{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"minLevel":{"value":"2"},"maxLevel":{"value":"2"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"812af86120b7d64463b747ac09afa7ed"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"72c9b4a1-f493-4b84-b268-16358df35c8b"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"Cohesity gives you both data security and data management. Defend against ransomware with immutable backup, AI-based early threat detection, and rapid data.","type":"text"}]},{"type":"paragraph","content":[{"text":"The Cohesity Helios API is lazy, so the collector will have to observe a lookback window to ensure that the least amount of events are lost. To define this window the collector has 2 parameters:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"lookback","type":"text","marks":[{"type":"code"}]},{"text":": This is the amount of time to look back and extract data.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"lookback_width","type":"text","marks":[{"type":"code"}]},{"text":": The width of the slot to extract data from the look-back parameter.","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"If not defined, the collector will default to ","type":"text"},{"text":"1h","type":"text","marks":[{"type":"code"}]},{"text":" for the lookback and ","type":"text"},{"text":"5m","type":"text","marks":[{"type":"code"}]},{"text":" for the lookback width. This means that every time the request period is reached the collector will look back at the last 1 hour and pull all events that have occurred in that 5-minute time frame. These are reasonable defaults, but you can adjust them to your needs.","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Important","type":"text","marks":[{"type":"strong"}]},{"text":": The ","type":"text"},{"text":"lookback_width","type":"text","marks":[{"type":"code"}]},{"text":" parameter must be the same as the ","type":"text"},{"text":"request_period_in_seconds","type":"text","marks":[{"type":"code"}]},{"text":" parameter. If not, events will get lost or be duplicated.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Devo collector features","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"0ab3b2ef-2f2a-4b04-9967-e08c1200cb68"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[432.0]},"content":[{"type":"paragraph","content":[{"text":"Feature","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[324.0]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[432.0]},"content":[{"type":"paragraph","content":[{"text":"Allow parallel downloading (","type":"text"},{"text":"multipod","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[324.0]},"content":[{"type":"paragraph","content":[{"text":"not allowed","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[432.0]},"content":[{"type":"paragraph","content":[{"text":"Running environments","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[324.0]},"content":[{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"collector server","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"on-premise","type":"text","marks":[{"type":"code"}]}]}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[432.0]},"content":[{"type":"paragraph","content":[{"text":"Populated Devo events","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[324.0]},"content":[{"type":"paragraph","content":[{"text":"table","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[432.0]},"content":[{"type":"paragraph","content":[{"text":"Flattening preprocessing","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[324.0]},"content":[{"type":"paragraph","content":[{"text":"no","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[432.0]},"content":[{"type":"paragraph","content":[{"text":"Allowed source events obfuscation","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[324.0]},"content":[{"type":"paragraph","content":[{"text":"yes","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Data sources","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"9435c4ed-b468-41be-9313-494ec9731a76"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Data source","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[210.0]},"content":[{"type":"paragraph","content":[{"text":"API endpoint","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[196.0]},"content":[{"type":"paragraph","content":[{"text":"Collector service name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[205.0]},"content":[{"type":"paragraph","content":[{"text":"Devo table","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Helios Audit","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[210.0]},"content":[{"type":"paragraph","content":[{"text":"/v2/mcm/audit-logs","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[196.0]},"content":[{"type":"paragraph","content":[{"text":"audit","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[205.0]},"content":[{"type":"paragraph","content":[{"text":"dmp.cohesity.helios.audit","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[146.0]},"content":[{"type":"paragraph","content":[{"text":"Helios Alert","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[210.0]},"content":[{"type":"paragraph","content":[{"text":"/v2/mcm/alerts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[196.0]},"content":[{"type":"paragraph","content":[{"text":"alerts","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[205.0]},"content":[{"type":"paragraph","content":[{"text":"dmp.cohesity.helios.alerts","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"For more information on how the events are parsed, ","type":"text"},{"text":"visit our page","type":"text","marks":[{"type":"link","attrs":{"href":"https://devodocs.atlassian.net/wiki/spaces/latest/pages/596705284"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Flattening preprocessing ","type":"text"}]},{"type":"paragraph","content":[{"text":"The audit logs have flattening enabled. If a record has several records, the new records will be extracted and partially applied to the original log.","type":"text"}]},{"type":"paragraph","content":[{"text":"For example:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"json"},"content":[{"text":"{\"a\": 1, \"b\": 2, \"c\": [{\"name\": \"john\"},{\"name\": \"scott\"}]}","type":"text"}]},{"type":"paragraph","content":[{"text":"The flattening process will be applied and you'll get the additional logs such as:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"json"},"content":[{"text":"{\"a\": 1, \"b\": 2, \"newRecord\": [{\"name\": \"john\"}]}\n{\"a\": 1, \"b\": 2, \"newRecord\": [{\"name\": \"scott\"}]}","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Source Event Obfuscation","type":"text"}]},{"type":"paragraph","content":[{"text":"There is no default source obfuscation for this collector.