[Trellix_EDR_Cloud] Initial release for the Trellix EDR Cloud

.github/CODEOWNERS

@@ -229,6 +229,7 @@
 /packages/tines @elastic/security-external-integrations
 /packages/tomcat @elastic/obs-infraobs-integrations
 /packages/traefik @elastic/obs-infraobs-integrations
+/packages/trellix_edr_cloud @elastic/security-external-integrations
 /packages/trellix_epo_cloud @elastic/security-external-integrations
 /packages/trend_micro_vision_one @elastic/security-external-integrations
 /packages/trendmicro @elastic/security-external-integrations

packages/trellix_edr_cloud/_dev/build/build.yml

@@ -0,0 +1,4 @@
+dependencies:
+  ecs:
+    reference: git@v8.9.0
+    import_mappings: true

packages/trellix_edr_cloud/_dev/build/docs/README.md

@@ -0,0 +1,121 @@
+# Trellix EDR Cloud
+
+This [Trellix EDR Cloud](https://www.trellix.com/en-us/products/edr.html) integration enables your detected threats and suspicious network data to be sent to Elastic Security via Amazon S3. When integrated with Elastic Security, this valuable data can be leveraged within Elastic for threat protection, detection, and incident response.
+
+The Trellix EDR Cloud integration can be used in two different modes to collect data:
+- AWS S3 polling mode: Trellix EDR Cloud writes data to S3, and Elastic Agent polls the S3 bucket by listing its contents and reading new files.
+- AWS S3 SQS mode: Trellix EDR Cloud writes data to S3, S3 sends a notification of a new object to SQS, the Elastic Agent receives the notification from SQS, and then reads the S3 object. Multiple agents can be used in this mode.
+
+## Compatibility
+
+This module has been tested against the latest (June 05, 2023) Trellix EDR Cloud version.
+
+## Data streams
+
+The Trellix EDR Cloud integration collects logs for the following seventeen events:
+
+| Event Type      |
+|-----------------|
+| API             |
+| Context Changed |
+| DNS Query       |
+| EPP             |
+| File            |
+| Image Loaded    |
+| Named Pipe      |
+| Network         |
+| Process         |
+| RegKey          |
+| RegValue        |
+| Scheduled Task  |
+| Script Executed |
+| Service         |
+| SysInfo         |
+| User            |
+| WMI             |
+
+
+**NOTE**: The Trellix EDR Cloud integration collects logs for the above mentioned events, but we have combined all of those in one data stream named `event`.
+
+## Requirements
+
+- Elastic Agent must be installed.
+- You can install only one Elastic Agent per host.
+- Elastic Agent is required to stream data from the S3 bucket and ship the data to Elastic, where the events will then be processed via the integration's ingest pipelines.
+
+### Installing and managing an Elastic Agent:
+
+You have a few options for installing and managing an Elastic Agent:
+
+### Install a Fleet-managed Elastic Agent (recommended):
+
+With this approach, you install Elastic Agent and use Fleet in Kibana to define, configure, and manage your agents in a central location. We recommend using Fleet management because it makes the management and upgrade of your agents considerably easier.
+
+### Install Elastic Agent in standalone mode (advanced users):
+
+With this approach, you install Elastic Agent and manually configure the agent locally on the system where it’s installed. You are responsible for managing and upgrading the agents. This approach is reserved for advanced users only.
+
