Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Placeholder for datadog certificate changed #782

Merged
merged 7 commits into from
Jan 21, 2022
Merged

Placeholder for datadog certificate changed #782

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0193585
Placeholder for datadog certificate changed
pramodgslab Jan 20, 2022
10d2392
Merge branch 'develop' into datadog_placeholder_change
pramodgslab Jan 20, 2022
75787f0
updated False to false text
pramodgslab Jan 20, 2022
6e76c35
Merge branch 'datadog_placeholder_change' of https://github.com/imm00…
pramodgslab Jan 20, 2022
e1be5cc
made changes in selfsignedcert
pramodgslab Jan 21, 2022
d8adc7b
Made changes - use ssl certificate or verify ssl false
pramodgslab Jan 21, 2022
89cc95a
Resolved undefined error
pramodgslab Jan 21, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 6 additions & 6 deletions stix_shifter_modules/datadog/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ Uses the data source API to ping the connection

CLI command example:
```
python3 main.py transmit datadog '{"site_url": <site_url>, "selfSignedCert": False}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' ping
python3 main.py transmit datadog '{"site_url": <site_url>, "selfSignedCert": false}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' ping
```
If connection establish returns the following response:
```
Expand All @@ -207,7 +207,7 @@ Queries the data source API with the translated query and returns the search id

CLI command example:
```
python3 main.py transmit datadog '{"site_url": <site_url>, "selfSignedCert": False}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' query "{\"query\": {\"tags\": \"account\", \"start\": 1627207221, \"end\": 1629972021}, \"source\": \"events\"}"
python3 main.py transmit datadog '{"site_url": <site_url>, "selfSignedCert": false}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' query "{\"query\": {\"tags\": \"account\", \"start\": 1627207221, \"end\": 1629972021}, \"source\": \"events\"}"
```

If successful, will return the following response:
Expand All @@ -224,7 +224,7 @@ Uses the data source API to fetch the query results based on the search ID, offs

CLI Command example for events dialect:
```
python3 main.py transmit datadog '{"site_url": <site_url>, "selfSignedCert": False}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' results "{\"query\": {\"tags\": \"account\", \"start\": 1627207221, \"end\": 1629972021}, \"source\": \"events\"}" <OFFSET> <LENGTH>
python3 main.py transmit datadog '{"site_url": <site_url>, "selfSignedCert": false}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' results "{\"query\": {\"tags\": \"account\", \"start\": 1627207221, \"end\": 1629972021}, \"source\": \"events\"}" <OFFSET> <LENGTH>
```
Returns following result
```json
Expand Down Expand Up @@ -252,7 +252,7 @@ Returns following result

CLI Command example for processes dialect:
```
python3 main.py transmit datadog '{"site_url": <site_url>, "selfSignedCert": False}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' results "{\"query\": {\"pid\": 92, \"start\": 1627207221, \"end\": 1629972021}, \"source\": \"processes\"}" <OFFSET> <LENGTH>
python3 main.py transmit datadog '{"site_url": <site_url>, "selfSignedCert": false}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' results "{\"query\": {\"pid\": 92, \"start\": 1627207221, \"end\": 1629972021}, \"source\": \"processes\"}" <OFFSET> <LENGTH>
```
Returns following result
```json
Expand Down Expand Up @@ -285,7 +285,7 @@ defined in the `to_stix_map.json` file.

CLI Command example for events dialect:
```
python3 main.py execute datadog:events datadog:events '{"type": "identity","id": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","name": "datadog","identity_class": "events"}' {"site_url": <site_url>, "selfSignedCert": False}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' "[x-datadog-event:tags = 'account'] START t'2021-09-19T00:00:00.000Z' STOP t'2021-09-24T00:00:00.000Z'"
python3 main.py execute datadog:events datadog:events '{"type": "identity","id": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","name": "datadog","identity_class": "events"}' {"site_url": <site_url>, "selfSignedCert": false}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' "[x-datadog-event:tags = 'account'] START t'2021-09-19T00:00:00.000Z' STOP t'2021-09-24T00:00:00.000Z'"
```

If successful, will return the following response
Expand Down Expand Up @@ -347,7 +347,7 @@ STIX Results:

CLI Command example for processes dialect:
```
python3 main.py execute datadog:processes datadog:processes '{"type": "identity","id": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","name": "datadog","identity_class": "events"}' {"site_url": <site_url>, "selfSignedCert": False}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' "[domain-name:value = 'win10vm4'] START t'2021-09-19T00:00:00.000Z' STOP t'2021-09-24T00:00:00.000Z'"
python3 main.py execute datadog:processes datadog:processes '{"type": "identity","id": "identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","name": "datadog","identity_class": "events"}' {"site_url": <site_url>, "selfSignedCert": false}' '{ "auth": { "api_key": <api_key>, "application_key": <application_key>}}' "[domain-name:value = 'win10vm4'] START t'2021-09-19T00:00:00.000Z' STOP t'2021-09-24T00:00:00.000Z'"
```

If successful, will return the following response
Expand Down
8 changes: 4 additions & 4 deletions stix_shifter_modules/datadog/stix_transmission/api_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@ def __init__(self, connection, configuration):
self.configuration = datadog_api_client.v1.Configuration(host=connection["site_url"])
self.configuration.api_key["apiKeyAuth"] = self.auth["api_key"]
self.configuration.api_key["appKeyAuth"] = self.auth["application_key"]
if connection["selfSignedCert"]:
if "selfSignedCert" in connection:
self.configuration.ssl_ca_cert = connection["selfSignedCert"]
else:
self.configuration.verify_ssl = connection["selfSignedCert"]
self.configuration.verify_ssl = False
urllib3.disable_warnings()

def ping_data_source(self):
Expand Down Expand Up @@ -62,10 +62,10 @@ def get_processes_results(self):
configuration = datadog_api_client.v2.Configuration(host=self.connection["site_url"])
configuration.api_key["apiKeyAuth"] = self.auth["api_key"]
configuration.api_key["appKeyAuth"] = self.auth["application_key"]
if self.connection["selfSignedCert"]:
if "selfSignedCert" in self.connection:
mdazam1942 marked this conversation as resolved.
Show resolved Hide resolved
configuration.ssl_ca_cert = self.connection["selfSignedCert"]
else:
configuration.verify_ssl = self.connection["selfSignedCert"]
configuration.verify_ssl = False
with datadog_api_client.v2.ApiClient(configuration) as api_client:
api_instance = processes_api.ProcessesApi(api_client)
try:
Expand Down