[AI-6402] DDS: Cisco Secure Client Integration v1.0.0#22260
[AI-6402] DDS: Cisco Secure Client Integration v1.0.0#22260steveny91 merged 14 commits intoDataDog:masterfrom
Conversation
607d9b4 to
eed9136
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| '%{regex("[^']*"):usr.name}' local ip %{ip:local_ip} | ||
| (connected|reconnected) from %{ip:network.client.ip} | ||
|
|
||
| parsing_session_connection %{parse_event_type_header}'%{parse_session_id_ip_and_user}:\s*%{regex("Session disconnected|Session connected"):action}. Session Type:\s*%{notSpace:session_type}(, Duration:\s*%{notSpace:duration}, Bytes xmt:\s*%{number:network.bytes_read}, Bytes rcv:\s*%{number:network.bytes_written}, Reason:\s*%{regex(".*(?= \\')"):reason})?\s*' |
There was a problem hiding this comment.
Capture bytes xmt/rcv into correct fields
The Meraki session parser maps Bytes xmt to network.bytes_read and Bytes rcv to network.bytes_written, which inverts transmitted vs. received counts. For AnyConnect session manager logs that include these fields, downstream dashboards and analytics will show read/write byte totals swapped (xmt is outbound, rcv is inbound). This affects any events type=anyconnect_vpn_session_manager messages with byte counters.
Useful? React with 👍 / 👎.
7a55cb3 to
640871c
Compare
|
The following files, which will be shipped with the agent, were modified in this PR and You can ignore this if you are sure the changes in this PR do not require QA. Otherwise, consider removing the label. List of modified files that will be shipped with the agent |
evazorro
left a comment
There was a problem hiding this comment.
Thank you for making those changes! One more small suggestion.
|
@manan-crest Would you mind resolving the merge conflict? That is the only thing blocking this merge now. I can't seem to see what file is in conflict |
Review from steveny91 is dismissed. Related teams and files:
- agent-integrations
- .github/CODEOWNERS
- .github/workflows/config/labeler.yml
6ab2b29 to
d398937
Compare
Review from evazorro is dismissed. Related teams and files:
- documentation
- cisco_secure_client/README.md
- cisco_secure_client/assets/cisco-secure-client.svg
- cisco_secure_client/assets/configuration/spec.yaml
- cisco_secure_client/assets/dashboards/cisco_secure_client_overview.json
- cisco_secure_client/assets/dashboards/cisco_secure_client_vpn_connection_insights.json
- cisco_secure_client/assets/monitors/cisco_secure_client_maximum_client_connection_limit_reached.json
- cisco_secure_client/datadog_checks/cisco_secure_client/data/conf.yaml.example
- cisco_secure_client/manifest.json
* Add: Cisco Secure Client Integration * Fix: CI check Failures * Update: minor changes for CI * Update: remap bytes standard attributes * Update: change minimum agent version * Update: CODEOWNERS * Update: review comments * Update: readme as per review comments * Add: owner field in manifest.json * Update: README.md note aa88427
There was a problem hiding this comment.
@bhargavnariyanicrest Can this dashboard image please be updated without the blank widgets?
* Add: Cisco Secure Client Integration * Fix: CI check Failures * Update: minor changes for CI * Update: remap bytes standard attributes * Update: change minimum agent version * Update: CODEOWNERS * Update: review comments * Update: readme as per review comments * Add: owner field in manifest.json * Update: README.md note Signed-off-by: lukepatrick <lukephilips@gmail.com>
What does this PR do?
This is a initial release PR of Cisco Secure Client integration including all the required assets.
Integration Logo Sources: https://upload.wikimedia.org/wikipedia/commons/0/08/Cisco_logo_blue_2016.svg
Review checklist (to be filled by reviewers)
qa/skip-qalabel if the PR doesn't need to be tested during QA.backport/<branch-name>label to the PR and it will automatically open a backport PR once this one is merged