{ "name": "pps", "title": "Pleasant Password Server", "version": "1.1.0", "release": "ga", "source": { "license": "Apache-2.0" }, "description": "Integration for Pleasant Password Server Syslog Messages", "type": "integration", "download": "/epr/pps/pps-1.1.0.zip", "path": "/package/pps/1.1.0", "icons": [ { "src": "/img/logo.svg", "path": "/package/pps/1.1.0/img/logo.svg", "title": "PPS logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.13.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "community", "github": "elastic/security-service-integrations" }, "categories": [ "custom", "productivity", "security" ], "signature_path": "/epr/pps/pps-1.1.0.zip.sig", "format_version": "3.0.3", "readme": "/package/pps/1.1.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/overview-dashboard.png", "path": "/package/pps/1.1.0/img/overview-dashboard.png", "title": "Pleasant Password Server overview", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/pps/1.1.0/LICENSE.txt", "/package/pps/1.1.0/changelog.yml", "/package/pps/1.1.0/manifest.yml", "/package/pps/1.1.0/validation.yml", "/package/pps/1.1.0/docs/README.md", "/package/pps/1.1.0/img/logo.svg", "/package/pps/1.1.0/img/overview-dashboard.png", "/package/pps/1.1.0/data_stream/log/manifest.yml", "/package/pps/1.1.0/data_stream/log/sample_event.json", "/package/pps/1.1.0/kibana/dashboard/pps-66ae8483-4391-4554-a223-11e5c6c98653.json", "/package/pps/1.1.0/kibana/search/pps-e1373589-225f-4d6e-8751-fc846f726b10.json", "/package/pps/1.1.0/data_stream/log/fields/agent.yml", "/package/pps/1.1.0/data_stream/log/fields/base-fields.yml", "/package/pps/1.1.0/data_stream/log/fields/fields.yml", "/package/pps/1.1.0/data_stream/log/agent/stream/log.yml.hbs", "/package/pps/1.1.0/data_stream/log/agent/stream/tcp.yml.hbs", "/package/pps/1.1.0/data_stream/log/agent/stream/udp.yml.hbs", "/package/pps/1.1.0/data_stream/log/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "Pleasant Password Server", "title": "Pleasant Password Server logs", "description": "Collect Pleasant Password Server logs.", "inputs": [ { "type": "logfile", "vars": [ { "name": "paths", "type": "text", "title": "Paths", "multi": true, "required": true, "show_user": true } ], "title": "Collect logs from Pleasant Password Server via File input", "description": "Collecting syslog from Pleasant Password Server via File input." }, { "type": "tcp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9037 }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect logs from Pleasant Password Server via TCP input", "description": "Collecting logs from Pleasant Password Server via TCP input." }, { "type": "udp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for UDP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The UDP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9038 } ], "title": "Collect logs from Pleasant Password Server via UDP input", "description": "Collecting syslog from Pleasant Password Server via UDP input." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "pps.log", "title": "Pleasant Password Server logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "logfile", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "pps-log" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "tz_offset", "type": "text", "title": "Timezone Offset", "description": "By default, datetimes in the logs will be interpreted as relative to the timezone configured in the host where the agent is running. If ingesting logs from a host on a different timezone, use this field to set the timezone offset so that datetimes are correctly parsed. Acceptable timezone formats are: a canonical ID (e.g. \"Europe/Amsterdam\"), abbreviated (e.g. \"EST\") or an HH:mm differential (e.g. \"-05:00\") from UCT.", "multi": false, "required": true, "show_user": true, "default": "local" }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "log.yml.hbs", "title": "Pleasant Password Server logs", "description": "Collect Pleasant Password Server logs via file input.", "enabled": true, "ingestion_method": "File" }, { "input": "tcp", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "pps-log" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "tz_offset", "type": "text", "title": "Timezone Offset", "description": "By default, datetimes in the logs will be interpreted as relative to the timezone configured in the host where the agent is running. If ingesting logs from a host on a different timezone, use this field to set the timezone offset so that datetimes are correctly parsed. Acceptable timezone formats are: a canonical ID (e.g. \"Europe/Amsterdam\"), abbreviated (e.g. \"EST\") or an HH:mm differential (e.g. \"-05:00\") from UCT.", "multi": false, "required": true, "show_user": true, "default": "local" }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Pleasant Password Server logs", "description": "Collect Pleasant Password Server logs via TCP input.", "enabled": true, "ingestion_method": "Network Protocol" }, { "input": "udp", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "pps-log" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "tz_offset", "type": "text", "title": "Timezone Offset", "description": "By default, datetimes in the logs will be interpreted as relative to the timezone configured in the host where the agent is running. If ingesting logs from a host on a different timezone, use this field to set the timezone offset so that datetimes are correctly parsed. Acceptable timezone formats are: a canonical ID (e.g. \"Europe/Amsterdam\"), abbreviated (e.g. \"EST\") or an HH:mm differential (e.g. \"-05:00\") from UCT.", "multi": false, "required": true, "show_user": true, "default": "local" }, { "name": "udp_options", "type": "yaml", "title": "Custom UDP Options", "description": "Specify custom configuration options for the UDP input.", "multi": false, "required": false, "show_user": false, "default": "#read_buffer: 100MiB\n#max_message_size: 50KiB\n#timeout: 300s\n" }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "udp.yml.hbs", "title": "Pleasant Password Server logs", "description": "Collect Pleasant Password Server logs via UDP input.", "enabled": true, "ingestion_method": "Network Protocol" } ], "package": "pps", "path": "log" } ] }