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Minimum configuration required for basic pulling","type":"text"}]},{"type":"paragraph","content":[{"text":"Although this collector supports advanced configuration, the fields required to retrieve data with basic configuration are defined below.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This minimum configuration refers exclusively to those specific parameters of this integration. There are more required parameters related to the generic behavior of the collector. Check setting sections for details.","type":"text"}]}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"c367918c-a9ae-4aa7-a39b-13c962a20ba0"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"Setting","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[446.0]},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"api_key_name","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[446.0]},"content":[{"type":"paragraph","content":[{"text":"The name of the API given in setup.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[313.0]},"content":[{"type":"paragraph","content":[{"text":"api_key","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[446.0]},"content":[{"type":"paragraph","content":[{"text":"The key generated in setup.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Accepted authentication methods","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"0819b663-566b-411b-91f6-1c4218cb8659"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Authentication method","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"api_key_name","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"api_key","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"OAuth2","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"green","style":"bold","text":"REQUIRED","localId":"fcf73d9b-cc01-4ce2-a4f3-f4a8e9d0f8be"}},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"green","style":"bold","text":"REQUIRED","localId":"a200f491-4681-49e1-b010-7b7b63ef1733"}}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Vendor setup","type":"text"}]},{"type":"paragraph","content":[{"text":"Follow these steps to get the required credentials:","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-steps-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"9bf7a9cc-c8dd-49f8-8d5d-f9461942b975"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step-container.png"}}],"title":"Refined Step Container"}},"localId":"98ce4309-2ef9-4caf-80b7-c417ff710a39"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"44a964aa-4505-4dc7-bca6-6990b96203c4"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"bb95b60a-eaa6-4ce1-9c6e-df3b2d94d9c7"}},{"type":"paragraph","content":[{"text":"Log in to Helios using your username and password.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":602,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1912,"alt":"image-20240620-105040.png","id":"a5493d8e-4e7d-4369-be6c-8682e2656d08","collection":"contentId-676233217","type":"file","height":1063}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"d4649681-5594-4091-9cbb-88a0f950b8cd"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"6baf7373-e7da-4c23-9454-2c46af241234"}},{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Settings","type":"text","marks":[{"type":"strong"}]},{"text":" icon at the top right corner and select ","type":"text"},{"text":"Access Management","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":606,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1911,"alt":"image-20240620-105255.png","id":"100be09b-8ace-4b4a-bd24-b738335c737e","collection":"contentId-676233217","type":"file","height":1057}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"e2245b0f-97ce-45ef-b463-d9ee87a52653"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"d17cf7c7-6918-4c65-a289-8c0daee0d5b7"}},{"type":"paragraph","content":[{"text":"From the available tabs, select ","type":"text"},{"text":"API Keys","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":588,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1910,"alt":"image-20240620-105351.png","id":"a676e18e-0f9c-4824-894b-795e2c8cc5b2","collection":"contentId-676233217","type":"file","height":1035}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"4b8021d2-1314-4c29-865b-b82c06c3b365"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"4c9ec8ba-c810-44d6-9e7f-c388099d8b4f"}},{"type":"paragraph","content":[{"text":"Click the ","type":"text"},{"text":"Add API Key","type":"text","marks":[{"type":"strong"}]},{"text":" button. ","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":638,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1910,"alt":"image-20240620-105444.png","id":"45f39403-b46f-4066-a4e1-72b385585071","collection":"contentId-676233217","type":"file","height":550}}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"3447b722-306a-475c-90b1-5d76d439e32d"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"afbe2c2f-cc43-4eb2-a292-97f0402d88ef"}},{"type":"paragraph","content":[{"text":"Give the API key a name and click the ","type":"text"},{"text":"Save","type":"text","marks":[{"type":"strong"}]},{"text":" button.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":660,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1909,"alt":"image-20240620-105524.png","id":"bf278974-fa71-430f-96ce-983a40cccb4b","collection":"contentId-676233217","type":"file","height":405}}]},{"type":"paragraph","content":[{"text":"Note that once you navigate to a different page from this page, you won't be able to view the ","type":"text"},{"text":"apiKey","type":"text","marks":[{"type":"strong"}]},{"text":" again, so copy and save it.","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-step","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"ef292eb9-836b-4099-83c6-6009e05ba8c8"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/step.png"}}],"title":"Refined Step"}},"localId":"5cfc1a11-eb2c-4192-bcff-035c2ec7abc8"}},{"type":"paragraph","content":[{"text":"Copy the key and API name, those are the credentials needed.