+### Install Elastic Agent in a containerized environment:
+
+You can run Elastic Agent inside a container, either with Fleet Server or standalone. Docker images for all versions of Elastic Agent are available from the Elastic Docker registry, and we provide deployment manifests for running on Kubernetes.
+
+There are some minimum requirements for running Elastic Agent and for more information, refer to the link [here](https://www.elastic.co/guide/en/fleet/current/elastic-agent-installation.html).
+
+The minimum **kibana.version** required is **8.9.0**.
+
+## Setup
+
+### To collect data from an AWS S3 bucket, follow the below steps:
+
+1. Considering you already have an AWS S3 bucket setup, to configure it with Trellix EDR Cloud, follow the steps mentioned below:
+   - Login to your Trellix Admin Account, select Trellix ePO.
+   - Go to Policy Catalog -> Trellix EDR.
+   - Create a new policy by filling the required details and  click OK.
+   - After creating a policy, click on edit for the policy you  want to edit.
+   - Go to the Trace, fill in the details of the trace scanner and AWS S3 settings, and click on save.
+   - Now go to the system tree and click on the system to which you want to assign the policy.
+   - Go to Actions -> Agent -> Set Policy and Inheritance
+   - Select the product under policy as MVISION EDR, and select the policy that you want to assign to this system, and click  save.
+   - Policy is assigned to the system, and the system trace  logs will be sent to the AWS S3 bucket.
+2. The default value of the field `Bucket List Prefix` is event/.
+
+### To collect data from AWS SQS, follow the below steps:
+
+1. Assuming you've already set up a connection to push data into the AWS bucket; if not, see the section above.
+2. To set up an SQS queue, follow "Step 1: Create an Amazon SQS Queue" mentioned in the [link](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ways-to-add-notification-config-to-bucket.html).
+   - While creating an access policy, use the bucket name configured to create a connection for AWS S3 in Trellix EDR Cloud.
+3. Configure event notifications for an S3 bucket. Follow this [link](https://docs.aws.amazon.com/AmazonS3/latest/userguide/enable-event-notifications.html).
+   - While creating `event notification` select the event type as s3:ObjectCreated:*, destination type SQS Queue, and select the queue name created in Step 2.
+
+### Enabling the integration in Elastic:
+
+1. In Kibana go to Management > Integrations
+2. In "Search for integrations" search bar, type Trellix EDR Cloud
+3. Click on the "Trellix EDR Cloud" integration from the search results.
+4. Click on the Add Trellix EDR Cloud Integration button to add the integration.
+5. While adding the integration, if you want to collect logs via AWS S3, then you have to put the following details:
+   - access key id
+   - secret access key
+   - bucket arn
+   - collect logs via S3 Bucket toggled on
+
+   or if you want to collect logs via AWS SQS, then you have to put the following details:
+   - access key id
+   - secret access key
+   - queue url
+   - region
+   - collect logs via S3 Bucket toggled off
+
+**NOTE**: There are other input combination options available, please check [here](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html).
+
+## Logs reference
+
+### Event
+
+This is the `Event` dataset.
+
+#### Example
+
+{{event "event"}}
+
+{{fields "event"}}

