{ "name": "cisa_kevs", "title": "CISA Known Exploited Vulnerabilities", "version": "1.11.0", "release": "ga", "description": "This package allows the ingest of known exploited vulnerabilities according to the Cybersecurity and Infrastructure Security Agency of the United States of America. This information could be used to enrich or track exisiting vulnerabilities that are known to be exploited in the wild.", "type": "integration", "download": "/epr/cisa_kevs/cisa_kevs-1.11.0.zip", "path": "/package/cisa_kevs/1.11.0", "icons": [ { "src": "/img/icon-threat-detection-64-color.svg", "path": "/package/cisa_kevs/1.11.0/img/icon-threat-detection-64-color.svg", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.2 || ^9.0.5" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "community", "github": "elastic/security-service-integrations" }, "categories": [ "security", "vulnerability_management" ], "signature_path": "/epr/cisa_kevs/cisa_kevs-1.11.0.zip.sig", "format_version": "3.3.2", "readme": "/package/cisa_kevs/1.11.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/cisa_kevs.png", "path": "/package/cisa_kevs/1.11.0/img/cisa_kevs.png", "title": "Dashboard for CISA Known Exploitable Vulnerabilities", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/cisa_kevs/1.11.0/LICENSE.txt", "/package/cisa_kevs/1.11.0/changelog.yml", "/package/cisa_kevs/1.11.0/manifest.yml", "/package/cisa_kevs/1.11.0/validation.yml", "/package/cisa_kevs/1.11.0/docs/README.md", "/package/cisa_kevs/1.11.0/img/cisa_kevs.png", "/package/cisa_kevs/1.11.0/img/icon-threat-detection-64-color.svg", "/package/cisa_kevs/1.11.0/data_stream/vulnerability/manifest.yml", "/package/cisa_kevs/1.11.0/data_stream/vulnerability/sample_event.json", "/package/cisa_kevs/1.11.0/kibana/dashboard/cisa_kevs-dcb4dd40-d17a-11ee-b159-799470efb549.json", "/package/cisa_kevs/1.11.0/kibana/tag/cisa_kevs-security-solution-default.json", "/package/cisa_kevs/1.11.0/data_stream/vulnerability/fields/base-fields.yml", "/package/cisa_kevs/1.11.0/data_stream/vulnerability/fields/beats.yml", "/package/cisa_kevs/1.11.0/data_stream/vulnerability/fields/fields.yml", "/package/cisa_kevs/1.11.0/data_stream/vulnerability/agent/stream/cel.yml.hbs", "/package/cisa_kevs/1.11.0/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "cisa_kevs", "title": "CISA Known Exploited Vulnerabilities", "description": "Ingest the CISA KEVs with Elastic Agent.", "inputs": [ { "type": "cel", "vars": [ { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false } ], "title": "Collect CISA KEVs via API", "description": "Ingest the CISA KEVs with Elastic Agent." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "cisa_kevs.vulnerability", "title": "CISA Known Exploited Vulnerabilities List", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "CISA KEV URL Catalog API endpoint", "multi": false, "required": true, "show_user": false, "default": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "multi": false, "required": true, "show_user": true, "default": "60m" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "cisa-kev" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "CISA KEV Catalog logs", "description": "Collect CISA Known Exploited Vulnerability logs", "enabled": false, "ingestion_method": "API" } ], "package": "cisa_kevs", "path": "vulnerability" } ] }