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":674,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":1909,"alt":"image-20240620-105622.png","id":"2a7b1a37-568b-484f-867f-17f17b535021","collection":"contentId-676233217","type":"file","height":421}}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Run the collector","type":"text"}]},{"type":"paragraph","content":[{"text":"Once the data source is configured, you can either send us the required information if you want us to host and manage the collector for you (","type":"text"},{"text":"Cloud collector","type":"text","marks":[{"type":"underline"}]},{"text":"), or deploy and host the collector in your own machine using a Docker image (","type":"text"},{"text":"On-premise collector","type":"text","marks":[{"type":"underline"}]},{"text":").","type":"text"}]},{"type":"bodiedExtension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-ui-tabs-macro","parameters":{"macroParams":{},"macroMetadata":{"macroId":{"value":"6a805bc0-abf6-4d98-987c-6a9164c77642"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab-container.png"}}],"title":"Refined Tab Container"}},"localId":"51a38310-b288-4fb7-a20e-43dcd020e55a"},"content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"Cloud collector"}},"macroMetadata":{"macroId":{"value":"2825992cb366f7c43cdf1373692654dc"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"bf956792-3efe-4638-bb79-d031587fadb0"}},{"type":"codeBlock","attrs":{"language":"json"},"content":[{"text":"{\n \"global_overrides\": {\n \"debug\": false\n },\n \"inputs\": {\n \"cohesity\": {\n \"id\": \"\",\n \"enabled\": true,\n \"credentials\": {\n \"api_key_name\": \"\",\n \"api_key\": \"\"\n },\n \"services\": {\n \"audit\": {\n \"lookback\": \"\",\n \"lookback_width\": \"\",\n \"request_period_in_seconds\": \n },\n \"alerts\": {\n \"lookback\": \"\",\n \"lookback_width\": \"\",\n \"request_period_in_seconds\": \n }\n }\n }\n }\n}","type":"text"}]},{"type":"paragraph","content":[{"text":"The following table outlines the parameters available for configuring the collector. Each parameter is categorized by its necessity (mandatory or optional), data type, acceptable values or formats, and a brief description.","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"62f0c228-2455-4d24-81e2-80b0626608c0"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[173.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"Data type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Requirement","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Value range / Format","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[173.0]},"content":[{"type":"paragraph","content":[{"text":"short_unique_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1, Max length: 5","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Short, unique ID for input service, used in persistence addressing. Avoid duplicates to prevent collisions.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[173.0]},"content":[{"type":"paragraph","content":[{"text":"api_key_name","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Api Key Name","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[173.0]},"content":[{"type":"paragraph","content":[{"text":"api_key","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Api Key","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[173.0]},"content":[{"type":"paragraph","content":[{"text":"lookback_value","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Amount of time to look back and extract data. This is usually seconds, but can be a specific time like ","type":"text"},{"text":"1h","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"30m","type":"text","marks":[{"type":"code"}]},{"text":", etc. If not specified, by default its value is ","type":"text"},{"text":"1h","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[173.0]},"content":[{"type":"paragraph","content":[{"text":"lookback_width_value","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"The width of the slot to extract data from the look-back parameter. This is usually seconds, but can be a specific time like ","type":"text"},{"text":"1h","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"30m","type":"text","marks":[{"type":"code"}]},{"text":", etc. If specified, set the same amount as ","type":"text"},{"text":"request_period_in_seconds_value","type":"text","marks":[{"type":"code"}]},{"text":", or events will get lost or be duplicated. If not specified, by default its value is ","type":"text"},{"text":"5m","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[173.0]},"content":[{"type":"paragraph","content":[{"text":"request_period_in_seconds_value","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[110.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[109.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min: 60","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Custom period in seconds between data pulls, overriding default (180s).","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Parameters marked as \"Mandatory\" are required for the collector's configuration. Optional parameters can be omitted or removed if not used, but they provide additional customization and control over the collector's behavior.","type":"text"}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"rw-tab","parameters":{"macroParams":{"title":{"value":"On-premise collector"}},"macroMetadata":{"macroId":{"value":"0e08d10a084320745cfcad174c481cfb"},"schemaVersion":{"value":"1"},"placeholder":[{"type":"icon","data":{"url":"https://static.dg.refinedtheme.refinedwiki.com/refinedtheme-for-cloud/macro-icons/tab.png"}}],"title":"Refined Tab"}},"localId":"3392ad6b-e017-4587-96ac-e5e9d4459cb2"}},{"type":"paragraph","content":[{"text":"This data collector can be run in any machine that has the Docker service available because it should be executed as a docker container. The following sections explain how to prepare all the required setup for having the data collector running.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Structure","type":"text"}]},{"type":"paragraph","content":[{"text":"The following directory structure should be created for being used when running the collector:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n└── devo-collectors/\n └── /\n ├── certs/\n │ ├── chain.crt\n │ ├── .key\n │ └── .crt\n ├── state/\n └── config/ \n └── config.yaml ","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the proper value.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Devo credentials","type":"text"}]},{"type":"paragraph","content":[{"text":"To send data securely to the Devo platform, you will need to download X.509 Certificates from your Devo Domain:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Login to your Devo tenant.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"On the left menu, click on ","type":"text"},{"text":"Administration","type":"text","marks":[{"type":"strong"}]},{"text":", click on ","type":"text"},{"text":"Credentials","type":"text","marks":[{"type":"strong"}]},{"text":", then ","type":"text"},{"text":"X.509 Certificates","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Download your Certificate by clicking on ","type":"text"},{"text":"Certificate","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Download your Private Key by clicking on ","type":"text"},{"text":"Private Key","type":"text","marks":[{"type":"strong"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Download your Chain CA by clicking on ","type":"text"},{"text":"Chain CA.","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Move the downloaded files to ","type":"text"},{"text":"/certs/","type":"text","marks":[{"type":"code"}]},{"text":" folder.