ๆฌกใงๅฉ็จๅฏ่ฝ:
Cloud SIEM
|
Cloud Security Management
|
Application Security Management
ๆคๅบใซใผใซใฏใๅใ่พผใใ ใในใฆใฎใญใฐใใใณใฏใฉใฆใๆงๆใซ้ฉ็จใใใๆกไปถไปใใญใธใใฏใๅฎ็พฉใใพใใๅฏพ่ฑกๆ้ๅ
ใซใใซใผใซใงๅฎ็พฉใใใๅฐใชใใจใ 1 ใคใฎใฑใผในใไธ่ดใใๅ ดๅใซใปใญใฅใชใใฃใทใฐใใซใ็ๆใใใพใใใใใใฎใทใฐใใซใฏใใทใฐใใซใจใฏในใใญใผใฉใผใง็ขบ่ชใงใใพใใ
ใใใซไฝฟใใๆคๅบใซใผใซ
Datadog ใฏใๆปๆ่
ใฎๆๆณใๆงๆใในใซใใฉใฐใ็ซใฆใใใใซใใใใซไฝฟใใๆคๅบใซใผใซใๆไพใใพใใๆฐใใๆคๅบใซใผใซใใชใชใผในใใใใจใๆงๆใซๅฟใใฆใๆฐ่ฆใซใผใซใ่ชๅใงใไฝฟใใฎใขใซใฆใณใใApplication Security Management ใฉใคใใฉใชใใใใณ Agent ใซใคใณใใผใใใใพใใ
ใใใซไฝฟใใใซใผใซใฏใไปฅไธใฎใปใญใฅใชใใฃ่ฃฝๅใงๅฉ็จๅฏ่ฝใงใใ
- Cloud SIEM ใฏใใญใฐๆคๅบใไฝฟ็จใใฆใๅใ่พผใพใใใญใฐใใชใขใซใฟใคใ ใงๅๆใใพใใ
- Cloud Security Management (CSM):
- CSM Misconfigurations ใงใฏใใฏใฉใฆใๆงๆใใใณใคใณใใฉในใใฉใฏใใฃใผๆงๆๆคๅบใซใผใซใไฝฟ็จใใฆใใฏใฉใฆใ็ฐๅขใฎ็ถๆ
ใในใญใฃใณใใพใใ
- CSM Threats ใฏใDatadog Agent ใจๆคๅบใซใผใซใไฝฟ็จใใฆใใทในใใ ใฎใขใฏใใฃใใใฃใ็ฉๆฅต็ใซ็ฃ่ฆใ่ฉไพกใใพใใ
- CSM Identity Risks ใฏใๆคๅบใซใผใซใไฝฟ็จใใฆใใฏใฉใฆใใคใณใใฉในใใฉใฏใใฃใผใซใใใ IAM ใใผในใฎใชในใฏใๆคๅบใใพใใ
- Application Security Management (ASM) ใฏใDatadog APMใDatadog Agentใๆคๅบใซใผใซใๆดป็จใใใขใใชใฑใผใทใงใณ็ฐๅขใซใใใ่
ๅจใๆคๅบใใพใใ
ใใผใฟๆคๅบใซใผใซ
Datadog ใฎใปใญใฅใชใใฃใชใตใผใใใผใ ใฏใ็ถ็ถ็ใซๆฐใใใใใซไฝฟใใใปใญใฅใชใใฃๆคๅบใซใผใซใ่ฟฝๅ ใใฆใใพใใใใฎ็ฎ็ใฏใใคใณใใฐใฌใผใทใงใณใใใฎไปใฎๆฐๆฉ่ฝใฎใชใชใผในใจใจใใซ้ซๅ่ณชใฎๆคๅบใๆไพใใใใจใงใใใใใฎใซใผใซใไธ่ฌ็ใซๅฉ็จๅฏ่ฝใซใใๅใซใๅคใใฎๅ ดๅใๅคง่ฆๆจกใงใฎๆคๅบใฎใใใฉใผใใณในใ่ฆณๅฏใใๅฟ
่ฆใใใใพใใใใใซใใใDatadog ใฎใปใญใฅใชใใฃใชใตใผใใฏใๅฝ็คพใฎๅบๆบใๆบใใใชใๆคๅบใฎๆฉไผใๆนๅใใใใ้ๆจๅฅจใซใใใใใๆ้ใๅพใใใจใใงใใพใใ
ใซในใฟใ ๆคๅบใซใผใซ
็ฐๅขใพใใฏใฏใผใฏใญใผใใซๅบใฅใใฆใซใผใซใใซในใฟใใคใบใใใๅ ดๅใใใใใใใใพใใใไพใใฐใASM ใไฝฟ็จใใฆใใๅ ดๅใใใธใในใ่กใใใฆใใชใๅฐๅใใๆฉๅฏใขใฏใทใงใณใๅฎ่กใใใฆใผใถใผใๆคๅบใใๆคๅบใซใผใซใใซในใฟใใคใบใใใใจๆใใใใใใพใใใ
ใซในใฟใ ใซใผใซใไฝๆใใใซใฏใใใใฉใซใใฎใซใผใซใ่ค่ฃฝใใฆใณใใผใ็ทจ้ใใใใ็ฌ่ชใฎใซใผใซใใผใญใใไฝๆใใพใใ
ๆคๅบใซใผใซใฎๆค็ดขใจใใฃใซใฟใผ
Datadog ใงใใใซไฝฟใใๆคๅบใซใผใซใจใซในใฟใ ๆคๅบใซใผใซใ่กจ็คบใใใซใฏใSecurity Settings ใใผใธใซ็งปๅใใพใใใซใผใซใฏใๅ่ฃฝๅ (Application SecurityใCloud Security ManagementใCloud SIEM) ใฎๅๅฅใฎใใผใธใซใชในใใใใฆใใพใใ
