{ "name": "spycloud", "title": "SpyCloud Enterprise Protection", "version": "1.2.1", "release": "ga", "description": "Collect data from SpyCloud Enterprise Protection with Elastic Agent.", "type": "integration", "download": "/epr/spycloud/spycloud-1.2.1.zip", "path": "/package/spycloud/1.2.1", "icons": [ { "src": "/img/spycloud-logo.svg", "path": "/package/spycloud/1.2.1/img/spycloud-logo.svg", "title": "Sample logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.13.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "partner", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/spycloud/spycloud-1.2.1.zip.sig", "format_version": "3.2.1", "readme": "/package/spycloud/1.2.1/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/spycloud-breach-catalog-dashboard.png", "path": "/package/spycloud/1.2.1/img/spycloud-breach-catalog-dashboard.png", "title": "Breach Catalog Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/spycloud-breach-record-dashboard.png", "path": "/package/spycloud/1.2.1/img/spycloud-breach-record-dashboard.png", "title": "Breach Record Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/spycloud-compass-dashboard.png", "path": "/package/spycloud/1.2.1/img/spycloud-compass-dashboard.png", "title": "Compass Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/spycloud/1.2.1/LICENSE.txt", "/package/spycloud/1.2.1/changelog.yml", "/package/spycloud/1.2.1/manifest.yml", "/package/spycloud/1.2.1/validation.yml", "/package/spycloud/1.2.1/docs/README.md", "/package/spycloud/1.2.1/img/spycloud-breach-catalog-dashboard.png", "/package/spycloud/1.2.1/img/spycloud-breach-record-dashboard.png", "/package/spycloud/1.2.1/img/spycloud-compass-dashboard.png", "/package/spycloud/1.2.1/img/spycloud-logo.svg", "/package/spycloud/1.2.1/kibana/tags.yml", "/package/spycloud/1.2.1/data_stream/breach_catalog/manifest.yml", "/package/spycloud/1.2.1/data_stream/breach_catalog/sample_event.json", "/package/spycloud/1.2.1/data_stream/breach_record/manifest.yml", "/package/spycloud/1.2.1/data_stream/breach_record/sample_event.json", "/package/spycloud/1.2.1/data_stream/compass/manifest.yml", "/package/spycloud/1.2.1/data_stream/compass/sample_event.json", "/package/spycloud/1.2.1/kibana/dashboard/spycloud-586e3060-9e51-11ee-acf7-7108ddc3dcca.json", "/package/spycloud/1.2.1/kibana/dashboard/spycloud-9589d660-9e43-11ee-acf7-7108ddc3dcca.json", "/package/spycloud/1.2.1/kibana/dashboard/spycloud-a34dc2b0-9e62-11ee-acf7-7108ddc3dcca.json", "/package/spycloud/1.2.1/kibana/search/spycloud-183723e0-cfd3-11ee-be61-3fc66032ff4c.json", "/package/spycloud/1.2.1/kibana/search/spycloud-43954630-d171-11ee-be61-3fc66032ff4c.json", "/package/spycloud/1.2.1/kibana/search/spycloud-4757ed20-d169-11ee-be61-3fc66032ff4c.json", "/package/spycloud/1.2.1/kibana/search/spycloud-55e37350-cfd4-11ee-be61-3fc66032ff4c.json", "/package/spycloud/1.2.1/kibana/search/spycloud-90f45670-9e48-11ee-acf7-7108ddc3dcca.json", "/package/spycloud/1.2.1/kibana/search/spycloud-b2beff20-aadd-11ee-bf13-df1477528748.json", "/package/spycloud/1.2.1/kibana/search/spycloud-e27a8bb0-d168-11ee-be61-3fc66032ff4c.json", "/package/spycloud/1.2.1/kibana/search/spycloud-ec8c5750-cfd8-11ee-be61-3fc66032ff4c.json", "/package/spycloud/1.2.1/kibana/search/spycloud-f27f95b0-cfd7-11ee-be61-3fc66032ff4c.json", "/package/spycloud/1.2.1/data_stream/breach_catalog/fields/base-fields.yml", "/package/spycloud/1.2.1/data_stream/breach_catalog/fields/beats.yml", "/package/spycloud/1.2.1/data_stream/breach_catalog/fields/fields.yml", "/package/spycloud/1.2.1/data_stream/breach_record/fields/base-fields.yml", "/package/spycloud/1.2.1/data_stream/breach_record/fields/beats.yml", "/package/spycloud/1.2.1/data_stream/breach_record/fields/fields.yml", "/package/spycloud/1.2.1/data_stream/compass/fields/base-fields.yml", "/package/spycloud/1.2.1/data_stream/compass/fields/beats.yml", "/package/spycloud/1.2.1/data_stream/compass/fields/fields.yml", "/package/spycloud/1.2.1/data_stream/breach_catalog/agent/stream/cel.yml.hbs", "/package/spycloud/1.2.1/data_stream/breach_catalog/elasticsearch/ingest_pipeline/default.yml", "/package/spycloud/1.2.1/data_stream/breach_record/agent/stream/cel.yml.hbs", "/package/spycloud/1.2.1/data_stream/breach_record/elasticsearch/ingest_pipeline/default.yml", "/package/spycloud/1.2.1/data_stream/compass/agent/stream/cel.yml.hbs", "/package/spycloud/1.2.1/data_stream/compass/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "SpyCloud Enterprise Protection", "title": "SpyCloud Enterprise Protection logs", "description": "Collect SpyCloud Enterprise Protection logs.", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the SpyCloud Server API.", "multi": false, "required": true, "show_user": true, "default": "https://api.spycloud.io/enterprise-v2" }, { "name": "api_key", "type": "password", "title": "API Key", "description": "API Key for the SpyCloud Enterprise Protection.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect SpyCloud Enterprise Protection logs via API", "description": "Collecting SpyCloud Enterprise Protection logs via API." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "spycloud.breach_catalog", "title": "Collect Breach Catalog logs from SpyCloud Enterprise Protection.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval between two REST API calls. Expected value is multiples of 24, expressed in hours. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "spycloud-breach_catalog" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve spycloud.breach_catalog fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Breach Catalog Logs", "description": "Collect Breach Catalog logs from SpyCloud Enterprise Protection.", "enabled": false, "ingestion_method": "API" } ], "package": "spycloud", "path": "breach_catalog" }, { "type": "logs", "dataset": "spycloud.breach_record", "title": "Collect Breach Record logs from SpyCloud Enterprise Protection.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Breach Record logs from SpyCloud Server. Expected value is multiples of 24, expressed in hours. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval between two REST API calls. Expected value is multiples of 24, expressed in hours. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "severity", "type": "select", "title": "Severity", "description": "The severity level of the security event or compromise.", "multi": false, "required": true, "show_user": true, "default": "2,5,20,25" }, { "name": "hide_sensitive", "type": "bool", "title": "Hide Sensitive True", "description": "Hide sensitive user details.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "spycloud-breach_record" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve spycloud.breach_record fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Breach Record Logs", "description": "Collect Breach Record logs from SpyCloud Enterprise Protection.", "enabled": false, "ingestion_method": "API" } ], "package": "spycloud", "path": "breach_record" }, { "type": "logs", "dataset": "spycloud.compass", "title": "Collect Compass logs from SpyCloud Enterprise Protection.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Compass logs from SpyCloud Server. Expected value is multiples of 24, expressed in hours. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval between two REST API calls. Expected value is multiples of 24, expressed in hours. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "hide_sensitive", "type": "bool", "title": "Hide Sensitive True", "description": "Hide sensitive user details.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "spycloud-compass" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve spycloud.compass fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Compass Logs", "description": "Collect Compass logs from SpyCloud Enterprise Protection.", "enabled": false, "ingestion_method": "API" } ], "package": "spycloud", "path": "compass" } ] }