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"center","width":752,"widthType":"pixel"},"content":[{"type":"media","attrs":{"width":950,"alt":"image-20240613-130355.png","id":"8e0dd03d-904d-4fc0-94c8-4020b8deabfc","collection":"contentId-676233217","type":"file","height":448}}]},{"type":"paragraph","content":[{"text":"For more information about how to get the Devo certificates, please visit ","type":"text"},{"text":"Devo Docs","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.devo.com/space/latest/94763741/X.509+certificates"}}]},{"text":".","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the proper value.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Editing the config.yaml file","type":"text"}]},{"type":"codeBlock","attrs":{"language":"yaml"},"content":[{"text":"globals:\n debug: false\n id: not_used\n name: cohesity\n persistence:\n type: filesystem\n config:\n directory_name: state\n\noutputs:\n devo_1:\n type: devo_platform\n config:\n address: \n port: 443\n type: SSL\n chain: \n cert: \n key: \n\ninputs:\n cohesity:\n id: \n enabled: true\n credentials:\n api_key_name: \n api_key: \n services:\n audit:\n lookback: \n lookback_width: \n request_period_in_seconds: \n alerts:\n lookback: \n lookback_width: \n request_period_in_seconds: ","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"All defined service entities will be executed by the collector. If you do not want to run any of them, just remove the entity from the ","type":"text"},{"text":"services","type":"text","marks":[{"type":"code"}]},{"text":" object.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The following table outlines the parameters available for configuring the collector. Each parameter is categorized by its necessity (mandatory or optional), data type, acceptable values or formats, and a brief description. Replace the placeholders with your required values following the description table below:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"f0ad0e7e-1b63-4806-b56e-bcbeb1ae6977"},"content":[{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"Parameter","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"Data type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Requirement","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Value range / Format","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"background":"#f4f5f7","rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"collector_id_value","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1, Max length: 5","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Unique identifier for the collector.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"collector_name_value","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1, Max length: 10","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Name assigned to the collector.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"devo_address","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"One of: ","type":"text"},{"text":"collector-us.devo.io","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"collector-eu.devo.io","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Devo Cloud destination for events.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"chain_filename","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 4, Max length: 20","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Filename of the ","type":"text"},{"text":"chain.crt","type":"text","marks":[{"type":"code"}]},{"text":" file from your Devo domain.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"cert_filename","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 4, Max length: 20","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Filename of the ","type":"text"},{"text":"file.cert","type":"text","marks":[{"type":"code"}]},{"text":" from your Devo domain.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"key_filename","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 4, Max length: 20","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Filename of the ","type":"text"},{"text":"file.key","type":"text","marks":[{"type":"code"}]},{"text":" from your Devo domain.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"short_unique_id","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1, Max length: 5","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Short, unique ID for input service, used in persistence addressing. Avoid duplicates to prevent collisions.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"api_key_name","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Api Key Name","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"api_key","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Mandatory","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Api Key","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"lookback_value","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Amount of time to look back and extract data. This is usually seconds, but can be a specific time like ","type":"text"},{"text":"1h","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"30m","type":"text","marks":[{"type":"code"}]},{"text":", etc. If not specified, by default its value is ","type":"text"},{"text":"1h","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"lookback_width_value","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"str","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min length: 1","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"The width of the slot to extract data from the look-back parameter. This is usually seconds, but can be a specific time like ","type":"text"},{"text":"1h","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"30m","type":"text","marks":[{"type":"code"}]},{"text":", etc. If specified, set the same amount as ","type":"text"},{"text":"request_period_in_seconds_value","type":"text","marks":[{"type":"code"}]},{"text":", or events will get lost or be duplicated. If not specified, by default its value is ","type":"text"},{"text":"5m","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[178.0]},"content":[{"type":"paragraph","content":[{"text":"request_period_in_seconds_value","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[87.0]},"content":[{"type":"paragraph","content":[{"text":"int","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Optional","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Min: 60","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[127.0]},"content":[{"type":"paragraph","content":[{"text":"Custom period in seconds between data pulls, overriding default (300s).","type":"text"}]}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"Parameters marked as \"Mandatory\" are required for the collector's configuration. Optional parameters can be omitted or removed if not used, but they provide additional customization and control over the collector's behavior.