{ "name": "cybereason", "title": "Cybereason", "version": "1.9.0", "release": "ga", "description": "Collect logs from Cybereason with Elastic Agent.", "type": "integration", "download": "/epr/cybereason/cybereason-1.9.0.zip", "path": "/package/cybereason/1.9.0", "icons": [ { "src": "/img/cybereason-logo.svg", "path": "/package/cybereason/1.9.0/img/cybereason-logo.svg", "title": "Sample logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.2 || ^9.0.5" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "edr_xdr" ], "signature_path": "/epr/cybereason/cybereason-1.9.0.zip.sig", "format_version": "3.3.2", "readme": "/package/cybereason/1.9.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/cybereason-logon-session-dashboard.png", "path": "/package/cybereason/1.9.0/img/cybereason-logon-session-dashboard.png", "title": "Cybereason Logon Session Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/cybereason-malop-connection-dashboard.png", "path": "/package/cybereason/1.9.0/img/cybereason-malop-connection-dashboard.png", "title": "Cybereason Malop Connection Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/cybereason-malop-process-dashboard.png", "path": "/package/cybereason/1.9.0/img/cybereason-malop-process-dashboard.png", "title": "Cybereason Malop Process Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/cybereason-malware-dashboard.png", "path": "/package/cybereason/1.9.0/img/cybereason-malware-dashboard.png", "title": "Cybereason Malware Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/cybereason-poll-malop-dashboard.png", "path": "/package/cybereason/1.9.0/img/cybereason-poll-malop-dashboard.png", "title": "Cybereason Poll Malop Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/cybereason-suspicions-process-dashboard.png", "path": "/package/cybereason/1.9.0/img/cybereason-suspicions-process-dashboard.png", "title": "Cybereason Suspicions Process Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/cybereason/1.9.0/LICENSE.txt", "/package/cybereason/1.9.0/changelog.yml", "/package/cybereason/1.9.0/manifest.yml", "/package/cybereason/1.9.0/validation.yml", "/package/cybereason/1.9.0/docs/README.md", "/package/cybereason/1.9.0/img/cybereason-logo.svg", "/package/cybereason/1.9.0/img/cybereason-logon-session-dashboard.png", "/package/cybereason/1.9.0/img/cybereason-malop-connection-dashboard.png", "/package/cybereason/1.9.0/img/cybereason-malop-process-dashboard.png", "/package/cybereason/1.9.0/img/cybereason-malware-dashboard.png", "/package/cybereason/1.9.0/img/cybereason-poll-malop-dashboard.png", "/package/cybereason/1.9.0/img/cybereason-suspicions-process-dashboard.png", "/package/cybereason/1.9.0/data_stream/logon_session/manifest.yml", "/package/cybereason/1.9.0/data_stream/logon_session/sample_event.json", "/package/cybereason/1.9.0/data_stream/malop_connection/manifest.yml", "/package/cybereason/1.9.0/data_stream/malop_connection/sample_event.json", "/package/cybereason/1.9.0/data_stream/malop_process/manifest.yml", "/package/cybereason/1.9.0/data_stream/malop_process/sample_event.json", "/package/cybereason/1.9.0/data_stream/malware/manifest.yml", "/package/cybereason/1.9.0/data_stream/malware/sample_event.json", "/package/cybereason/1.9.0/data_stream/poll_malop/manifest.yml", "/package/cybereason/1.9.0/data_stream/poll_malop/sample_event.json", "/package/cybereason/1.9.0/data_stream/suspicions_process/manifest.yml", "/package/cybereason/1.9.0/data_stream/suspicions_process/sample_event.json", "/package/cybereason/1.9.0/kibana/dashboard/cybereason-1aad66f0-9e9b-4795-90b6-79ee2f1f3fe9.json", "/package/cybereason/1.9.0/kibana/dashboard/cybereason-5446c6fd-4522-4fdc-a6d7-e42d46a30b7d.json", "/package/cybereason/1.9.0/kibana/dashboard/cybereason-8cd3601b-06e9-4c3e-a94f-e5a851a76fb9.json", "/package/cybereason/1.9.0/kibana/dashboard/cybereason-bd4e9dde-68a3-4658-b4c5-b7b5395a05c7.json", "/package/cybereason/1.9.0/kibana/dashboard/cybereason-d5ebb256-640d-44e8-a1d2-123c8866e61d.json", "/package/cybereason/1.9.0/kibana/dashboard/cybereason-d7c34832-3555-484f-adde-43c071909eef.json", "/package/cybereason/1.9.0/kibana/search/cybereason-12c11dc9-0f60-4f99-964d-a9b739bff363.json", "/package/cybereason/1.9.0/kibana/search/cybereason-3c3ea653-66fe-45f6-bccf-8051fc0c3d86.json", "/package/cybereason/1.9.0/kibana/search/cybereason-65c4e561-3002-430f-919a-ce8eccd378ee.json", "/package/cybereason/1.9.0/kibana/search/cybereason-76672322-858a-4481-8b71-4d9d5c1976b0.json", "/package/cybereason/1.9.0/kibana/search/cybereason-952e7720-9a6f-404f-991f-c9c4ad240ef0.json", "/package/cybereason/1.9.0/kibana/search/cybereason-efd1b965-4a57-4ac2-baea-9adbf2394a14.json", "/package/cybereason/1.9.0/kibana/search/cybereason-f9b26c26-aa49-4be4-be9d-1499b73d7b31.json", "/package/cybereason/1.9.0/data_stream/logon_session/fields/base-fields.yml", "/package/cybereason/1.9.0/data_stream/logon_session/fields/beats.yml", "/package/cybereason/1.9.0/data_stream/logon_session/fields/fields.yml", "/package/cybereason/1.9.0/data_stream/malop_connection/fields/base-fields.yml", "/package/cybereason/1.9.0/data_stream/malop_connection/fields/beats.yml", "/package/cybereason/1.9.0/data_stream/malop_connection/fields/fields.yml", "/package/cybereason/1.9.0/data_stream/malop_process/fields/base-fields.yml", "/package/cybereason/1.9.0/data_stream/malop_process/fields/beats.yml", "/package/cybereason/1.9.0/data_stream/malop_process/fields/fields.yml", "/package/cybereason/1.9.0/data_stream/malware/fields/base-fields.yml", "/package/cybereason/1.9.0/data_stream/malware/fields/beats.yml", "/package/cybereason/1.9.0/data_stream/malware/fields/fields.yml", "/package/cybereason/1.9.0/data_stream/poll_malop/fields/base-fields.yml", "/package/cybereason/1.9.0/data_stream/poll_malop/fields/beats.yml", "/package/cybereason/1.9.0/data_stream/poll_malop/fields/fields.yml", "/package/cybereason/1.9.0/data_stream/suspicions_process/fields/base-fields.yml", "/package/cybereason/1.9.0/data_stream/suspicions_process/fields/beats.yml", "/package/cybereason/1.9.0/data_stream/suspicions_process/fields/fields.yml", "/package/cybereason/1.9.0/data_stream/logon_session/agent/stream/cel.