Skip to content

Commit d7737d3

Browse files
animehartanimehart
authored
Merge branch 'main' into new-findings-workflow-categories
2 parents ce1088a + d68f9ae commit d7737d3

29 files changed

Lines changed: 4064 additions & 3 deletions

‎.github/CODEOWNERS‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
/packages/activemq @elastic/obs-infraobs-integrations
1515
/packages/admin_by_request_epm @elastic/security-service-integrations
1616
/packages/airflow @elastic/obs-infraobs-integrations
17+
/packages/airlock_digital @elastic/security-service-integrations
1718
/packages/akamai @elastic/security-service-integrations
1819
/packages/amazon_security_lake @elastic/security-service-integrations
1920
/packages/apache @elastic/obs-infraobs-integrations

‎packages/airlock_digital/_dev/build/build.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
dependencies:
2+
ecs:
3+
reference: git@v8.17.0

‎packages/airlock_digital/_dev/build/docs/README.md‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
# Airlock Digital Integration for Elastic
2+
3+
## Overview
4+
5+
[Airlock Digital](https://www.airlockdigital.com/) delivers an easy-to-manage and scalable application control solution to protect endpoints with confidence. Built by cybersecurity professionals and trusted by organizations worldwide, Airlock Digital enforces a Deny by Default security posture to block all untrusted code, including unknown applications, unwanted scripts, malware, and ransomware.
6+
7+
The Airlock Digital integration for Elastic allows you to collect logs from, [Airlock Digital REST API](https://api.airlockdigital.com/), then visualise the data in Kibana.
8+
9+
### Compatibility
10+
11+
The Airlock Digital integration is compatible with `v6.1.x` and `v1` version of Airlock Digital REST API.
12+
13+
### How it works
14+
15+
This integration periodically queries the Airlock Digital REST API to retrieve Agent logs.
16+
17+
## What data does this integration collect?
18+
19+
This integration collects log messages of the following types:
20+
21+
- `Agent`: Collects agent logs via [Airlock Digital REST API](https://api.airlockdigital.com/#35ef50c6-1df4-4330-a433-1915ccf380cf).
22+
23+
### Supported use cases
24+
Integrating Airlock Digital agent logs with Elastic SIEM provides SOC teams with comprehensive visibility into endpoint policy enforcement and system activity. Dashboards highlight agent health, host and user patterns, OS distribution, group and policy metrics, storage availability, and trusted configurations, empowering efficient monitoring, proactive resource management, and improved operational readiness.
25+
26+
## What do I need to use this integration?
27+
28+
### From Airlock Digital
29+
30+
#### To collect data from the REST API:
31+
32+
1. In order to make the API calls, the User Group to which a user belongs should contain required permissions. You can follow the below steps for that:
33+
2. Go to the **Settings** and navigate to **Users** tab.
34+
3. Under **User Group Management** for the respective user group provide **agent/find** and **group/policies** roles in the REST API Roles section and click on save.
35+
36+
#### Generate Client API key for Authentication:
37+
38+
1. Log in to your Airlock console.
39+
2. On the right side of the navigation bar, click on the dropdown with the user’s name and navigate to **My profile** section.
40+
3. Click on the **Generate API Key** button.
41+
4. Copy the displayed API key — it will be required later for configuration.
42+
43+
For more details, check [Documentation](https://api.airlockdigital.com/).
44+
45+
## How do I deploy this integration?
46+
47+
This integration supports both Elastic Agentless-based and Agent-based installations.
48+
49+
### Agentless-based installation
50+
51+
Agentless integrations allow you to collect data without having to manage Elastic Agent in your cloud. They make manual agent deployment unnecessary, so you can focus on your data instead of the agent that collects it. For more information, refer to [Agentless integrations](https://www.elastic.co/guide/en/serverless/current/security-agentless-integrations.html) and the [Agentless integrations FAQ](https://www.elastic.co/guide/en/serverless/current/agentless-integration-troubleshooting.html).
52+
53+
Agentless deployments are only supported in Elastic Serverless and Elastic Cloud environments. This functionality is in beta and is subject to change. Beta features are not subject to the support SLA of official GA features.
54+
55+
### Agent-based installation
56+
57+
Elastic Agent must be installed. For more details, check the Elastic Agent [installation instructions](docs-content://reference/fleet/install-elastic-agents.md). You can install only one Elastic Agent per host.
58+
59+
## Setup
60+
61+
1. In the top search bar in Kibana, search for **Integrations**.
62+
2. In the search bar, type **Airlock Digital**.
63+
3. Select the **Airlock Digital** integration from the search results.
64+
4. Select **Add Airlock Digital** to add the integration.
65+
5. Enable and configure only the collection methods which you will use.
66+
67+
* To **Collect Airlock Digital logs via API**, you'll need to:
68+
69+
- Configure **URL** and **API Key**.
70+
- Enable/Disable the required datasets.
71+
- For each dataset, adjust the integration configuration parameters if required, including the Interval, Preserve original event etc. to enable data collection.
72+
73+
6. Select **Save and continue** to save the integration.
74+
75+
### Validation
76+
77+
#### Dashboards populated
78+
79+
1. In the top search bar in Kibana, search for **Dashboards**.
80+
2. In the search bar, type **Airlock Digital**.
81+
3. Select a dashboard for the dataset you are collecting, and verify the dashboard information is populated.
82+
83+
## Performance and scaling
84+
85+
For more information on architectures that can be used for scaling this integration, check the [Ingest Architectures](https://www.elastic.co/docs/manage-data/ingest/ingest-reference-architectures) documentation.
86+
87+
## Reference
88+
89+
### ECS field reference
90+
91+
#### Agent
92+
93+
{{fields "agent"}}
94+
95+
### Example event
96+
97+
#### Agent
98+
99+
{{event "agent"}}
100+
101+
### Inputs used
102+
103+
These inputs can be used in this integration:
104+
105+
- [cel](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-cel)
106+
107+
### API usage
108+
109+
These integration datasets use the following API:
110+
111+
- `Agent`: [Airlock Digital REST API](https://api.airlockdigital.com/#35ef50c6-1df4-4330-a433-1915ccf380cf).

‎packages/airlock_digital/_dev/deploy/docker/docker-compose.yml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
version: '3.8'
2+
services:
3+
airlock_digital:
4+
image: docker.elastic.co/observability/stream:v0.20.0
5+
hostname: airlock_digital
6+
ports:
7+
- 8090
8+
volumes:
9+
- ./files:/files:ro
10+
environment:
11+
PORT: '8090'
12+
command:
13+
- http-server
14+
- --addr=:8090
15+
- --config=/files/config.yml

0 commit comments

Comments
 (0)