Configuration Installation

The first stage is designed to automate the deployment and setup of dependent objects for the Smart EDR module. The setup is performed by the make_smart_edr.py utility. The utility is provided in the smart_edr_ko_maker package and located in the bin directory. The utility performs the following tasks:

1. Deployment of knowledge objects (Smart Monitor entities)
2. Creation of index templates
3. Creation of index patterns
4. Loading rules from a CSV file

---

Requirements

1. Python 3.12 or higher
2. Utility dependencies are installed by the bin/install_dependencies.sh script, which creates .venv and installs the smpy and httpx libraries
3. Access to the Smart Monitor cluster with administrator credentials

---

Utility Structure

The script contains the following directory structure:

./
├── data/                    # Main directory with configurations
│   ├── sm_*/                # Directories with `Smart Monitor` entities (starting with sm_)
│   ├── index_templates/     # Index templates
│   ├── index_patterns/      # Index patterns
└── lookups/
    └── rules.csv            # CSV file with rules

---

File Formats

1. Smart Monitor entities (in sm_* directories): JSON files with metadata in the _meta field and a unique identifier

2. Index templates (index_templates):

   {
     "name": "template_name",
     "index_template": {
   	// template configuration
     }
   }

3. Index patterns (index_patterns):

   {
     "attributes": {
   	"title": "pattern_name"
     },
     "references": []
   }

4. Rules (rules.csv): Current list of BI.ZONE EDR threat detection rules

---

Installation Sequence

1. Install Utility Dependencies

./bin/install_dependencies.sh

The script creates the .venv virtual environment and installs utility dependencies, including the smpy and httpx libraries.

2. Run Configuration Installation

Installation is performed by running the make_smart_edr.py utility:

./.venv/bin/python bin/make_smart_edr.py \
  --sm_host <SMART_MONITOR_HOST> \
  --sm_api_port <SMART_MONITOR_API_PORT> \
  --sm_cluster_port <OPENSEARCH_PORT> \
  --sm_user <SMART_MONITOR_USER> \
  --sm_password '<SMART_MONITOR_PASSWORD>'

Command-line parameters:

Parameter	Required	Type	Default	Description
--sm_host	Yes	str	-	Smart Monitor host (one of the cluster nodes)
--sm_api_port	No	int	5601	Frontend API port (saved objects)
--sm_cluster_port	No	int	9200	OpenSearch API port (index templates, sm entities, lookups)
--sm_user	Yes	str	-	Username
--sm_password	Yes	str	-	User password

Example run:

./.venv/bin/python bin/make_smart_edr.py --sm_host open-search-host-1.my_company.ru --sm_api_port 5601 --sm_cluster_port 9200 --sm_user admin --sm_password securepassword

Attention!

--sm_api_port is used for the frontend API and saved objects (index patterns). --sm_cluster_port is used for the OpenSearch API (index templates, sm entities, and lookups). If the frontend API and OpenSearch are published on different servers, you can explicitly set --sm_api_host and --sm_cluster_host.

3. Checking Configuration Application

1. In the Templates section: (Main Menu - System Settings - Index Management - Templates) module templates are displayed:

2. In the Index Patterns section: (Main Menu - System Settings - Module Settings - OPENSEARCH - Index Patterns) module index patterns are displayed:

3. In the Lookup List: (Main Menu - Lookup Manager - Lookup List) module lookups are displayed:

   • bizone_alert_setting
   • dim_bizone_host
   • dim_bizone_rule
   • dim_bizone_task
   • link_bizone_alert_severity_incident_severity

4. The dim_bizone_rule lookup contains a list of threat detection rules

4. Register the Module Incident Type

After importing the Smart EDR content module, run the apply_incident_types.py script from the same smart_edr_ko_maker utility. The script registers incident card fields (investigation playbook), idempotently creates the Security Incident incident type, and then assigns it to the module jobs.

./.venv/bin/python bin/apply_incident_types.py \
  --sm_host <SMART_MONITOR_HOST> \
  --sm_api_port <SMART_MONITOR_API_PORT> \
  --sm_user <SMART_MONITOR_USER> \
  --sm_password '<SMART_MONITOR_PASSWORD>'

After execution, verify that:

• the Security Incident incident type appears in Main Menu - Incident Manager - Incident Types
• the type is available in the Incident Type dropdown list in the job editor
• incident jobs of the Smart EDR module received this type
• the incident card displays the playbook fields