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Download the Docker image","type":"text"}]},{"type":"paragraph","content":[{"text":"The collector should be deployed as a Docker container. Download the Docker image of the collector as a .tgz file by clicking the link in the following table:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"b8b71399-05b4-4d13-96f9-f7654449f889"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Collector Docker image","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"SHA-256 hash","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"collector-cohesity_helios_if-docker-image-1.2.0","type":"text","marks":[{"type":"link","attrs":{"href":"https://drive.google.com/file/d/1mNZSkJeS3PSKegculGhUeeyxTAUYC-Tc/view?usp=drive_link"}}]},{"text":" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"40cd6b4439045881d75674bd34c5b496e39a218bdb5eb8df51752ab48849d14c","type":"text","marks":[{"type":"code"}]},{"text":" ","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Use the following command to add the Docker image to the system:","type":"text"}]},{"type":"codeBlock","content":[{"text":"gunzip -c -.tgz | docker load","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Once the Docker image is imported, it will show the real name of the Docker image (including version info). Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with a proper value.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"The Docker image can be deployed on the following services:","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Docker","type":"text"}]},{"type":"paragraph","content":[{"text":"Execute the following command on the root directory ","type":"text"},{"text":"/devo-collectors//","type":"text","marks":[{"type":"code"}]}]},{"type":"codeBlock","content":[{"text":"docker run \n--name collector- \n--volume $PWD/certs:/devo-collector/certs \n--volume $PWD/config:/devo-collector/config \n--volume $PWD/state:/devo-collector/state \n--env CONFIG_FILE=config.yaml \n--rm \n--interactive \n--tty \n:","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the proper values.","type":"text"}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Docker Compose","type":"text"}]},{"type":"paragraph","content":[{"text":"The following Docker Compose file can be used to execute the Docker container. It must be created in the ","type":"text"},{"text":"/devo-collectors//","type":"text","marks":[{"type":"code"}]},{"text":" directory.","type":"text"}]},{"type":"codeBlock","content":[{"text":"version: '3'\nservices:\n collector-:\n image: :${IMAGE_VERSION:-latest}\n container_name: collector-\n volumes:\n - ./certs:/devo-collector/certs\n - ./config:/devo-collector/config\n - ./credentials:/devo-collector/credentials\n - ./state:/devo-collector/state\n environment:\n - CONFIG_FILE=${CONFIG_FILE:-config.yaml}","type":"text"}]},{"type":"paragraph","content":[{"text":"To run the container using docker-compose, execute the following command from the ","type":"text"},{"text":"/devo-collectors//","type":"text","marks":[{"type":"code"}]},{"text":" directory:","type":"text"}]},{"type":"codeBlock","content":[{"text":"IMAGE_VERSION= docker-compose up -d","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Replace ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" with the proper values.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Collector services detail","type":"text"}]},{"type":"paragraph","content":[{"text":"This section is intended to explain how to proceed with specific actions for services.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Alerts (","type":"text"},{"text":"alerts","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Internal process and deduplication method","type":"text"}]},{"type":"paragraph","content":[{"text":"All alerts data are pulled with an Id value. The collector checks the Ids each run. Checkpoints are persisted to ensure that duplicate data is not sent to Devo.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Devo categorization and destination","type":"text"}]},{"type":"paragraph","content":[{"text":"All events of this service are ingested into the table ","type":"text"},{"text":"dmp.cohesity.helios.alerts","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Setup output","type":"text"}]},{"type":"codeBlock","content":[{"text":"2024-04-09T09:56:19.561389088Z 2024-04-09T09:56:19.561 WARNING InputProcess::CohesityPullerSetup(cohesity,cohesity#56752,alerts#predefined) -> Testing fetch from /mcm/alerts.\n2024-04-09T09:56:19.771898077Z 2024-04-09T09:56:19.771 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,relay_0) -> Number of available senders: 1, sender manager internal queue size: 0\n2024-04-09T09:56:19.772167710Z 2024-04-09T09:56:19.771 INFO OutputProcess::DevoSenderManagerMonitor(internal_senders,relay_0) -> Number of available senders: 1, sender manager internal queue size: 0\n2024-04-09T09:56:19.772327665Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,relay_0) -> enqueued_elapsed_times_in_seconds_stats: {}\n2024-04-09T09:56:19.772395427Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(internal_senders,relay_0) -> enqueued_elapsed_times_in_seconds_stats: {}\n2024-04-09T09:56:19.772425735Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(internal_senders,relay_0) -> Sender: DevoSender(internal_senders,devo_sender_0), status: {\"internal_queue_size\": 0, \"is_connection_open\": True}\n2024-04-09T09:56:19.772519048Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,relay_0) -> Sender: DevoSender(lookup_senders,devo_sender_0), status: {\"internal_queue_size\": 0, \"is_connection_open\": False}\n2024-04-09T09:56:19.772601144Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(internal_senders,relay_0) -> Internal - Total number of messages: 6333 messages/bytes sent since/to \"2024-04-09T09:51:19.771169+00:00/2024-04-09T09:56:19.772408+00:00\": 25/13762, (elapsed 0.052 seconds)\n2024-04-09T09:56:19.772631900Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,relay_0) -> Lookup - Total number of messages sent: 0, messages sent since \"2024-04-09 09:51:19.770969+00:00\": 0 (elapsed 0.000 seconds)\n2024-04-09T09:56:20.261298432Z 2024-04-09T09:56:20.261 INFO InputProcess::CohesityPullerSetup(cohesity,cohesity#56752,alerts#predefined) -> Successfully tested fetch from /mcm/alerts. Source is pullable.