSL
      chain: <chain_filename>
      cert: <cert_filename>
      key: <key_filename>
inputs:
  kiteworks:
    id: short-id
    enabled: true
    credentials:
      client_id:
      client_secret:
      signature_secret:
      user_email:
    base_url: https://{domain}.kiteworks.com
    token_url: https://{domain}.kiteworks.com/oauth/token
    services:
      admin:
        request_period_in_seconds: 60
        start_time_in_utc: 0000-00-00T00:00:00Z
        compact: false

Info
All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the `services` object.

Replace the placeholders with your required values following the description table below:

Parameter	Data Type	Requirement	Value Range / Format	Description
`collector_id_value`	`str`	Mandatory	Min length: 1, Max length: 5	Unique identifier for the collector.
`collector_name_value`	`str`	Mandatory	Min length: 1, Max length: 10	Name assigned to the collector.
`devo_address`	`str`	Mandatory	One of: `collector-us.devo.io`, `collector-eu.devo.io`	Devo Cloud destination for events.
`chain_filename`	`str`	Mandatory	Min length: 4, Max length: 20	Filename of the `chain.crt` file from your Devo domain.
`cert_filename`	`str`	Mandatory	Min length: 4, Max length: 20	Filename of the `file.cert` from your Devo domain.
`key_filename`	`str`	Mandatory	Min length: 4, Max length: 20	Filename of the `file.key` from your Devo domain.
`short_unique_id`	`str`	Mandatory	Min length: 1, Max length: 5	Short, unique ID for input service, used in persistence addressing. Avoid duplicates to prevent collisions.
`client_id`	`str`	Mandatory	Min length: 1	Client ID for Kiteworks authentication.
`client_secret`	`str`	Mandatory	Min length: 1	Client secret for Kiteworks authentication.
`signature_secret`	`str`	Mandatory	Min length: 1	Signature secret for Kiteworks authentication.
`user_email`	`str`	Mandatory	Email (e.g. "user@kiteworks.com")	User email used to set up
`base_url`	`str`	Mandatory	Standard domain (e.g. "https://{domain}.kiteworks.com")
`token_url`	`str`	Mandatory	Standard domain (e.g. "https://{domain}.kiteworks.com")
`request_period_in_seconds`	`int`	Optional	Min: 60	Custom period in seconds between data pulls, overriding the default (60s).
`start_time_in_utc`	`str`	Optional	UTC datetime format: `%Y-%m-%dT%H:%M:%SZ`	Custom start date for data retrieval, used for historical data download. Max historical date is 30 days prior.
`compact`	`bool`	Optional	true/false	Setting to false will add more fields to the data (default is false)
`override_tag`	`str`	Optional	Devo tag string or tag map object	An optional tag that will override the default tag destination.

Download the Docker image

The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:

Collector Docker image	SHA-256 hash
collector-kiteworks_if-docker-image-1.0.0.tgz	`6d43ffe54f71e9e801dcbacb6174b0f516af92bf92dce9e2c13b089e19636442`

Use the following command to add the Docker image to the system:

Code Block
gunzip -c <image_file>-<version>.tgz \| docker load

Note
Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace `<image_file>` and `<version>` with a proper value.

The Docker image can be deployed on the following services:

Docker

Execute the following command on the root directory <any_directory>/devo-collectors/<product_name>/

Code Block

docker run 
--name collector-<product_name> 
--volume $PWD/certs:/devo-collector/certs 
--volume $PWD/config:/devo-collector/config 
--volume $PWD/state:/devo-collector/state 
--env CONFIG_FILE=config.yaml 
--rm 
--interactive 
--tty 
<image_name>:<version>

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

Docker Compose

The following Docker Compose file can be used to execute the Docker container. It must be created in the <any_directory>/devo-collectors/<product_name>/ directory.

Code Block

version: '3'
services:
  collector-<product_name>:
    image: <image_name>:${IMAGE_VERSION:-latest}
    container_name: collector-<product_name>
    volumes:
      - ./certs:/devo-collector/certs
      - ./config:/devo-collector/config
      - ./credentials:/devo-collector/credentials
      - ./state:/devo-collector/state
    environment:
      - CONFIG_FILE=${CONFIG_FILE:-config.yaml}

To run the container using docker-compose, execute the following command from the <any_directory>/devo-collectors/<product_name>/ directory:

Code Block
IMAGE_VERSION=<version> docker-compose up -d

Note
Replace `<product_name>`, `<image_name>` and `<version>` with the proper values.

...

The Integrations Factory Collector SDK has 3 different sender services depending on the event type to deliver (internal, standard, and lookup). This collector uses the following Sender Services:

Logging trace

Description

Number of available senders: 1

Displays the number of concurrent senders available for the given Sender Service.

Sender manager internal queue size: 0

Displays the items available in the internal sender queue.

This value helps detect bottlenecks and needs to increase the performance of data delivery to Devo. This last can be made by increasing the concurrent senders.

Total number of messages sent: 44, messages sent since "2022-06-28 10:39:22.511671+00:00": 21 (elapsed 0.007 seconds)

Displays the number of events from the last time the collector executed the pull logic. Following the given example, the following conclusions can be obtained:

44 events were sent to Devo since the collector started.
The last checkpoint timestamp was 2022-06-28 10:39:22.511671+00:00.
21 events were sent to Devo between the last UTC checkpoint and now.
Those 21 events required 0.007 seconds to be delivered.
By default these traces will be shown every 10 minutes.

Sender statistics

Each service displays its own performance statistics that allow checking how many events have been delivered to Devo by type:

Logging trace

Description

Number of available senders: 1

Displays the number of concurrent senders available for the given Sender Service

Sender manager internal queue size: 0

Displays the items available in the internal sender queue.

Standard - Total number of messages sent: 57, messages sent since "2023-01-10 16:09:16.116750+00:00": 0 (elapsed 0.000 seconds

Displays the number of events from the last time the collector executed the pull logic. Following the given example, the following conclusions can be obtained:

44 events were sent to Devo since the collector started.
The last checkpoint timestamp was 2023-01-10 16:09:16.116750+00:00.
21 events were sent to Devo between the last UTC checkpoint and now.
Those 21 events required 0.00 seconds to be delivered.

Check memory usage

To check the memory usage of this collector, look for the following log records in the collector which are displayed every 5 minutes by default, always after running the memory-free process.

...

Versions Compared

Old Version 3

New Version Current

Key

Vendor setup

Getting Credentials

Accepted authentication methods

Run the collector

Editing the JSON configuration

Structure

Devo credentials

Editing the config.yaml file

Download the Docker image

Docker

Docker Compose

Sender statistics

Check memory usage