{
  "name": "opencanary",
  "title": "OpenCanary",
  "version": "1.1.0",
  "release": "ga",
  "description": "This integration collects and parses logs from OpenCanary honeypots.",
  "type": "integration",
  "download": "/epr/opencanary/opencanary-1.1.0.zip",
  "path": "/package/opencanary/1.1.0",
  "icons": [
    {
      "src": "/img/logo.svg",
      "path": "/package/opencanary/1.1.0/img/logo.svg",
      "title": "OpenCanary Logo",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.15.0 || ^9.0.0"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "community",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "security"
  ],
  "signature_path": "/epr/opencanary/opencanary-1.1.0.zip.sig",
  "format_version": "3.1.3",
  "readme": "/package/opencanary/1.1.0/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/opencanary-dashboard.png",
      "path": "/package/opencanary/1.1.0/img/opencanary-dashboard.png",
      "title": "OpenCanary Event Summary Dashboard",
      "size": "3718×2336",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/opencanary/1.1.0/LICENSE.txt",
    "/package/opencanary/1.1.0/changelog.yml",
    "/package/opencanary/1.1.0/manifest.yml",
    "/package/opencanary/1.1.0/validation.yml",
    "/package/opencanary/1.1.0/docs/README.md",
    "/package/opencanary/1.1.0/img/logo.svg",
    "/package/opencanary/1.1.0/img/opencanary-dashboard.png",
    "/package/opencanary/1.1.0/data_stream/events/manifest.yml",
    "/package/opencanary/1.1.0/data_stream/events/sample_event.json",
    "/package/opencanary/1.1.0/kibana/dashboard/opencanary-96cfb6c4-bc46-4fd4-9476-e8e9550442d9.json",
    "/package/opencanary/1.1.0/kibana/tag/opencanary-3fbc4167-dabb-46c1-9e5e-af06de6e2c88.json",
    "/package/opencanary/1.1.0/data_stream/events/fields/agent.yml",
    "/package/opencanary/1.1.0/data_stream/events/fields/base-fields.yml",
    "/package/opencanary/1.1.0/data_stream/events/fields/fields.yml",
    "/package/opencanary/1.1.0/data_stream/events/agent/stream/filestream.yml.hbs",
    "/package/opencanary/1.1.0/data_stream/events/agent/stream/http_endpoint.yml.hbs",
    "/package/opencanary/1.1.0/data_stream/events/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "events",
      "title": "OpenCanary Events",
      "description": "Collect OpenCanary events from logs.",
      "inputs": [
        {
          "type": "filestream",
          "title": "OpenCanary Log Files",
          "description": "Collect OpenCanary events from logs."
        },
        {
          "type": "http_endpoint",
          "title": "OpenCanary Webhooks",
          "description": "Collect OpenCanary events via webhooks."
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "opencanary.events",
      "title": "OpenCanary HoneyPot Events",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "/var/tmp/opencanary.log"
              ]
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "opencanary-logs"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "redact_passwords",
              "type": "bool",
              "title": "Redact passwords",
              "description": "Some events may contain plain-text passwords in the `event.original` field. Enabling this option will redact those passwords.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": true
            },
            {
              "name": "preserve_duplicate_custom_fields",
              "type": "bool",
              "title": "Preserve duplicate custom fields",
              "description": "Preserve custom fields for all ECS mappings.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "filestream.yml.hbs",
          "title": "OpenCanary Log Files",
          "description": "Collect OpenCanary events from logs.",
          "enabled": true,
          "ingestion_method": "File"
        },
        {
          "input": "http_endpoint",
          "vars": [
            {
              "name": "listen_address",
              "type": "text",
              "title": "Listen Address",
              "description": "The bind address to listen for http endpoint connections. Set to `0.0.0.0` to bind to all available interfaces.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "localhost"
            },
            {
              "name": "listen_port",
              "type": "integer",
              "title": "Listen Port",
              "description": "The port number the listener binds to.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 8080
            },
            {
              "name": "url",
              "type": "text",
              "title": "URL",
              "description": "This option specifies which URL path to accept requests on. Defaults to /.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "/"
            },
            {
              "name": "secret_header",
              "type": "text",
              "title": "Secret Header",
              "description": "The header to check for a specific value specified by `secret.value`.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "secret_value",
              "type": "password",
              "title": "Secret Value",
              "description": "The secret stored in the header name specified by `secret.header`.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "ssl",
              "type": "yaml",
              "title": "SSL Configuration",
              "description": "i.e. certificate_authorities, supported_protocols, verification_mode etc.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#certificate_authorities:\n#  - |\n#    -----BEGIN CERTIFICATE-----\n#    MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n#    ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n#    MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n#    BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n#    fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n#    94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n#    /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n#    PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n#    CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n#    BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n#    8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n#    874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n#    3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n#    H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n#    8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n#    yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n#    sxSmbIUfc2SGJGCJD4I=\n#    -----END CERTIFICATE-----\n"
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "forwarded",
                "opencanary-logs"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "redact_passwords",
              "type": "bool",
              "title": "Redact passwords",
              "description": "Some events may contain plain-text passwords in the `event.original` field. Enabling this option will redact those passwords.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "preserve_duplicate_custom_fields",
              "type": "bool",
              "title": "Preserve duplicate custom fields",
              "description": "Preserve custom fields for all ECS mappings.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "http_endpoint.yml.hbs",
          "title": "OpenCanary Webhooks",
          "description": "Collect OpenCanary events via webhooks.",
          "enabled": false,
          "ingestion_method": "Webhook"
        }
      ],
      "package": "opencanary",
      "path": "events"
    }
  ]
}