\n2024-04-09T09:56:20.262730750Z 2024-04-09T09:56:20.262 INFO InputProcess::CohesityPullerSetup(cohesity,cohesity#56752,alerts#predefined) -> Setup for module has been successfully executed","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Puller output","type":"text"}]},{"type":"codeBlock","content":[{"text":"2024-04-09T09:56:22.704294203Z 2024-04-09T09:56:22.704 INFO InputProcess::CohesityPuller(cohesity,56752,alerts,predefined) -> Pull Started\n2024-04-09T09:56:23.124016843Z 2024-04-09T09:56:23.123 INFO InputProcess::CohesityPuller(cohesity,56752,alerts,predefined) -> Updating the persistence\n2024-04-09T09:56:23.124811682Z 2024-04-09T09:56:23.124 INFO InputProcess::CohesityPuller(cohesity,56752,alerts,predefined) -> (Partial) Statistics for this pull cycle (@devo_pulling_id=1712656582704):Number of requests made: 535; Number of events received: 2; Number of duplicated events filtered out: 0; Number of events generated and sent: 2; Average of events per second: 4.759.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Restart the persistence","type":"text"}]},{"type":"paragraph","content":[{"text":"Update the unique ID of the collector and restart, this will remove the Id values that have been pulled. This may cause duplicates.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Audit (","type":"text"},{"text":"audit","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Internal process and deduplication method","type":"text"}]},{"type":"paragraph","content":[{"text":"Audit logs are pulled with a start time value, that value is updated anytime logs are found. If no logs are found the start time is not persisted. The start time will be used until logs are found.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Devo categorization and destination","type":"text"}]},{"type":"paragraph","content":[{"text":"All events of this service are ingested into the table ","type":"text"},{"text":"dmp.cohesity.helios.audit","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Setup output","type":"text"}]},{"type":"codeBlock","content":[{"text":"2024-04-09T09:56:19.561389088Z 2024-04-09T09:56:19.561 WARNING InputProcess::CohesityPullerSetup(cohesity,cohesity#56752,audit#predefined) -> Testing fetch from /mcm/get-audit.\n2024-04-09T09:56:19.771898077Z 2024-04-09T09:56:19.771 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,relay_0) -> Number of available senders: 1, sender manager internal queue size: 0\n2024-04-09T09:56:19.772167710Z 2024-04-09T09:56:19.771 INFO OutputProcess::DevoSenderManagerMonitor(internal_senders,relay_0) -> Number of available senders: 1, sender manager internal queue size: 0\n2024-04-09T09:56:19.772327665Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,relay_0) -> enqueued_elapsed_times_in_seconds_stats: {}\n2024-04-09T09:56:19.772395427Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(internal_senders,relay_0) -> enqueued_elapsed_times_in_seconds_stats: {}\n2024-04-09T09:56:19.772425735Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(internal_senders,relay_0) -> Sender: DevoSender(internal_senders,devo_sender_0), status: {\"internal_queue_size\": 0, \"is_connection_open\": True}\n2024-04-09T09:56:19.772519048Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,relay_0) -> Sender: DevoSender(lookup_senders,devo_sender_0), status: {\"internal_queue_size\": 0, \"is_connection_open\": False}\n2024-04-09T09:56:19.772601144Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(internal_senders,relay_0) -> Internal - Total number of messages: 6333 messages/bytes sent since/to \"2024-04-09T09:51:19.771169+00:00/2024-04-09T09:56:19.772408+00:00\": 25/13762, (elapsed 0.052 seconds)\n2024-04-09T09:56:19.772631900Z 2024-04-09T09:56:19.772 INFO OutputProcess::DevoSenderManagerMonitor(lookup_senders,relay_0) -> Lookup - Total number of messages sent: 0, messages sent since \"2024-04-09 09:51:19.770969+00:00\": 0 (elapsed 0.000 seconds)\n2024-04-09T09:56:20.261298432Z 2024-04-09T09:56:20.261 INFO InputProcess::CohesityPullerSetup(cohesity,cohesity#56752,audit#predefined) -> Successfully tested fetch from /mcm/get-audit. Source is pullable.\n2024-04-09T09:56:20.262730750Z 2024-04-09T09:56:20.262 INFO InputProcess::CohesityPullerSetup(cohesity,cohesity#56752,audit#predefined) -> Setup for module has been successfully executed","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Puller output","type":"text"}]},{"type":"codeBlock","content":[{"text":"2024-04-09T09:56:22.704294203Z 2024-04-09T09:56:22.704 INFO InputProcess::CohesityPuller(cohesity,56752,audit,predefined) -> Pull Started\n2024-04-09T09:56:23.124016843Z 2024-04-09T09:56:23.123 INFO InputProcess::CohesityPuller(cohesity,56752,audit,predefined) -> Updating the persistence\n2024-04-09T09:56:23.124811682Z 2024-04-09T09:56:23.124 INFO InputProcess::CohesityPuller(cohesity,56752,audit,predefined) -> (Partial) Statistics for this pull cycle (@devo_pulling_id=1712656582704):Number of requests made: 535; Number of events received: 2; Number of duplicated events filtered out: 0; Number of events generated and sent: 2; Average of events per second: 4.759.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Restart the persistence","type":"text"}]},{"type":"paragraph","content":[{"text":"Update the unique Id of the collector and restart, this will remove the Id values that have been pulled. This may cause duplicates.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Troubleshooting","type":"text"}]},{"type":"paragraph","content":[{"text":"This collector has different security layers that detect both an invalid configuration and abnormal operation. This table will help you detect and resolve the most common errors.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Common logic","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"9d42d03a-7e19-46a4-8cc4-a09a0435f545"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Error Type","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Error Id","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Error Message","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Cause","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Solution","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"InitVariablesError ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"1 ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"\"lookback\" parameter must be a valid time string. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"The parameter has an unexpected type. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Review the configuration and ensure it is a string. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"InitVariablesError ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"2 ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"\"lookback_width\" parameter must be a valid time string. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"The parameter has an unexpected type. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Review the configuration and ensure it is a string. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"InitVariablesError ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"3 ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"\"lookback_width\" is greater than \"lookback\" ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"The parameter has an invalid value. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Ensure the value is less than \"lookback\". ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"InitVariablesError ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"4 ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"\"lookback_width\" must be the same as the \"request_period_in_seconds\" parameter ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"The parameter is not the same as \"request_period_in_seconds\". ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Ensure both values are the same. ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"ApiError ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"496 ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Connection Error - Ensure the URL parameters are correct and the that host has access to the server. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Could not connect to the Host ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Ensure the endpoint is reachable with the credentials ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"ApiError ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"497 ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Max Retries Error - Request attempts with {retries} retries failed. \\n{reason} ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Max Retries Hit ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Update rate limits ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"SetUpError ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"102 ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Failed to fetch from {endpoint}. Error: {e} ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"The collector was unable to access the specified endpoint. ","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Ensure the endpoint is reachable with the credentials ","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Collector operations","type":"text"}]},{"type":"paragraph","content":[{"text":"This section is intended to explain how to proceed with specific operations of this collector.","type":"text"}]},{"type":"expand","attrs":{"title":"Verify collector operations"},"content":[{"type":"heading","attrs":{"level":3},"content":[{"text":"Initialization","type":"text"}]},{"type":"paragraph","content":[{"text":"The initialization module is in charge of setup and running the input (pulling logic) and output (delivering logic) services and validating the given configuration.","type":"text"}]},{"type":"paragraph","content":[{"text":"A successful run has the following output messages for the initializer module:","type":"text"}]},{"type":"codeBlock","content":[{"text":"2023-01-10T15:22:57.146 INFO MainProcess::MainThread -> Loading configuration using the following files: {\"full_config\": \"config-test-local.yaml\", \"job_config_loc\": null, \"collector_config_loc\": null}\n2023-01-10T15:22:57.146 INFO MainProcess::MainThread -> Using the default location for \"job_config_loc\" file: \"/etc/devo/job/job_config.json\"\n2023-01-10T15:22:57.147 INFO MainProcess::MainThread -> \"\\etc\\devo\\job\" does not exists\n2023-01-10T15:22:57.147 INFO MainProcess::MainThread -> Using the default location for \"collector_config_loc\" file: \"/etc/devo/collector/collector_config.json\"\n2023-01-10T15:22:57.148 INFO MainProcess::MainThread -> \"\\etc\\devo\\collector\" does not exists\n2023-01-10T15:22:57.148 INFO MainProcess::MainThread -> Results of validation of config files parameters: {\"config\": \"C:\\git\\collectors2\\devo-collector-\\config\\config.yaml\", \"config_validated\": True, \"job_config_loc\": \"/etc/devo/job/job_config.json\", \"job_config_loc_default\": True, \"job_config_loc_validated\": False, \"collector_config_loc\": \"/etc/devo/collector/collector_config.json\", \"collector_config_loc_default\": True, \"collector_config_loc_validated\": False}\n2023-01-10T15:22:57.171 WARNING MainProcess::MainThread -> [WARNING] Illegal global setting has been ignored -> multiprocessing: False","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Events delivery and Devo ingestion","type":"text"}]},{"type":"paragraph","content":[{"text":"The event delivery module is in charge of receiving the events from the internal queues where all events are injected by the pullers and delivering them using the selected compatible delivery method.","type":"text"}]},{"type":"paragraph","content":[{"text":"A successful run has the following output messages for the initializer module:","type":"text"}]},{"type":"codeBlock","content":[{"text":"2023-01-10T15:23:00.788 INFO OutputProcess::MainThread -> DevoSender(standard_senders,devo_sender_0) -> Starting thread\n2023-01-10T15:23:00.789 INFO OutputProcess::MainThread -> DevoSenderManagerMonitor(standard_senders,devo_1) -> Starting thread (every 300 seconds)\n2023-01-10T15:23:00.790 INFO OutputProcess::MainThread -> DevoSenderManager(standard_senders,manager,devo_1) -> Starting thread\n2023-01-10T15:23:00.842 INFO OutputProcess::MainThread -> global_status: {\"output_process\": {\"process_id\": 18804, \"process_status\": \"running\", \"thread_counter\": 21, \"thread_names\": [\"MainThread\", \"pydevd.Writer\", \"pydevd.Reader\", \"pydevd.CommandThread\", \"pydevd.CheckAliveThread\", \"DevoSender(standard_senders,devo_sender_0)\", \"DevoSenderManagerMonitor(standard_senders,devo_1)\", \"DevoSenderManager(standard_senders,manager,devo_1)\", \"OutputStandardConsumer(standard_senders_consumer_0)\",","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Sender services","type":"text"}]},{"type":"paragraph","content":[{"text":"The Integrations Factory Collector SDK has 3 different senders services depending on the event type to delivery (","type":"text"},{"text":"internal","type":"text","marks":[{"type":"code"}]},{"text":", ","type":"text"},{"text":"standard","type":"text","marks":[{"type":"code"}]},{"text":", and ","type":"text"},{"text":"lookup","type":"text","marks":[{"type":"code"}]},{"text":"). This collector uses the following Sender Services:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"6bd704ef-0e1e-4407-992c-002264d15132"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[234.0]},"content":[{"type":"paragraph","content":[{"text":"Sender services","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[416.