yml.hbs", "/package/cybereason/1.9.0/data_stream/logon_session/elasticsearch/ingest_pipeline/default.yml", "/package/cybereason/1.9.0/data_stream/malop_connection/agent/stream/cel.yml.hbs", "/package/cybereason/1.9.0/data_stream/malop_connection/elasticsearch/ingest_pipeline/default.yml", "/package/cybereason/1.9.0/data_stream/malop_process/agent/stream/cel.yml.hbs", "/package/cybereason/1.9.0/data_stream/malop_process/elasticsearch/ingest_pipeline/default.yml", "/package/cybereason/1.9.0/data_stream/malware/agent/stream/cel.yml.hbs", "/package/cybereason/1.9.0/data_stream/malware/elasticsearch/ingest_pipeline/default.yml", "/package/cybereason/1.9.0/data_stream/poll_malop/agent/stream/cel.yml.hbs", "/package/cybereason/1.9.0/data_stream/poll_malop/elasticsearch/ingest_pipeline/default.yml", "/package/cybereason/1.9.0/data_stream/suspicions_process/agent/stream/cel.yml.hbs", "/package/cybereason/1.9.0/data_stream/suspicions_process/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "Cybereason", "title": "Cybereason logs", "description": "Collect Cybereason logs.", "inputs": [ { "type": "cel", "vars": [ { "name": "host", "type": "text", "title": "Host", "description": "Hostname for Cybereason server.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "port", "type": "text", "title": "Port", "description": "The port used for Cybereason server.", "multi": false, "required": true, "show_user": true, "default": 443 }, { "name": "username", "type": "text", "title": "Username", "description": "User Name.", "multi": false, "required": true, "show_user": true }, { "name": "password", "type": "password", "title": "Password", "description": "Password.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Cybereason logs via API", "description": "Collecting Cybereason logs via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "cybereason.logon_session", "title": "Collect Logon Session logs from Cybereason.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Logon Session logs from Cybereason. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Cybereason API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Cyberason API.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "cybereason-logon_session" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve cybereason.logon_session fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Logon Session logs", "description": "Collect Logon Session logs from Cybereason.", "enabled": false, "ingestion_method": "API" } ], "package": "cybereason", "path": "logon_session" }, { "type": "logs", "dataset": "cybereason.malop_connection", "title": "Collect Malop Connection logs from Cybereason.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Malop Connection logs from Cybereason. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Cybereason API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Cyberason API.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "cybereason-malop_connection" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve cybereason.malop_connection fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Malop Connection logs", "description": "Collect Malop Connection logs from Cybereason.", "enabled": false, "ingestion_method": "API" } ], "package": "cybereason", "path": "malop_connection" }, { "type": "logs", "dataset": "cybereason.malop_process", "title": "Collect Malop Process logs from Cybereason.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Malop Process logs from Cybereason. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Cybereason API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Cyberason API.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "cybereason-malop_process" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve cybereason.malop_process fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Malop Process logs", "description": "Collect Malop Process logs from Cybereason.", "enabled": false, "ingestion_method": "API" } ], "package": "cybereason", "path": "malop_process" }, { "type": "logs", "dataset": "cybereason.malware", "title": "Collect Malware logs from Cybereason.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Malware logs from Cybereason. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Cybereason API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Cyberason API. It must be between 1 - 1000.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "cybereason-malware" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve cybereason.malware fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Malware logs", "description": "Collect Malware logs from Cybereason.", "enabled": false, "ingestion_method": "API" } ], "package": "cybereason", "path": "malware" }, { "type": "logs", "dataset": "cybereason.poll_malop", "title": "Collect Poll Malop logs from Cybereason.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Poll Malop logs from Cybereason. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Cybereason API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "cybereason-poll_malop" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve cybereason.poll_malop fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Poll Malop logs", "description": "Collect Poll Malop logs from Cybereason.", "enabled": false, "ingestion_method": "API" } ], "package": "cybereason", "path": "poll_malop" }, { "type": "logs", "dataset": "cybereason.suspicions_process", "title": "Collect Suspicions Process logs from Cybereason.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Suspicions Process logs from Cybereason. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Cybereason API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Cyberason API.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "cybereason-suspicions_process" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve cybereason.suspicions_process fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Suspicions Process logs", "description": "Collect Suspicions Process logs from Cybereason.", "enabled": false, "ingestion_method": "API" } ], "package": "cybereason", "path": "suspicions_process" } ] }