{ "name": "ping_one", "title": "PingOne", "version": "1.25.0", "release": "ga", "description": "Collect logs from PingOne with Elastic-Agent.", "type": "integration", "download": "/epr/ping_one/ping_one-1.25.0.zip", "path": "/package/ping_one/1.25.0", "icons": [ { "src": "/img/ping-one-logo.svg", "path": "/package/ping_one/1.25.0/img/ping-one-logo.svg", "title": "PingOne logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.4 || ~9.0.7 || ^9.1.4" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "iam" ], "signature_path": "/epr/ping_one/ping_one-1.25.0.zip.sig", "format_version": "3.3.2", "readme": "/package/ping_one/1.25.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/ping-one-dashboard.png", "path": "/package/ping_one/1.25.0/img/ping-one-dashboard.png", "title": "PingOne Audit Dashboard Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/ping_one/1.25.0/LICENSE.txt", "/package/ping_one/1.25.0/changelog.yml", "/package/ping_one/1.25.0/manifest.yml", "/package/ping_one/1.25.0/validation.yml", "/package/ping_one/1.25.0/docs/README.md", "/package/ping_one/1.25.0/img/ping-one-dashboard.png", "/package/ping_one/1.25.0/img/ping-one-logo.svg", "/package/ping_one/1.25.0/kibana/tags.yml", "/package/ping_one/1.25.0/data_stream/audit/manifest.yml", "/package/ping_one/1.25.0/data_stream/audit/sample_event.json", "/package/ping_one/1.25.0/kibana/dashboard/ping_one-60aa0020-0ea5-11ed-9b69-fdafbf89c645.json", "/package/ping_one/1.25.0/data_stream/audit/fields/agent.yml", "/package/ping_one/1.25.0/data_stream/audit/fields/base-fields.yml", "/package/ping_one/1.25.0/data_stream/audit/fields/fields.yml", "/package/ping_one/1.25.0/data_stream/audit/agent/stream/http_endpoint.yml.hbs", "/package/ping_one/1.25.0/data_stream/audit/agent/stream/httpjson.yml.hbs", "/package/ping_one/1.25.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "ping_one", "title": "PingOne", "description": "Collect logs from PingOne.", "inputs": [ { "type": "http_endpoint", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for http endpoint connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "secret_header", "type": "text", "title": "Secret Header", "description": "The header to check for a specific value specified by `secret.value`.", "multi": false, "required": false, "show_user": false }, { "name": "secret_value", "type": "password", "title": "Secret Value", "description": "The secret stored in the header name specified by `secret.header`.", "multi": false, "required": false, "show_user": false } ], "title": "Collect PingOne logs via HTTP Endpoint", "description": "Collecting PingOne logs via HTTP Endpoint." }, { "type": "httpjson", "vars": [ { "name": "api_path", "type": "text", "title": "URL", "description": "API Path of the PingOne App. Format of the API Path - https://api.pingone.{{regional_domain}}", "multi": false, "required": true, "show_user": false }, { "name": "token_url", "type": "text", "title": "Token Endpoint", "description": "Token Endpoint URL of the PingOne App.", "multi": false, "required": true, "show_user": false }, { "name": "environment_id", "type": "text", "title": "Environment ID", "description": "Environment ID of the PingOne App.", "multi": false, "required": true, "show_user": false }, { "name": "client_id", "type": "text", "title": "Client ID", "description": "Client ID.", "multi": false, "required": true, "show_user": false }, { "name": "client_secret", "type": "password", "title": "Client Secret", "description": "Client Secret.", "multi": false, "required": true, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect PingOne logs via API", "description": "Collecting PingOne logs via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "ping_one.audit", "title": "Collect Audit logs from PingOne", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number on which listener binds to.", "multi": false, "required": true, "show_user": true, "default": 9100 }, { "name": "url", "type": "text", "title": "URL Path", "description": "This options specific which URL path to accept requests on. Defaults to /.", "multi": false, "required": false, "show_user": false, "default": "/" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "ping_one-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve ping_one.audit fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Audit logs", "description": "Collect audit logs from PingOne via HTTP Endpoint.", "enabled": true, "ingestion_method": "Webhook" }, { "input": "httpjson", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the activities from PingOne. Supported units for this parameter are h/m/s. (Maximum - 2 years)", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the PingOne API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "ping_one-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve ping_one.audit fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Audit logs", "description": "Collect audit logs from PingOne via REST API.", "enabled": true, "ingestion_method": "API" } ], "package": "ping_one", "path": "audit" } ] }