{ "name": "tanium", "title": "Tanium", "version": "1.14.1", "release": "ga", "description": "This Elastic integration collects logs from Tanium with Elastic Agent.", "type": "integration", "download": "/epr/tanium/tanium-1.14.1.zip", "path": "/package/tanium/1.14.1", "icons": [ { "src": "/img/tanium-logo.svg", "path": "/package/tanium/1.14.1/img/tanium-logo.svg", "title": "Sample logo", "size": "224x224", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.16.2" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/tanium/tanium-1.14.1.zip.sig", "format_version": "3.0.3", "readme": "/package/tanium/1.14.1/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/tanium-action-history-dashboard.png", "path": "/package/tanium/1.14.1/img/tanium-action-history-dashboard.png", "title": "Tanium Action History Screenshot", "size": "1891x767", "type": "image/png" }, { "src": "/img/tanium-client-status-dashboard.png", "path": "/package/tanium/1.14.1/img/tanium-client-status-dashboard.png", "title": "Tanium Client Status Screenshot", "size": "1891x698", "type": "image/png" }, { "src": "/img/tanium-discover-dashboard.png", "path": "/package/tanium/1.14.1/img/tanium-discover-dashboard.png", "title": "Tanium Discover Screenshot", "size": "1902x788", "type": "image/png" }, { "src": "/img/tanium-endpoint-config-dashboard.png", "path": "/package/tanium/1.14.1/img/tanium-endpoint-config-dashboard.png", "title": "Tanium Endpoint Config Screenshot", "size": "1890x708", "type": "image/png" }, { "src": "/img/tanium-reporting-dashboard.png", "path": "/package/tanium/1.14.1/img/tanium-reporting-dashboard.png", "title": "Tanium Reporting Screenshot", "size": "1893x800", "type": "image/png" }, { "src": "/img/tanium-threat-response-dashboard.png", "path": "/package/tanium/1.14.1/img/tanium-threat-response-dashboard.png", "title": "Tanium Threat Response Screenshot", "size": "1893x800", "type": "image/png" } ], "assets": [ "/package/tanium/1.14.1/LICENSE.txt", "/package/tanium/1.14.1/changelog.yml", "/package/tanium/1.14.1/manifest.yml", "/package/tanium/1.14.1/validation.yml", "/package/tanium/1.14.1/docs/README.md", "/package/tanium/1.14.1/img/tanium-action-history-dashboard.png", "/package/tanium/1.14.1/img/tanium-client-status-dashboard.png", "/package/tanium/1.14.1/img/tanium-discover-dashboard.png", "/package/tanium/1.14.1/img/tanium-endpoint-config-dashboard.png", "/package/tanium/1.14.1/img/tanium-logo.svg", "/package/tanium/1.14.1/img/tanium-reporting-dashboard.png", "/package/tanium/1.14.1/img/tanium-threat-response-dashboard.png", "/package/tanium/1.14.1/kibana/tags.yml", "/package/tanium/1.14.1/data_stream/action_history/manifest.yml", "/package/tanium/1.14.1/data_stream/action_history/sample_event.json", "/package/tanium/1.14.1/data_stream/client_status/manifest.yml", "/package/tanium/1.14.1/data_stream/client_status/sample_event.json", "/package/tanium/1.14.1/data_stream/discover/manifest.yml", "/package/tanium/1.14.1/data_stream/discover/sample_event.json", "/package/tanium/1.14.1/data_stream/endpoint_config/manifest.yml", "/package/tanium/1.14.1/data_stream/endpoint_config/sample_event.json", "/package/tanium/1.14.1/data_stream/reporting/manifest.yml", "/package/tanium/1.14.1/data_stream/reporting/sample_event.json", "/package/tanium/1.14.1/data_stream/threat_response/manifest.yml", "/package/tanium/1.14.1/data_stream/threat_response/sample_event.json", "/package/tanium/1.14.1/kibana/dashboard/tanium-1cf57430-add9-11ed-baef-9ff4bc7fc264.json", "/package/tanium/1.14.1/kibana/dashboard/tanium-53510240-751e-11ed-ac81-f9d06ecfbe4d.json", "/package/tanium/1.14.1/kibana/dashboard/tanium-bb48efc0-7221-11ed-9ca9-cffacbd3ea4b.json", "/package/tanium/1.14.1/kibana/dashboard/tanium-d007ae70-6712-11ed-a002-4b5caf8e6ce4.json", "/package/tanium/1.14.1/kibana/dashboard/tanium-ed004c30-97c3-11ed-995f-9bf277425742.json", "/package/tanium/1.14.1/kibana/dashboard/tanium-ee076ba0-7166-11ed-8152-6bb1c847deb5.json", "/package/tanium/1.14.1/data_stream/action_history/fields/base-fields.yml", "/package/tanium/1.14.1/data_stream/action_history/fields/beats.yml", "/package/tanium/1.14.1/data_stream/action_history/fields/fields.yml", "/package/tanium/1.14.1/data_stream/client_status/fields/base-fields.yml", "/package/tanium/1.14.1/data_stream/client_status/fields/beats.yml", "/package/tanium/1.14.1/data_stream/client_status/fields/fields.yml", "/package/tanium/1.14.1/data_stream/discover