Working with Docker detection plugins

Prev Next

Prerequisites

  1. License requirements: You must have -

    • A valid Content-Update license to download the containers

    • An NDR Core or Enterprise license

  2. Connectivity to DTI production: The appliance must be configured to reach the Trellix DTI production domain.

To work with docker detection plugins for anomaly detection, perform the following steps:

  1. Verify licenses

    1. Using the SSH protocol, log into the appliance as npadmin.

    2. Enter privileged mode on the CLI.

      npadmin@hostname> enable

    3. Enter configuration mode.

      npadmin@hostname# configure system

    4. Type License and press Enter.

    5. Verify that CONTENT_UPDATES and NDR licenses are valid and active.

      You can also use show versions command to ensure that the Product Edition field shows Enterprise or Core. See License Management for more information.

  2. Configure DTI Gateway to production domain

    1. On configuration mode, type dtigateway and then press Enter to open the DTI Gateway Configuration menu.

      Activated with appliance ID: 8629xxxxxxxC
      
      U. Update DTI activation code.
      S. Set DTI Gateway Configuration.
      
      ----------------------------------------
      
      E: Exit
      
      Enter your choice:
                  
    2. Type S to set the DTI gateway configuration.

    3. On the DTI configuration menu, type 1 to update the DTI domain to cloud.fireeye.com:443. Enter U to save the configuration updates.

      DTI Server Status: OK
      DTI Gateway Configuration:
      1. DTI Domain: cloud-production.fenet.fireeye.com:443
      2. DTI Protocol: https
      3. DTI Timeout: 600 (seconds)
      4. Proxy Status: Disabled
      5. Proxy Address:
      6. Proxy Authtype: basic
      7. Proxy Username:
      8. Proxy Password:
      
      R. Reset DTI Gateway Configuration.
      
      ----------------------------------------
      
      U: Update changes and go back
      C: Cancel changes and go back
      
      Enter your choice:   
  3. Check the container status

    1. On configuration mode, type show-docker-container and press Enter.

    2. Type S to view the container status.

    CONTAINER ID

    IMAGE

    COMMAND

    CREATED

    STATUS

    PORTS

    NAMES

    1602ea745ef9

    dnst:v1.0.0

    "/usr/local/bin/supe…"

    8 minutes ago

    Up 8 minutes

    dnst-detection

    f748d3e143b6

    dga:v1.0.0

    "/usr/local/bin/supe…"

    8 minutes ago

    Up 8 minutes

    dga-detection

    31dc0599c6c6

    shared-plugins:v1.1.0

    "/usr/local/bin/supe…"

    8 minutes ago

    Up 8 minutes

    ndr-detection-plugins

    891fda9c6a71

    neurl:v1.1.0

    "/usr/local/bin/supe…"

    8 minutes ago

    Up 8 minutes

    neurl-detection

Check alerts on NDR

Once active and running, The plugins will start populating the Alerts dashboard if there is a match found in detection logic. To analyze these alerts -

  1. Click Main_menu.png icon and then under Investigation, select Alerts.

  2. Use the Alert List table to look for specific alerts, such as newly registered domains, SSL anomalies or ICMP/DNS tunneling anomalies. These alerts look like native ML or signature-based alerts, so you can investigate everything in a centralized place.

  3. Review the JSON file and other contextual data in the Alert Details page for further investigation. See Investigating alerts for more information.

    dockerUI1.png