added assets

Author: vinodkumar-sacumen

checkpoint_harmony_endpoint/README.md

@@ -2,59 +2,75 @@
 
 ## Overview
 
-This check monitors [checkpoint_harmony_endpoint][1] through the Datadog Agent. 
-
-Include a high level overview of what this integration does:
-- What does your product do (in 1-2 sentences)?
-- What value will customers get from this integration, and why is it valuable to them?
-- What specific data will your integration monitor, and what's the value of that data?
+Checkpoint Harmony Endpoint is a next-generation endpoint security solution designed to prevent, detect, and respond to threats on user devices (desktops, laptops, servers, etc). This integration monitors [Checkpoint Harmony Endpoint][1].
 
 ## Setup
+1. Collecting logs is disabled by default in the Datadog Agent. Enable it in the `datadog.yaml` file with:
 
-Follow the instructions below to install and configure this check for an Agent running on a host. For containerized environments, see the [Autodiscovery Integration Templates][3] for guidance on applying these instructions.
+    ```yaml
+      logs_enabled: true
+    ```
+2. Add this configuration block to your `checkpoint_harmony_endpoint.d/conf.yaml` file to start collecting your checkpoint_harmony_endpoint logs:
 
-### Installation
+    ```yaml
+      logs:
+        - type: file
+          path:  /var/log/checkpoint.log
+          source: checkpoint_harmony_endpoint
+          service: <SERVICE_NAME>
+    ```
 
-The checkpoint_harmony_endpoint check is included in the [Datadog Agent][2] package.
-No additional installation is needed on your server.
+    Change the `path` and `service` parameter values for your environment.
 
-### Configuration
+3. [Restart the Agent][4].
 
-1. Edit the `checkpoint_harmony_endpoint.d/conf.yaml` file, in the `conf.d/` folder at the root of your Agent's configuration directory to start collecting your checkpoint_harmony_endpoint performance data. See the [sample checkpoint_harmony_endpoint.d/conf.yaml][4] for all available configuration options.
+### Installation
 
-2. [Restart the Agent][5].
+The checkpoint harmony endpoint check is included in the [Datadog Agent][2] package.
 
-### Validation
+### Prerequisites
 
-[Run the Agent's status subcommand][6] and look for `checkpoint_harmony_endpoint` under the Checks section.
+1. Administrative access to Checkpoint Harmony Endpoint - Gaia installed on your server.
+2. The Datadog Agent installed and running (on a server or container that can receive syslog messages).
+3. Network Access between the endpoint and the Datadog Agent (usually port 514, but may be a custom value). Enable log exporter in the Smart Console for log streaming.
+4. Syslog support enabled in the Datadog Agent (with a TCP or UDP  listener configured).
 
-## Data Collected
+### Validation
 
-### Metrics
+1. Confirm the Datadog Agent is listening on the correct port (`514` in the following examples)
+    `sudo netstat -tunlp | grep 514`
+    If using TCP and UDP listeners, use the following command:
+    `sudo lsof -i :514`
+2. Confirm logs are reaching the Agent from the correct log source.
+    `tail -f /var/log/datadog/syslog.log`
+**Note**: If the file doesn't exist, verify that syslog logs are being written by your configuration.
+3. Use the tcpdump command to confirm network traffic. On the Datadog Agent host:
+    `sudo tcpdump -i any port 514`
+After running this command, you should see traffic from the Checkpoint endpoint client's IP address. If you don't see any such traffic, check the firewall rules between Checkpoint Endpoint and the Datadog Agent. Confirm the correct protocol (UDP or TCP) is being used on both sides.
+4. Check the Datadog [Live Tail][7] in Datadog for logs from the source and service you defined in the `conf.yaml` file.
+5. After following these steps, you can create a test log on the harmony client by triggering an event.
+6. Check for tags or facets to use them for better filtering based on the required data.
 
-See [metadata.csv][7] for a list of metrics provided by this integration.
+### Metrics
 
-### Events
+The Checkpoint Harmony Endpoint integration does not include any metrics.
 
-The checkpoint_harmony_endpoint integration does not include any events.
+### Log collection
+## Data Collected
+The Checkpoint Harmony Endpoint logs contain key information of the endpoint client such as the event timestamp, detected_by and client IPs and ports, protocol used, firewall action (allow/deny), the matched rule name, user identity (if available), log type (e.g., forensic, malware, etc), action used, device name, and status of the operation, all of which help monitor endpoint behavior, access control, and system activity and many more which are collected by DataDog.
 
-### Service Checks
 
-The checkpoint_harmony_endpoint integration does not include any service checks.
+### Events
 
-See [service_checks.json][8] for a list of service checks provided by this integration.
+The checkpoint harmony endpoint integration includes log events such as attacks and malware hits.
 
 ## Troubleshooting
 
-Need help? Contact [Datadog support][9].
-
+Need help? Contact [Datadog support][3].
 
-[1]: **LINK_TO_INTEGRATION_SITE**
+[1]: https://www.checkpoint.com/harmony/endpoint/
 [2]: https://app.datadoghq.com/account/settings/agent/latest
-[3]: https://docs.datadoghq.com/agent/kubernetes/integrations/
-[4]: https://github.com/DataDog/integrations-core/blob/master/checkpoint_harmony_endpoint/datadog_checks/checkpoint_harmony_endpoint/data/conf.yaml.example
-[5]: https://docs.datadoghq.com/agent/guide/agent-commands/#start-stop-and-restart-the-agent
-[6]: https://docs.datadoghq.com/agent/guide/agent-commands/#agent-status-and-information
-[7]: https://github.com/DataDog/integrations-core/blob/master/checkpoint_harmony_endpoint/metadata.csv
-[8]: https://github.com/DataDog/integrations-core/blob/master/checkpoint_harmony_endpoint/assets/service_checks.json
-[9]: https://docs.datadoghq.com/help/
+[3]: https://docs.datadoghq.com/help/
+[4]: https://docs.datadoghq.com/agent/guide/agent-commands/#start-stop-and-restart-the-agent
+[5]: https://app.datadoghq.com/integrations?search=checkpoint_harmony_endpoint
+[6]: https://github.com/DataDog/integrations-core/blob/master/checkpoint_harmony_endpoint/assets/service_checks.json