ใซใผใซใๆค็ดขใใใณใใฃใซใฟใชใณใฐใใใซใฏใๆค็ดขใใใฏในใจใใกใปใใใไฝฟ็จใใฆใๅคใงใฏใจใชใใพใใไพใใฐใๆๅฎใใใซใผใซใฟใคใใฎใซใผใซใฎใฟใ่กจ็คบใใใซใฏใใซใผใซใฟใคใใซใซใผใฝใซใๅใใใonly ใ้ธๆใใพใใใพใใๅไฟกใใๅ้กใ่ชฟๆปใใใณใใชใขใผใธใใ้ใซใsource ใ severity ใชใฉใฎใใกใปใใใงใใฃใซใฟใชใณใฐใใใใจใใงใใพใใ
ๆคๅบใซใผใซใฎไฝๆ
ใซในใฟใ ๆคๅบใซใผใซใไฝๆใใใซใฏใDetection Rules ใใผใธใฎๅณไธ้
ใซใใ New Rule ใใฟใณใใฏใชใใฏใใพใใใพใใๆขๅญใฎใใใฉใซใใซใผใซใพใใฏใซในใฟใ ใซใผใซใ่ค่ฃฝใใฆใใณใใฌใผใใจใใฆไฝฟ็จใใใใจใใงใใพใใ
่ฉณใใๆ้ ใซใคใใฆใฏใไปฅไธใฎ่จไบใๅ็
งใใฆใใ ใใใ
ๆคๅบใซใผใซใฎ็ฎก็
ใซใผใซใฎๆๅนๅใป็กๅนๅ
ใซใผใซใๆๅนใพใใฏ็กๅนใซใใใซใฏใใซใผใซๅใฎๅณๅดใซใใในใคใใใๅใๆฟใใพใใ
ใพใใใซใผใซใฎไธๆฌๆๅนๅใ็กๅนๅใๅฏ่ฝใงใใ
- Select Rules ใใฏใชใใฏใใพใใ
- ๆๅนๅใพใใฏ็กๅนๅใใใใซใผใซใ้ธๆใใพใใ
- Edit Rules ใใญใใใใฆใณใกใใฅใผใใฏใชใใฏใใพใใ
- Enable Rules ใพใใฏ Disable Rules ใ้ธๆใใพใใ
ใซใผใซใฎ็ทจ้
ใใใซไฝฟใใๆคๅบใซใผใซใฎๅ ดๅใๆๅถใฏใจใชใฎ่ฟฝๅ ใพใใฏ็ทจ้ใฎใฟใๅฏ่ฝใงใใใฏใจใชใฎๆดๆฐใใใชใฌใผใฎ่ชฟๆดใ้็ฅใฎ็ฎก็ใ่กใใซใฏใใใใฉใซใใฎใซใผใซใ่ค่ฃฝใใฆใใซในใฟใ ใซใผใซใฎใใณใใฌใผใใจใใฆไฝฟ็จใใพใใใใฎๅพใใใใฉใซใใฎใซใผใซใ็กๅนใซใใใใจใใงใใพใใ
- ใใใฉใซใใซใผใซใ็ทจ้ใใใซใฏใใซใผใซใฎ็ธฆ 3 ็นใกใใฅใผใใฏใชใใฏใใEdit default rule ใ้ธๆใใพใใ
- ใซในใฟใ ใซใผใซใ็ทจ้ใใใซใฏใใซใผใซใฎ็ธฆ 3 ็นใกใใฅใผใใฏใชใใฏใใEdit rule ใ้ธๆใใพใใ
ใซใผใซใฎ่ค่ฃฝ
ใซใผใซใ่ค่ฃฝใใใซใฏใใซใผใซใฎ็ธฆ 3 ็นใกใใฅใผใใฏใชใใฏใใClone rule ใ้ธๆใใพใใ
ใซใผใซใฎ่ค่ฃฝใฏใๆขๅญใฎใซใผใซใ่ค่ฃฝใใฆ่ปฝใ่จญๅฎใๅคๆดใใไปใฎๆคๅบ้ ๅใใซใใผใใใๅ ดๅใซไพฟๅฉใงใใไพใใฐใใญใฐๆคๅบใซใผใซใ่ค่ฃฝใใThreshold ใใ Anomaly ใซๅคๆดใใใใจใงใๅใใฏใจใชใจใใชใฌใผใไฝฟ็จใใฆ่
ๅจๆคๅบใซๆฐใใๆฌกๅ
ใ่ฟฝๅ ใใใใจใใงใใพใใ
ใซใผใซใๅ้ค
ใซในใฟใ ใซใผใซใๅ้คใใใซใฏใใซใผใซใฎ็ธฆ 3 ็นใกใใฅใผใใฏใชใใฏใใDelete rule ใ้ธๆใใพใใ
ๆณจ: ๅ้คใงใใใฎใฏใซในใฟใ ใซใผใซใ ใใงใใใใใฉใซใใฎใซใผใซใๅ้คใใใซใฏใใซใผใซใ็กๅนใซใใๅฟ
่ฆใใใใพใใ
็ทจ้ๆจฉ้ใฎๅถ้
By default, all users have view and edit access to the detection rules. To use granular access controls to limit the roles that may edit a single rule:
- Click the vertical three-dot menu for the rule and select Permissions.
