Skip to content

Commit efb4f69

Browse files
manan-crestavaid-crest
manan-crest
and
avaid-crest
authored
[SAASINT-4032] DDS: DNSFilter: Crawler Integration v1.0.0 (DataDog#20384)
* initial commit without assets * Adding changes into manifest file * Removed service_checks and added codeowners * Add: DNSFilter Assets * Update: facets in logs file * Update: fix CI checks and add sample results * Update: minor changes in overview dashboard * Update: address review * Update: map result to evt.outcome * Update: pipeline results * Remove Log Details Panel from Overview Dashboard * Updated dashboard image --------- Co-authored-by: Akshit Vaid <akshit.vaid@crestdata.ai>
1 parent 12e0ab3 commit efb4f69

11 files changed

Lines changed: 4835 additions & 54 deletions

‎dnsfilter/README.md‎

Lines changed: 32 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,43 +1,54 @@
1-
# Agent Check: DNSFilter
1+
# DNSFilter
22

33
## Overview
44

5-
This check monitors [DNSFilter][1].
5+
[DNSFilter][1] is a cloud-based content filtering tool that blocks internet threats at the DNS layer. It helps protect organizations by preventing access to malicious domains, phishing sites, and other cyber threats, ensuring a safer and more secure internet experience.
66

7-
## Setup
7+
This integration ingests the following logs:
8+
9+
- DNS Traffic Logs: Represents information about allowed and blocked DNS requests, threats, domains accessed, policies, networks, and other DNS-related traffic data.
810

9-
### Installation
11+
This integration collects DNS Traffic Logs, channeling them into Datadog for analysis. Leveraging the built-in logs pipeline, these logs are parsed and enriched, enabling search and analysis. The integration provides insight into DNS traffic logs through out-of-the-box dashboards and includes ready-to-use Cloud SIEM detection rules for improved monitoring and security.
12+
13+
## Setup
1014

11-
The DNSFilter check is included in the [Datadog Agent][2] package.
12-
No additional installation is needed on your server.
15+
### Generate API credentials in DNSFilter
1316

14-
### Configuration
17+
1. Login to the **DNSFilter dashboard** and navigate to **Account**.
18+
2. Select **Account Settings**.
19+
3. Navigate to the **Security** tab.
20+
4. Navigate to the **API Keys** section, then click **CREATE KEY**.
21+
5. Enter a key **Name** and select an **Expiration**.
22+
6. Click **GENERATE KEY**.
23+
7. Fetch the API Key from the **Your API Key** Section.
1524

16-
!!! Add list of steps to set up this integration !!!
25+
### Connect your DNSFilter account to Datadog
1726

18-
### Validation
27+
1. Add your API Key.
1928

20-
!!! Add steps to validate integration is functioning as expected !!!
29+
| Parameters | Description |
30+
| ------------------------------------- | ------------------------------------------------------------ |
31+
| API Key | The API Key of your DNSFilter platform |
32+
33+
2. Click the **Save** button to save your settings.
2134

2235
## Data Collected
2336

24-
### Metrics
37+
### Logs
2538

26-
DNSFilter does not include any metrics.
39+
The DNSFilter integration collects and forwards DNS traffic logs to Datadog.
2740

28-
### Service Checks
41+
### Metrics
2942

30-
DNSFilter does not include any service checks.
43+
The DNSFilter integration does not include any metrics.
3144

3245
### Events
3346

34-
DNSFilter does not include any events.
35-
36-
## Troubleshooting
47+
The DNSFilter integration does not include any events.
3748

38-
Need help? Contact [Datadog support][3].
49+
## Support
3950

40-
[1]: **LINK_TO_INTEGRATION_SITE**
41-
[2]: https://app.datadoghq.com/account/settings/agent/latest
42-
[3]: https://docs.datadoghq.com/help/
51+
Need help? Contact [Datadog support][2].
4352

53+
[1]: https://www.dnsfilter.com/
54+
[2]: https://docs.datadoghq.com/help/

‎dnsfilter/assets/dashboards/dnsfilter_overview.json‎

Lines changed: 1997 additions & 0 deletions
Large diffs are not rendered by default.

‎dnsfilter/assets/dashboards/dnsfilter_security_insights.json‎

Lines changed: 1898 additions & 0 deletions
Large diffs are not rendered by default.

‎dnsfilter/assets/dnsfilter.svg‎

Lines changed: 5 additions & 0 deletions
Loading

‎dnsfilter/assets/logs/dnsfilter.yaml‎

Lines changed: 189 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,189 @@
1+
id: dnsfilter
2+
metric_id: dnsfilter
3+
backend_only: false
4+
facets:
5+
- groups:
6+
- DNS
7+
name: Response Code
8+
path: dns.flags.rcode
9+
source: log
10+
- groups:
11+
- DNS
12+
name: Question Name
13+
path: dns.question.name
14+
source: log
15+
- groups:
16+
- DNS
17+
name: Question Type
18+
path: dns.question.type
19+
source: log
20+
- groups:
21+
- Event
22+
name: Event Outcome
23+
path: evt.outcome
24+
source: log
25+
- groups:
26+
- Geoip
27+
name: City Name
28+
path: network.client.geoip.city.name
29+
source: log
30+
- groups:
31+
- Geoip
32+
name: Continent Code
33+
path: network.client.geoip.continent.code
34+
source: log
35+
- groups:
36+
- Geoip
37+
name: Continent Name
38+
path: network.client.geoip.continent.name
39+
source: log
40+
- groups:
41+
- Geoip
42+
name: Country ISO Code
43+
path: network.client.geoip.country.iso_code
44+
source: log
45+
- groups:
46+
- Geoip
47+
name: Country Name
48+
path: network.client.geoip.country.name
49+
source: log
50+
- groups:
51+
- Geoip
52+
name: Subdivision ISO Code
53+
path: network.client.geoip.subdivision.iso_code
54+
source: log
55+
- groups:
56+
- Geoip
57+
name: Subdivision Name
58+
path: network.client.geoip.subdivision.name
59+
source: log
60+
- groups:
61+
- Web Access
62+
name: Client IP
63+
path: network.client.ip
64+
source: log
65+
- groups:
66+
- User
67+
name: User ID
68+
path: usr.id
69+
source: log
70+
- groups:
71+
- User
72+
name: User Name
73+
path: usr.name
74+
source: log
75+
pipeline:
76+
type: pipeline
77+
name: DNSFilter
78+
enabled: true
79+
filter:
80+
query: source:dnsfilter
81+
processors:
82+
- type: grok-parser
83+
name: Convert to epoch time
84+
enabled: true
85+
source: time
86+
samples:
87+
- 2025-05-02 07:05:46.529
88+
grok:
89+
supportRules: ""
90+
matchRules: rule %{date("yyyy-M-d H:m:s.SSS"):timestamp}
91+
- type: date-remapper
92+
name: Define `timestamp` as the official date of the log
93+
enabled: true
94+
sources:
95+
- timestamp
96+
- type: attribute-remapper
97+
name: Map `local_user_id` to `usr.id`
98+
enabled: true
99+
sources:
100+
- local_user_id
101+
sourceType: attribute
102+
target: usr.id
103+
targetType: attribute
104+
preserveSource: false
105+
overrideOnConflict: false
106+
- type: attribute-remapper
107+
name: Map `local_user_name` to `usr.name`
108+
enabled: true
109+
sources:
110+
- local_user_name
111+
sourceType: attribute
112+
target: usr.name
113+
targetType: attribute
114+
preserveSource: false
115+
overrideOnConflict: false
116+
- type: attribute-remapper
117+
name: Map `request_address` to `network.client.ip`
118+
enabled: true
119+
sources:
120+
- request_address
121+
sourceType: attribute
122+
target: network.client.ip
123+
targetType: attribute
124+
preserveSource: false
125+
overrideOnConflict: false
126+
- type: geo-ip-parser
127+
name: Extracting geolocation information from the Client IP
128+
enabled: true
129+
sources:
130+
- network.client.ip
131+
target: network.client.geoip
132+
ip_processing_behavior: do-nothing
133+
- type: attribute-remapper
134+
name: Map `domain` to `dns.question.name`
135+
enabled: true
136+
sources:
137+
- domain
138+
sourceType: attribute
139+
target: dns.question.name
140+
targetType: attribute
141+
preserveSource: false
142+
overrideOnConflict: false
143+
- type: attribute-remapper
144+
name: Map `result` to `evt.outcome`
145+
enabled: true
146+
sources:
147+
- result
148+
sourceType: attribute
149+
target: evt.outcome
150+
targetType: attribute
151+
preserveSource: false
152+
overrideOnConflict: false
153+
- type: attribute-remapper
154+
name: Map `question_type` to `dns.question.type`
155+
enabled: true
156+
sources:
157+
- question_type
158+
sourceType: attribute
159+
target: dns.question.type
160+
targetType: attribute
161+
preserveSource: false
162+
overrideOnConflict: false
163+
- type: category-processor
164+
name: Define `status` based on `threat` and `evt.outcome`
165+
enabled: true
166+
categories:
167+
- name: info
168+
filter:
169+
query: (@threat:true @evt.outcome:blocked) OR (@threat:false
170+
@evt.outcome:allowed) OR (@threat:false @evt.outcome:blocked)
171+
- name: warning
172+
filter:
173+
query: "@threat:true @evt.outcome:allowed"
174+
target: status
175+
- type: status-remapper
176+
name: Define `status` as the official status of the log
177+
enabled: true
178+
sources:
179+
- status
180+
- type: attribute-remapper
181+
name: Map `code` to `dns.flags.rcode`
182+
enabled: true
183+
sources:
184+
- code
185+
sourceType: attribute
186+
target: dns.flags.rcode
187+
targetType: attribute
188+
preserveSource: false
189+
overrideOnConflict: false

0 commit comments

Comments
 (0)