Enabling ASM for GCP Service Extensions

Docs > Datadog Security > Application Security Management > Application Threat Management > Threat Management Setup > Enabling ASM Threat Detection using Datadog Tracing Libraries > Enabling ASM for GCP Service Extensions

ASM Service Extensions is in Preview

To try the preview of ASM Service Extensions for GCP, follow the setup instructions below.

You can enable application security with GCP Service Extensions within GCP Cloud Load Balancing. The Datadog Application Security Management (ASM) Service Extensions integration has support for threat detection and blocking.

Prerequisites

The Datadog Agent is installed and configured for your application’s operating system or container, cloud, or virtual environment.
Configure the Agent with Remote Configuration to block attackers using the Datadog UI.
In your GCP project, verify that you have either the project owner or editor role, or the relevant Compute Engine IAM roles: compute.instanceAdmin.v1 (to spin up instances) and compute.networkAdmin (to set up load balancing).
A GCP project with a Cloud Load Balancer configured with your services. Your Cloud Load Balancer must be one of the Application Load Balancers that supports Traffic Callouts.

Ensure that the Compute Engine API and Network Services API are enabled:

gcloud services enable compute.googleapis.com networkservices.googleapis.com

Enabling threat detection

Get started

On your GCP project, multiple steps are needed to fully create a Service Extension. Google Cloud provides guides to create a callout backend service and create a Service Extension as a traffic extension.

To integrate a Service Extension with ASM, do the following:

Create a new VM Compute instance using the Datadog Service Extensions Docker image. The image is available on the Datadog Go tracer GitHub Registry.

The Docker image exposes some settings:

Environment variable	Default value	Description
`DD_SERVICE_EXTENSION_HOST`	`0.0.0.0`	gRPC server listening address.
`DD_SERVICE_EXTENSION_PORT`	`443`	gRPC server port.
`DD_SERVICE_EXTENSION_HEALTHCHECK_PORT`	`80`	HTTP server port for health checks.

Configure the Datadog Agent to receive traces from the integration using the following environment variables:

Environment variable	Default value	Description
`DD_AGENT_HOST`	`localhost`	Hostname where your Datadog Agent is running.
`DD_TRACE_AGENT_PORT`	`8126`	Port of the Datadog Agent for trace collection.

Add the VM to an unmanaged instance group.
Specify http:80 and grpc:443 (or any other previously configured values) for the port mappings of the instance group.
Update the load balancer by creating a backend service and adding a backend.
Create a callout backend service that uses the HTTP/2 protocol and has an HTTP health check:
- Protocol: HTTP2
- Port name: grpc
- Region: us-west1
- Health check port number: 80 (or any other previously configured value)
1. Add the instance group with the extension server as a backend to the backend service.
2. Create a Traffic Service Extension callout.
  1. In the Google Cloud console, go to Service Extensions and create a new Service Extension.
  2. Select your load balancer type.
  3. Select Traffic extensions as the type.
  4. Select your forwarding rules.
3. When creating a new Extension Chain, do the following:
  1. To send all traffic to the extension, insert true in the Match condition.
  2. For Programability type, select Callouts.
  3. Select the backend service you created in the previous step.
  4. Select all Events from the list where you want ASM to run detection.
    
    After this configuration is complete, the library collects security data from your application and sends it to the Agent. The Agent sends the data to Datadog, where out-of-the-box detection rules flag attacker techniques and potential misconfigurations so you can take steps to remediate.
To see Application Security Management threat detection in action, send known attack patterns to your application. For example, trigger the Security Scanner Detected rule by running a file that contains the following curl script:
```
for ((i=1;i<=250;i++)); 
do
# Target existing service’s routes
curl https://your-application-url/existing-route -A dd-test-scanner-log;
# Target non existing service’s routes
curl https://your-application-url/non-existing-route -A dd-test-scanner-log;
done
```
Note: The dd-test-scanner-log value is supported in the most recent releases.
A few minutes after you enable your application and send known attack patterns to it, threat information appears in the Application Signals Explorer and vulnerability information appears in the Vulnerability Explorer.

Datadog Go tracer and GCP Service Extensions

Note: The GCP Service Extensions integration is built on top of the Datadog Go Tracer. It follows the same release process as the tracer, and its Docker images are tagged with the corresponding tracer version.

The GCP Service Extensions integration uses the Datadog Go Tracer and inherits all environment variables from the tracer. You can find more information in Configuring the Go Tracing Library and ASM Library Configuration.