packages/trellix_edr_cloud/changelog.yml

@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "0.1.0"
+  changes:
+    - description: Initial release.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/6697

packages/trellix_edr_cloud/data_stream/event/_dev/test/pipeline/test-common-config.yml

@@ -0,0 +1,4 @@
+fields:
+  tags:
+    - preserve_original_event
+    - preserve_duplicate_custom_fields

packages/trellix_edr_cloud/data_stream/event/_dev/test/pipeline/test-event.log

@@ -0,0 +1 @@
+{"_ver":2107,"_serverId":"5B0539BF-0932-4BEA-BD12-EA52687E58BD","_eventType":"File Deleted","accessType":"connection_opened","_deviceId":"D435435b0-BB33-4625-891E-XXXXXXX","_parentEventId":"1XXXXX-8566-404c-87a3-a4c46017b87d","_eventId":"675XXXX-054c-48e8-9549-468dbb5ae5bc","_time":"2023-04-05T07:05:21.186Z","name":"Write Process Memory","authorName":"Example","data":"AAA9UFgBAAA=","arguments":["0x220a50d0000","0x1000","0x2"],"cmdLine":"\"C:\\Users\\XXXX\\AppData\\Local\\Microsoft\\OneDrive\\Update\\setup.exe\"/update","result":"2085503003216","fileModificationDate":"2023-04-04T12:38:42.821Z","fileType":"PE","fileCreationDate":"2023-04-04T12:38:40.984Z","fileMd5":"A7F7A4EEC248E6C1841EC6D5B735357B","fileSha1":"B8F93C2963CF1415A3D1C49668BF56665E3DC334","fileSha256":"F36CD7BAD72D6B6144234DBA8A101A529DABEDC07D48056126A1356A4EECA418","filePath":"C:\\ProgramFiles\\WindowsApps\\Deleted\\XXX.PowerAutomateDesktop_1.0.414.0_x64__8wekyb3d8e7483ce5b-4hhh-4a05-a9d8-a3e99e12498d\\kk-KZ\\PPP.Console.XX.YY.dll","fileSize":5632,"fileAttributes":32,"subsystem":3,"fileMagicBytes":"d0cf11e0a1b11ae1","direction":"outbound","dnsName":"content-autofill.example.com","pipeName":"\\\\.\\pipe\\Sessions\\3\\AppContainerNamedObjects\\S-1-15-2-3573721485-3817616455-324955835-1810672402-3651098853-3568380600-1295794929","destAddress":"81.2.69.192","destPort":443,"sourceAddress":"81.2.69.144","sourcePort":52376,"protocol":"tcp","taskName":"example ReportingTask-S-1-5-21-1323470238-68471550-93548180-1001","taskDescription":null,"dnsType":65,"dnsClass":1,"targetPid":1964,"pid": "2280","dnsNames":["XXX.YYY.cdn.live.net","ttt-XXX.YYY.net","SSS.YYY.cdn.live.net.XXX.net","aaa.dscd.XXX.net"],"action":"added","serviceName":"WD FILTER","serviceDescription":"Example Antivirus On-Access Malware Protection Mini-Filter Driver","serviceLoadOrderGroup":"FS FilterAnti-Virus","userName":"example user","userDomain":"DESKTOP-66XXX","userSid":"S-1-5-21-1323470238-68471550-93548180-1001","tagId":0,"commands":["%localappdata%\\XXXXXX\\OneDrive\\updater.exe"],"httpUrl":"https://xxxx-win.xxx.example.com:443settings/v2.0/compat/appraiser?os=windows&osver=0.0.0.1.example.ni_release.220506-1250&appver=0.0.0.1","httpRequestHeaders":"GETsettings/v2.0/compat/appraiser?os=windows&osver=0.0.0.1.amd64fre.ni_release.220506-1250&appver=0.0.0.2600HTTP/1.1\r\nUser-Agent:MSDW\r\n","serviceType":2,"integrityLevel":4,"versionInfoFilename":"example.EXE","versionInfoFileVersion":"0.0.0.1(WinBuild.160101.0800)","versionInfoProductName":"XXXX®Windows®OperatingSystem","versionInfoProductVersion":"0.0.0.1194","versionInfoVendorName":"Example Corporation","serviceStartType":0,"keyName":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\XXXX\\SECURITY","keyValueName":"SECURITY","keyValueType":"REG_BINARY","keyValue":"01001480CC000000D8000000140000003000000002001C000100000002801400FF010F0001010000000000010000000002009C0006000000000018009D01020001020000000000052000000021020000000014009D010200010100000000000512000000000018009D01020001020000000000052000000020020000000014009D010200010100000000000504000000000014009D01020001010000000000050600000000002800FF010F00010600000000000550000000BF5508723BE028D089794BF891896E7C4025ECF4010100000000000512000000010100000000000512000000","keyOldValue":"01001480F400000000010000140000003000000002001C000100000002801400FF010F00010100000000000100000","certs":[[{"type":"signing","issuerName":"US,\"example,Inc.\",ZZZZZ TrustedG4CodeSigningRSAXXXXXXXA3842021CA1","publicKeyHash":"47A58D30595525187338F85B7F8235FC919CE3FC"},{"type":"parent","issuerName":"US,example,www.example.com,ROOTCAA","publicKeyHash":"6837E0EBB63BF85F1186FBFE617B088865F44E42"},{"type":"parent","issuerName":"US,DigiCertInc,www.example.com,ROOTCA","publicKeyHash":"ECD7E382D2715D644CDF2E673FE7BA98AE1C0F4F"},{"type":"parent","issuerName":"US,DigiCertInc,www.example.com,ROOTCA","publicKeyHash":"45EBA2AFF492CB82312D518BA7A7219DF36DC80F"}]]}