Cybersixgill Actionable Alerts

Supported OS Linux Windows Mac OS

Integration version1.0.1
이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Overview

The Cybersixgill actionable alerts check monitors critical assets across the deep, dark, and surface web such as IP addresses, domains, vulnerabilities, and VIPs. Receive alerts with context including severity, threat type, description, post snippet, recommendations, and assessments. This integration provides an out-of-the-box dashboard to prioritize and respond to threats.

Setup

Installation

To install the Cybersixgill actionable alerts check on your host:

  1. Install the developer tool on any machine.
  2. To build the package, run the command: ddev release build cybersixgill_actionable_alerts.
  3. Install the Datadog Agent on your host.
  4. Once the Agent is installed, run the following command to install the integration:
datadog-agent integration install -t datadog-cybersixgill-actionable-alerts==1.0.1

Configuration

  1. Reach out to Cybersixgill Support and request access to the Cybersixgill Developer Platform.
  2. Receive the welcome email with access to the Cybersixgill developer platform.
  3. Within the Cybersixgill developer platform, create the Client ID and Client secret.
  4. Copy the Client ID and Client secret and paste them into the Configuration.yaml file.
  5. Provide the minimum collection interval in seconds. For example, min_collection_interval: 3600

Validation

Verify that Cybersixgill events are generated in the Datadog Events Explorer .

Data Collected

Service Checks

cybersixgill_actionable_alert.can_connect
Returns OK If Client Id and Client Secret are present in an Instance. Returns CRITICAL If Configuration Errors occur.
Statuses: ok, critical

cybersixgill.health
Returns CRITICAL If the Agent is unable to connect to Cybersixgill API
Statuses: ok, critical

Events

This integration sends API-type events to Datadog.

Troubleshooting

Need help? Contact Cybersixgill support .