You can enable application security for the Envoy proxy. The Datadog Envoy integration has support for threat detection and blocking.

Prerequisites

• The Datadog Agent is installed and configured for your application’s operating system or container, cloud, or virtual environment.
• Configure the Agent with Remote Configuration to block attackers using the Datadog UI.

Enabling threat detection

Get started

The ASM Envoy integration uses the Envoy external processing filter.

1. Configure Envoy to use the external processing filter. For example:

   http_filters:
     # ... other filters
     - name: envoy.filters.http.ext_proc
       typed_config:
         "@type": type.googleapis.com/envoy.extensions.filters.http.ext_proc.v3.ExternalProcessor
         config:
           grpc_service:
             envoy_grpc:
               cluster_name: datadog_ext_proc_cluster
               timeout: 1s
   
   clusters:
       # ... other clusters
       - name: datadog_ext_proc_cluster
         type: STRICT_DNS
         lb_policy: ROUND_ROBIN
         http2_protocol_options: {}
         transport_socket:
           name: envoy.transport_sockets.tls
           typed_config:
             "@type": type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.UpstreamTlsContext
         load_assignment:
           cluster_name: datadog_ext_proc_cluster
           endpoints:
             - lb_endpoints:
                 - endpoint:
                     address:
                       socket_address:
                         address: Your Datadog image host from step 2
                         port_value: 443
   

   Copy

   Note: you need to replace Your Datadog image host from step 2 in the above example with the host where the Datadog Envoy docker image is running. You will configure this host next.

   You can find more configuration options available in the Envoy external processor documentation.

2. Run a new container with the Datadog Envoy Docker image. The image is available on the Datadog GitHub Registry.

   The Docker image exposes some settings specifically for the Envoy integration:

   Environment variable	Default value	Description
   DD_SERVICE_EXTENSION_HOST	0.0.0.0	gRPC server listening address.
   DD_SERVICE_EXTENSION_PORT	443	gRPC server port.
   DD_SERVICE_EXTENSION_HEALTHCHECK_PORT	80	HTTP server port for health checks.

   Configure the Datadog Agent to receive traces from the integration using the following environment variables:

   Environment variable	Default value	Description
   DD_AGENT_HOST	localhost	Hostname where your Datadog Agent is running.
   DD_TRACE_AGENT_PORT	8126	Port of the Datadog Agent for trace collection.

   After this configuration is complete, the library collects security data from your application and sends it to the Agent. The Agent sends the data to Datadog, where out-of-the-box detection rules flag attacker techniques and potential misconfigurations so you can take steps to remediate.

3. To see Application Security Management threat detection in action, send known attack patterns to your application. For example, trigger the Security Scanner Detected rule by running a file that contains the following curl script:

   for ((i=1;i<=250;i++)); 
   do
   # Target existing service’s routes
   curl https://your-application-url/existing-route -A dd-test-scanner-log;
   # Target non existing service’s routes
   curl https://your-application-url/non-existing-route -A dd-test-scanner-log;
   done

   Note: The dd-test-scanner-log value is supported in the most recent releases.

   A few minutes after you enable your application and send known attack patterns to it, threat information appears in the Application Signals Explorer and vulnerability information appears in the Vulnerability Explorer.

Datadog Go Tracer and Envoy integration

The Envoy integration uses the Datadog Go Tracer and inherits all environment variables from the tracer. You can find more information in Configuring the Go Tracing Library and ASM Library Configuration.

Limitations

The available functionality for Envoy version 1.71.0 has the following important limitations:

• The request body is not inspected, regardless of its content type.

Further Reading

Más enlaces, artículos y documentación útiles:

Envoy integration's source codeSOURCE CODE OOTB Application Security Management RulesDOCUMENTATION Troubleshooting Application Security ManagementDOCUMENTATION