{ "name": "proofpoint_itm", "title": "Proofpoint ITM", "version": "1.2.0", "release": "ga", "description": "Collect logs from Proofpoint ITM using Elastic Agent.", "type": "integration", "download": "/epr/proofpoint_itm/proofpoint_itm-1.2.0.zip", "path": "/package/proofpoint_itm/1.2.0", "icons": [ { "src": "/img/proofpoint_itm-logo.svg", "path": "/package/proofpoint_itm/1.2.0/img/proofpoint_itm-logo.svg", "title": "Proofpoint ITM logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.18.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/proofpoint_itm/proofpoint_itm-1.2.0.zip.sig", "format_version": "3.3.2", "readme": "/package/proofpoint_itm/1.2.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/proofpoint_itm-report-dashboard.png", "path": "/package/proofpoint_itm/1.2.0/img/proofpoint_itm-report-dashboard.png", "title": "Proofpoint ITM Report Dahsboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/proofpoint_itm/1.2.0/LICENSE.txt", "/package/proofpoint_itm/1.2.0/changelog.yml", "/package/proofpoint_itm/1.2.0/manifest.yml", "/package/proofpoint_itm/1.2.0/docs/README.md", "/package/proofpoint_itm/1.2.0/img/proofpoint_itm-logo.svg", "/package/proofpoint_itm/1.2.0/img/proofpoint_itm-report-dashboard.png", "/package/proofpoint_itm/1.2.0/data_stream/report/manifest.yml", "/package/proofpoint_itm/1.2.0/data_stream/report/sample_event.json", "/package/proofpoint_itm/1.2.0/kibana/dashboard/proofpoint_itm-29f45960-20a5-4ca4-a40a-ad1504eb8138.json", "/package/proofpoint_itm/1.2.0/kibana/tag/proofpoint_itm-security-solution-default.json", "/package/proofpoint_itm/1.2.0/data_stream/report/fields/base-fields.yml", "/package/proofpoint_itm/1.2.0/data_stream/report/fields/beats.yml", "/package/proofpoint_itm/1.2.0/data_stream/report/fields/fields.yml", "/package/proofpoint_itm/1.2.0/data_stream/report/agent/stream/cel.yml.hbs", "/package/proofpoint_itm/1.2.0/data_stream/report/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "proofpoint_itm", "title": "Proofpoint ITM Logs", "description": "Collect Proofpoint ITM logs", "inputs": [ { "type": "cel", "title": "Collect Proofpoint ITM logs via API", "description": "Collecting Proofpoint ITM logs via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "proofpoint_itm.report", "title": "Collect Reports from Proofpoint ITM", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "client_id", "type": "text", "title": "Client ID", "description": "Client ID for the Proofpoint ITM.", "multi": false, "required": true, "show_user": true }, { "name": "client_secret", "type": "password", "title": "Client Secret", "description": "Client Secret for the Proofpoint ITM.", "multi": false, "required": true, "show_user": true }, { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the Proofpoint ITM.", "multi": false, "required": true, "show_user": true }, { "name": "token_url", "type": "text", "title": "Token URL", "description": "Token URL of Proofpoint ITM.", "multi": false, "required": true, "show_user": false }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Reports from Proofpoint ITM API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Proofpoint ITM API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Proofpoint ITM API. The maximum supported batch size value is 1000.", "multi": false, "required": true, "show_user": false, "default": 10000 }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "1m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "proofpoint_itm-report" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve proofpoint_itm.report fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "cel.yml.hbs", "title": "Reports", "description": "Collect Reports from Proofpoint ITM.", "enabled": false, "ingestion_method": "API" } ], "package": "proofpoint_itm", "path": "report" } ] }