Digital Guardian

<div class="condensed-table">
| | |
| --- | --- |
| Version | 1.3.1 (View all) |
| Compatible Kibana version(s) | 8.13.0 or higher |
| Supported Serverless project types
What’s this? | Security
Observability |
| Subscription level
What’s this? | Basic |
| Level of support
What’s this? | Elastic |

</div>
This integration is for ingesting events and alerts from Fortra’s Digital Guardian. Fortra’s Digital Guardian helps organizations protect data, performing across the corporate network, traditional endpoints, and cloud applications. Digital Guardian’s data loss prevention, available as a software-as-a-service or managed service, helps to see that data, support compliance initiatives, and protect against serious risk.

The integration allows collection of events and alerts from Digital Guardian Analytics & Reporting Cloud (ARC) via the REST API.

The Digital Guardian integration collects events to populate following data-streams:

• digital_guardian.arc: Collects all events and alerts from Digital Guardian Analytics & Reporting Cloud (ARC) via the REST API.

Elastic Agent must be installed. For more details and installation instructions, please refer to the Elastic Agent Installation Guide.

There are several options for installing and managing Elastic Agent:

With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.

With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.

You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes.

Please note, there are minimum requirements for running Elastic Agent. For more information, refer to the Elastic Agent Minimum Requirements.

1. Copy Client ID: From ARC Tenant Settings, copy the Tenant ID.

2. Copy Client Secret: From ARC Tenant Settings, copy the Authentication Token.

3. Copy ARC Server URL: From Digital Guardian Management Console (DGMC), copy the Access Gateway Base URL.

4. Copy Authorization Server URL: From Digital Guardian Management Console (DGMC), copy the Authorization server URL.

5. Copy ARC Export Profile ID:

   • Navigate to Admin > reports > export profiles
   • Copy only the GUID part from the export profile.

1. In Kibana navigate to Management > Integrations.

2. In "Search for integrations" top bar, search for Digital Guardian.

3. Select the "Digital Guardian" integration from the search results.

4. Select "Add Digital Guardian" to add the integration.

5. Configure all required integration parameters.

   • ARC data requires following parameters:

     • Client ID
     • Client Secret
     • ARC Server URL
     • Authorization Server URL
     • ARC Export Profile ID

6. Save the integration.

This is the arc dataset.

The @timestamp field will be assigned one of several values, in the following order of precedence:

1. digital_guardian.arc.dg_time
2. digital_guardian.arc.dg_processed_time
3. digital_guardian.arc.inc_mtime
4. The time received by the pipeline (if none of the above are available).

{
    "@timestamp": "2023-05-23T06:56:39.000Z",
    "agent": {
        "ephemeral_id": "bc19c27a-7a31-4b0c-b04b-b3be2ab95a02",
        "id": "1edfb948-2ef5-4b96-8747-225d782bb6dd",
        "name": "docker-fleet-agent",
        "type": "filebeat",
        "version": "8.13.0"
    },
    "data_stream": {
        "dataset": "digital_guardian.arc",
        "namespace": "19912",
        "type": "logs"
    },
    "digital_guardian": {
        "arc": {
            "dg_description": "This file outlook.exe was going to [demo.digitalg@gmail.com]",
            "dg_guid": "1dc3c1fa-5474-4fc0-a7c3-74ff42d28e5e",
            "dg_name": "test has attached a Salesforce data to an email",
            "dg_tenant": "279b59f3-02f3-44ea-a7c3-9bac2eb0224d",
            "dg_utype": "Incident",
            "inc_assign": "test@dgdemo",
            "inc_creator": "dg",
            "inc_id": "230523-WIQHA",
            "inc_mtime": "2023-05-23T06:56:39.000Z",
            "inc_sev": "Critical",
            "inc_state": "Created"
        }
    },
    "ecs": {
        "version": "8.11.0"
    },
    "elastic_agent": {
        "id": "1edfb948-2ef5-4b96-8747-225d782bb6dd",
        "snapshot": false,
        "version": "8.13.0"
    },
    "event": {
        "action": "incident-created",
        "agent_id_status": "verified",
        "dataset": "digital_guardian.arc",
        "id": "1dc3c1fa-5474-4fc0-a7c3-74ff42d28e5e",
        "ingested": "2024-07-30T15:23:06Z",
        "kind": "alert",
        "original": "{\"dg_comment\":\"-\",\"dg_description\":\"This file outlook.exe was going to [demo.digitalg@gmail.com]\",\"dg_guid\":\"1dc3c1fa-5474-4fc0-a7c3-74ff42d28e5e\",\"dg_name\":\"test has attached a Salesforce data to an email\",\"dg_tenant\":\"279b59f3-02f3-44ea-a7c3-9bac2eb0224d\",\"dg_utype\":\"Incident\",\"inc_assign\":\"test@dgdemo\",\"inc_creator\":\"dg\",\"inc_id\":\"230523-WIQHA\",\"inc_mtime\":\"2023-05-23 06:56:39\",\"inc_sev\":\"Critical\",\"inc_state\":\"Created\"}",
        "severity": 1
    },
    "input": {
        "type": "cel"
    },
    "related": {
        "user": [
            "dg",
            "test@dgdemo"
        ]
    },
    "rule": {
        "name": "test has attached a Salesforce data to an email"
    },
    "tags": [
        "preserve_original_event",
        "preserve_duplicate_custom_fields",
        "forwarded",
        "digital_guardian-arc"
    ],
    "user": {
        "name": "dg"
    }
}