{
  "name": "bbot",
  "title": "BBOT (Bighuge BLS OSINT Tool)",
  "version": "1.2.0",
  "release": "ga",
  "description": "BBOT is a recursive internet scanner inspired by Spiderfoot, but designed to be faster, more reliable, and friendlier to pentesters, bug bounty hunters, and developers. ",
  "type": "integration",
  "download": "/epr/bbot/bbot-1.2.0.zip",
  "path": "/package/bbot/1.2.0",
  "icons": [
    {
      "src": "/img/BlackLantern-LOGO.svg",
      "path": "/package/bbot/1.2.0/img/BlackLantern-LOGO.svg",
      "title": "BBOT Logo",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.13.0"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "community",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "security"
  ],
  "signature_path": "/epr/bbot/bbot-1.2.0.zip.sig",
  "format_version": "3.1.2",
  "readme": "/package/bbot/1.2.0/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/BBOT-Dashboard.png",
      "path": "/package/bbot/1.2.0/img/BBOT-Dashboard.png",
      "title": "BBOT Screenshot",
      "size": "600x600",
      "type": "image/png"
    },
    {
      "src": "/img/add-integration-1.png",
      "path": "/package/bbot/1.2.0/img/add-integration-1.png",
      "title": "Add Integration",
      "size": "1624x1504",
      "type": "image/png"
    },
    {
      "src": "/img/add-integration-2.png",
      "path": "/package/bbot/1.2.0/img/add-integration-2.png",
      "title": "Add Integration",
      "size": "1624x1504",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/bbot/1.2.0/LICENSE.txt",
    "/package/bbot/1.2.0/changelog.yml",
    "/package/bbot/1.2.0/manifest.yml",
    "/package/bbot/1.2.0/validation.yml",
    "/package/bbot/1.2.0/docs/README.md",
    "/package/bbot/1.2.0/img/BBOT-Dashboard.png",
    "/package/bbot/1.2.0/img/BlackLantern-LOGO.svg",
    "/package/bbot/1.2.0/img/add-integration-1.png",
    "/package/bbot/1.2.0/img/add-integration-2.png",
    "/package/bbot/1.2.0/data_stream/asm_intel/manifest.yml",
    "/package/bbot/1.2.0/data_stream/asm_intel/sample_event.json",
    "/package/bbot/1.2.0/kibana/dashboard/bbot-8abcb381-42b3-4d99-a177-c103255eedd9.json",
    "/package/bbot/1.2.0/kibana/search/bbot-45ce1599-99e3-4c4e-9c1a-07254be0e274.json",
    "/package/bbot/1.2.0/data_stream/asm_intel/fields/base-fields.yml",
    "/package/bbot/1.2.0/data_stream/asm_intel/fields/beats.yml",
    "/package/bbot/1.2.0/data_stream/asm_intel/fields/fields.yml",
    "/package/bbot/1.2.0/data_stream/asm_intel/fields/host-as.yml",
    "/package/bbot/1.2.0/data_stream/asm_intel/agent/stream/http_endpoint.yml.hbs",
    "/package/bbot/1.2.0/data_stream/asm_intel/agent/stream/logfile.yml.hbs",
    "/package/bbot/1.2.0/data_stream/asm_intel/elasticsearch/ingest_pipeline/default.yml",
    "/package/bbot/1.2.0/data_stream/asm_intel/elasticsearch/ingest_pipeline/ecs.yml"
  ],
  "policy_templates": [
    {
      "name": "bbot",
      "title": "BBOT Scan Data",
      "description": "Collect BBOT output.ndjson",
      "inputs": [
        {
          "type": "logfile",
          "title": "Collect BBOT Logs via Files",
          "description": "Collecting BBOT Output Log Files"
        },
        {
          "type": "http_endpoint",
          "title": "Collect BBOT Logs via HTTP Output",
          "description": "Collecting BBOT HTTP Output"
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "bbot.asm_intel",
      "title": "BBOT-Data-Ingest",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "logfile",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Path to ndjson output file",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "/path/to/bbot/ndjson/file"
              ]
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "forwarded",
                "bbot"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve Original Event",
              "description": "This option copies the raw unmodified body of the incoming request to the event.original field as a string before sending the event to Elasticsearch.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": false
            },
            {
              "name": "preserve_duplicate_custom_fields",
              "type": "bool",
              "title": "Preserve Original Fields",
              "description": "Preserves all original data fields, rather than removing those that are mapped to ECS fields",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "logfile.yml.hbs",
          "title": "BBOT File Output",
          "description": "Collect BBOT NDJSON Files",
          "enabled": true,
          "ingestion_method": "File"
        },
        {
          "input": "http_endpoint",
          "vars": [
            {
              "name": "listen_address",
              "type": "text",
              "title": "Listen Address",
              "description": "Bind address for the HTTP listener. Use 0.0.0.0 to listen on all interfaces.\n",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "localhost"
            },
            {
              "name": "listen_port",
              "type": "text",
              "title": "Listen port",
              "description": "Bind port for the listener.\n",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 8080
            },
            {
              "name": "url",
              "type": "text",
              "title": "URL",
              "description": "This options specific which URL path to accept requests on. Defaults to /.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "/bbot/ndjson"
            },
            {
              "name": "basic_auth",
              "type": "bool",
              "title": "Basic Auth",
              "description": "Enables or disables HTTP basic auth for each incoming request. If enabled then username and password will also need to be configured.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "username",
              "type": "text",
              "title": "Username",
              "description": "If basic_auth is enabled, this is the username used for authentication against the HTTP listener. Requires password to also be set.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "password",
              "type": "password",
              "title": "Password",
              "description": "If basic_auth is enabled, this is the password used for authentication against the HTTP listener. Requires username to also be set.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "secret_header",
              "type": "text",
              "title": "Secret Header",
              "description": "The header to check for a specific value specified by secret.value. Certain webhooks provide the possibility to include a special header and secret to identify the source.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "secret_value",
              "type": "password",
              "title": "Secret Value",
              "description": "The secret stored in the header name specified by secret.header. Certain webhooks provide the possibility to include a special header and secret to identify the source.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "ssl",
              "type": "yaml",
              "title": "TLS",
              "description": "Options for enabling TLS for the listening HTTP endpoint. See the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html) for a list of all options.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "enabled: false\ncertificate: \"/etc/pki/client/cert.pem\"\nkey: \"/etc/pki/client/cert.key\"\n"
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "forwarded",
                "bbot"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve Original Event",
              "description": "This option copies the raw unmodified body of the incoming request to the event.original field as a string before sending the event to Elasticsearch.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": false
            },
            {
              "name": "preserve_duplicate_custom_fields",
              "type": "bool",
              "title": "Preserve Original Fields",
              "description": "Preserves all original data fields, rather than removing those that are mapped to ECS fields",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "The request tracer logs HTTP requests to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html#_tracer_filename_4) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "http_endpoint.yml.hbs",
          "title": "BBOT HTTP Output",
          "description": "Receives NDJSON from BBOT HTTP Output",
          "enabled": true,
          "ingestion_method": "Webhook"
        }
      ],
      "package": "bbot",
      "path": "asm_intel"
    }
  ]
}