- Click Restrict Access. The dialog box updates to show that members of your organization have Viewer access by default. Use that dropdown menu to select one or more roles, teams, or users that may edit the security rule.
- Use the dropdown menu to select one or more roles, teams, or users that may edit the security rule.
- Click Add.
- Click Save.
Note: To maintain your edit access to the rule, Datadog requires you to include at least one role that you are a member of before saving.
To restore access to a rule:
- Click the vertical three-dot menu for the rule and select Permissions.
- Click Restore Full Access.
- Click Save.
็ๆใใใใทใฐใใซใฎ็ขบ่ช
ใทใฐใใซใจใฏในใใญใผใฉใผใงใซใผใซใฎใปใญใฅใชใใฃใทใฐใใซใ็ขบ่ชใใใซใฏใ็ธฆ 3 ็นใกใใฅใผใใฏใชใใฏใใView generated signals ใ้ธๆใใพใใใใใฏใ่คๆฐใฎใฝใผในใใใฎใทใฐใใซใใซใผใซใใจใซ็ธ้ขใใใๅ ดๅใใใซใผใซใฎ็ฃๆปใๅฎไบใใใๅ ดๅใซไพฟๅฉใงใใ
ใซใผใซใ JSON ใจใใฆใจใฏในใใผใ
ใซใผใซใฎใณใใผใ JSON ใจใใฆใจใฏในใใผใใใใซใฏใใซใผใซใฎ็ธฆ 3 ็นใกใใฅใผใใฏใชใใฏใใExport as JSON ใ้ธๆใใพใใ
ใซใผใซ้ๆจๅฅจ
ใในใฆใฎๆคๅบใซใผใซใฎๅฎๆ็ใช็ฃๆปใ่กใใๅฟ ๅฎใชใทใฐใใซๅ่ณชใ็ถญๆใใพใใ้ๆจๅฅจใฎใซใผใซใฏใๆน่ฏใใใใซใผใซใซ็ฝฎใๆใใใใพใใ
ใซใผใซ้ๆจๅฅจใฎใใญใปในใฏไปฅไธใฎ้ใใงใใ
- ใซใผใซใซ้ๆจๅฅจใฎๆฅไปใๆธใใใ่ญฆๅใ่กจ็คบใใใฆใใพใใUI ใงใฏใ่ญฆๅใไปฅไธใซ่กจ็คบใใใพใใ
- ใทใฐใใซใตใคใใใใซใฎ Rule Details > Playbook ใปใฏใทใงใณ
- Misconfigurations ใตใคใใใใซ (CSM Misconfigurations ใฎใฟ)
- ใใฎ็นๅฎใฎใซใผใซใฎใซใผใซใจใใฃใฟใผ
- ใซใผใซใ้ๆจๅฅจใซใชใใจใใซใผใซใๅ้คใใใใพใงใซ 15 ใๆใฎๆ้ใใใใพใใใใใฏใใทใฐใใซใฎไฟๆๆ้ใ 15 ใๆใงใใใใใงใใใใฎ้ใUI ใงใซใผใซใฎ่ค่ฃฝใ่กใใจใใซใผใซใๅใณๆๅนใซใใใใจใใงใใพใใ
- ไธๅบฆๅ้คใใใใซใผใซใฏใ่ค่ฃฝใใฆๅๅบฆๆๅนใซใใใใจใฏใงใใพใใใ
ๅ่่ณๆ
ใๅฝนใซ็ซใคใใญใฅใกใณใใใชใณใฏใ่จไบ:
