Enabling ASM for GCP Service Extensions

Docs > Plateforme de sécurité Datadog > Application Security Management > Application Threat Management > Threat Management Setup > Enabling ASM Threat Detection using Datadog Tracing Libraries > Enabling ASM for GCP Service Extensions

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

ASM Service Extensions is in Preview

To try the preview of ASM Service Extensions for GCP, follow the setup instructions below.

You can enable application security with GCP Service Extensions within GCP Cloud Load Balancing. The Datadog Application Security Management (ASM) Service Extensions integration has support for threat detection and blocking.

Prerequisites

The Datadog Agent is installed and configured for your application’s operating system or container, cloud, or virtual environment.
Configure the Agent with Remote Configuration to block attackers using the Datadog UI.
In your GCP project, verify that you have either the project owner or editor role, or the relevant Compute Engine IAM roles: compute.instanceAdmin.v1 (to spin up instances) and compute.networkAdmin (to set up load balancing).
A GCP project with a Cloud Load Balancer configured with your services. Your Cloud Load Balancer must be one of the Application Load Balancers that supports Traffic Callouts.

Ensure that the Compute Engine API and Network Services API are enabled:

gcloud services enable compute.googleapis.com networkservices.googleapis.com

Enabling threat detection

Get started

On your GCP project, multiple steps are needed to fully create a Service Extension. Google Cloud provides guides to create a callout backend service and create a Service Extension as a traffic extension.

To integrate a Service Extension with ASM, do the following:

Create a new VM Compute instance using the Datadog Service Extensions Docker image. The image is available on the Datadog Go tracer GitHub Registry.

The Docker image exposes some settings:

Environment variable	Default value	Description
`DD_SERVICE_EXTENSION_HOST`	`0.0.0.0`	gRPC server listening address.
`DD_SERVICE_EXTENSION_PORT`	`443`	gRPC server port.
`DD_SERVICE_EXTENSION_HEALTHCHECK_PORT`	`80`	HTTP server port for health checks.

Configure the Datadog Agent to receive traces from the integration using the following environment variables:

Environment variable	Default value	Description
`DD_AGENT_HOST`	`localhost`	Hostname where your Datadog Agent is running.
`DD_TRACE_AGENT_PORT`	`8126`	Port of the Datadog Agent for trace collection.

Add the VM to an unmanaged instance group.
Specify http:80 and grpc:443 (or any other previously configured values) for the port mappings of the instance group.
Update the load balancer by creating a backend service and adding a backend.
Create a callout backend service that uses the HTTP/2 protocol and has an HTTP health check:
- Protocol: HTTP2
- Port name: grpc
- Region: us-west1
- Health check port number: 80 (or any other previously configured value)
1. Add the instance group with the extension server as a backend to the backend service.
2. Create a Traffic Service Extension callout.
  1. In the Google Cloud console, go to Service Extensions and create a new Service Extension.
  2. Select your load balancer type.
  3. Select Traffic extensions as the type.
  4. Select your forwarding rules.
3. When creating a new Extension Chain, do the following:
  1. To send all traffic to the extension, insert true in the Match condition.
  2. For Programability type, select Callouts.
  3. Select the backend service you created in the previous step.
  4. Select all Events from the list where you want ASM to run detection.
    
    Une fois cette configuration terminée, la bibliothèque recueille des données de sécurité à partir de votre application et les envoie à l’Agent, qui les transmet à son tour à Datadog. Les règles de détection prêtes à l’emploi signalent alors les attaques et les problèmes potentiels de configuration, afin que vous puissiez agir en conséquence.
Pour tester la détection des menaces Application Security Management, envoyez des patterns d’attaque connus à votre application. Par exemple, exécutez un fichier contenant le script curl suivant afin de déclencher la règle de détection de scanner de sécurité :
```
for ((i=1;i<=250;i++)); 
do
# Target existing service’s routes
curl https://your-application-url/existing-route -A dd-test-scanner-log;
# Target non existing service’s routes
curl https://your-application-url/non-existing-route -A dd-test-scanner-log;
done
```
Remarque : la plupart des versions récentes prennent en charge la valeur dd-test-scanner-log.
Quelques minutes après avoir activé votre application et envoyé les patterns d’attaque, des informations sur les menaces s’affichent dans l’Application Signals Explorer. Des informations sur les vulnérabilités apparaissent également dans le Vulnerability Explorer.

Datadog Go tracer and GCP Service Extensions

Note: The GCP Service Extensions integration is built on top of the Datadog Go Tracer. It follows the same release process as the tracer, and its Docker images are tagged with the corresponding tracer version.

The GCP Service Extensions integration uses the Datadog Go Tracer and inherits all environment variables from the tracer. You can find more information in Configuring the Go Tracing Library and ASM Library Configuration.