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[234.0]},"content":[{"type":"paragraph","content":[{"text":"internal_senders","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[416.0]},"content":[{"type":"paragraph","content":[{"text":"In charge of delivering internal metrics to Devo such as logging traces or metrics.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[234.0]},"content":[{"type":"paragraph","content":[{"text":"standard_senders","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[416.0]},"content":[{"type":"paragraph","content":[{"text":"In charge of delivering pulled events to Devo.","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Sender statistics","type":"text"}]},{"type":"paragraph","content":[{"text":"Each service displays its own performance statistics that allow checking how many events have been delivered to Devo by type:","type":"text"}]},{"type":"table","attrs":{"layout":"default","localId":"b4ce6589-85aa-4583-b31b-545216de40ff"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Logging trace","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"background":"var(--ds-background-neutral, #F4F5F7)","rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Number of available senders: 1","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Displays the number of concurrent senders available for the given Sender Service.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"sender manager internal queue size: 0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Displays the items available in the internal sender queue.","type":"text"}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"This value helps detect bottlenecks and needs to increase the performance of data delivery to Devo. This last can be made by increasing the concurrent senders.","type":"text"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Total number of messages sent: 57, messages sent since \"2023-01-10 16:09:16.116750+00:00\": 0 (elapsed 0.000 seconds)","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[325.0]},"content":[{"type":"paragraph","content":[{"text":"Displays the number of events from the last time and following the given example, the following conclusions can be obtained:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"44 events were sent to Devo since the collector started.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The last checkpoint timestamp was ","type":"text"},{"text":"2023-01-10 16:09:16.116750+00:00","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"21 events where sent to Devo between the last UTC checkpoint and now.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Those 21 events required ","type":"text"},{"text":"0.00 seconds","type":"text","marks":[{"type":"code"}]},{"text":" to be delivered.","type":"text"}]}]}]}]}]}]}]},{"type":"expand","attrs":{"title":"Check memory usage"},"content":[{"type":"paragraph","content":[{"text":"To check the memory usage of this collector, look for the following log records in the collector which are displayed every 5 minutes by default, always after running the memory-free process.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The used memory is displayed by running processes and the sum of both values will give the total used memory for the collector.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The global pressure of the available memory is displayed in the ","type":"text"},{"text":"global","type":"text","marks":[{"type":"code"}]},{"text":" value.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"All metrics (Global, RSS, VMS) include the value before freeing and after ","type":"text"},{"text":"previous -> after freeing memory","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"codeBlock","content":[{"text":" INFO InputProcess::MainThread -> [GC] global: 20.4% -> 20.4%, process: RSS(34.50MiB -> 34.08MiB), VMS(410.52MiB ->\n 410.02MiB)\n INFO OutputProcess::MainThread -> [GC] global: 20.4% -> 20.4%, process: RSS(28.41MiB -> 28.41MiB), VMS(705.28MiB ->\n 705.28MiB)","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Change log","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"42ea3dd6-b3a4-45bd-882c-8f327c61a1db"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Release","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Released on","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Release type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Details","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Recommended actions","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"v1.2.0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1731542400000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"Improvement","localId":"b127a1bf-b279-4359-965d-f2bd42b5c993"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Improvements","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add parameters for the lookback window in the configuration","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated DCSDK to ","type":"text"},{"text":"1.13.1","type":"text","marks":[{"type":"code"}]}]}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Recommended version","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"v1.1.0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1728864000000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"blue","style":"bold","text":"Improvement","localId":"de1de771-1fae-4e1d-93cb-865e8e3ac4a5"}}]},{"type":"paragraph","content":[{"type":"status","attrs":{"color":"yellow","style":"bold","text":"bug fixing","localId":"031fc55e-beab-4e4c-821c-a72d99aee9eb"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Bug Fixes","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Fixed bug with flattening a none type","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Improvements","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated Docker Image for Vulnerability","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Updated DCSDK to ","type":"text"},{"text":"1.12.4","type":"text","marks":[{"type":"code"}]}]}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"Upgrade","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"v1.0.0","type":"text","marks":[{"type":"code"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"date","attrs":{"timestamp":"1712620800000"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"type":"status","attrs":{"color":"purple","style":"bold","text":"INITIAL RELEASE","localId":"31b82c56-fe92-4340-afec-15f705a983de"}}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"nestedExpand","attrs":{"title":"Details"},"content":[{"type":"paragraph","content":[{"text":"Initial release. Released with Audit and Alert services","type":"text"}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1},"content":[{"type":"paragraph","content":[{"text":"-","type":"text"}]}]}]}]},{"type":"paragraph"}],"version":1}

Browser not supported