/fields/base-fields.yml", "/package/tanium/1.14.1/data_stream/discover/fields/beats.yml", "/package/tanium/1.14.1/data_stream/discover/fields/fields.yml", "/package/tanium/1.14.1/data_stream/endpoint_config/fields/base-fields.yml", "/package/tanium/1.14.1/data_stream/endpoint_config/fields/beats.yml", "/package/tanium/1.14.1/data_stream/endpoint_config/fields/fields.yml", "/package/tanium/1.14.1/data_stream/reporting/fields/base-fields.yml", "/package/tanium/1.14.1/data_stream/reporting/fields/beats.yml", "/package/tanium/1.14.1/data_stream/reporting/fields/fields.yml", "/package/tanium/1.14.1/data_stream/threat_response/fields/base-fields.yml", "/package/tanium/1.14.1/data_stream/threat_response/fields/beats.yml", "/package/tanium/1.14.1/data_stream/threat_response/fields/fields.yml", "/package/tanium/1.14.1/data_stream/action_history/agent/stream/aws-s3.yml.hbs", "/package/tanium/1.14.1/data_stream/action_history/agent/stream/http_endpoint.yml.hbs", "/package/tanium/1.14.1/data_stream/action_history/agent/stream/tcp.yml.hbs", "/package/tanium/1.14.1/data_stream/action_history/elasticsearch/ingest_pipeline/default.yml", "/package/tanium/1.14.1/data_stream/client_status/agent/stream/aws-s3.yml.hbs", "/package/tanium/1.14.1/data_stream/client_status/agent/stream/http_endpoint.yml.hbs", "/package/tanium/1.14.1/data_stream/client_status/agent/stream/tcp.yml.hbs", "/package/tanium/1.14.1/data_stream/client_status/elasticsearch/ingest_pipeline/default.yml", "/package/tanium/1.14.1/data_stream/discover/agent/stream/aws-s3.yml.hbs", "/package/tanium/1.14.1/data_stream/discover/agent/stream/http_endpoint.yml.hbs", "/package/tanium/1.14.1/data_stream/discover/agent/stream/tcp.yml.hbs", "/package/tanium/1.14.1/data_stream/discover/elasticsearch/ingest_pipeline/default.yml", "/package/tanium/1.14.1/data_stream/endpoint_config/agent/stream/aws-s3.yml.hbs", "/package/tanium/1.14.1/data_stream/endpoint_config/agent/stream/http_endpoint.yml.hbs", "/package/tanium/1.14.1/data_stream/endpoint_config/agent/stream/tcp.yml.hbs", "/package/tanium/1.14.1/data_stream/endpoint_config/elasticsearch/ingest_pipeline/default.yml", "/package/tanium/1.14.1/data_stream/reporting/agent/stream/aws-s3.yml.hbs", "/package/tanium/1.14.1/data_stream/reporting/agent/stream/http_endpoint.yml.hbs", "/package/tanium/1.14.1/data_stream/reporting/agent/stream/tcp.yml.hbs", "/package/tanium/1.14.1/data_stream/reporting/elasticsearch/ingest_pipeline/default.yml", "/package/tanium/1.14.1/data_stream/threat_response/agent/stream/aws-s3.yml.hbs", "/package/tanium/1.14.1/data_stream/threat_response/agent/stream/http_endpoint.yml.hbs", "/package/tanium/1.14.1/data_stream/threat_response/agent/stream/tcp.yml.hbs", "/package/tanium/1.14.1/data_stream/threat_response/elasticsearch/ingest_pipeline/default.yml", "/package/tanium/1.14.1/data_stream/threat_response/elasticsearch/ingest_pipeline/match_details.yml", "/package/tanium/1.14.1/data_stream/threat_response/elasticsearch/ingest_pipeline/match_details_whats.yml", "/package/tanium/1.14.1/data_stream/threat_response/elasticsearch/ingest_pipeline/match_details_whats_actions.yml" ], "policy_templates": [ { "name": "Tanium", "title": "Tanium logs", "description": "Collect logs using TCP, HTTP endpoint, and AWS S3 or AWS SQS.", "inputs": [ { "type": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "ARN of the AWS S3 bucket that will be polled for list operation. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "ARN of the AWS S3 Access Point that will be polled for list operation. Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "URL of the AWS SQS queue that messages will be received from. It is a required parameter for collecting logs via the AWS SQS.", "multi": false, "required": false, "show_user": true }, { "name": "access_key_id", "type": "password", "title": "Access Key ID", "description": "First part of access key. This parameter along with the secret_access_key parameter is required if we are not providing shared_credential_file.", "multi": false, "required": false, "show_user": true }, { "name": "secret_access_key", "type": "password", "title": "Secret Access Key", "description": "Second part of access key. This parameter along with the access_key_id parameter is required if we are not providing shared_credential_file.", "multi": false, "required": false, "show_user": true }, { "name": "session_token", "type": "password", "title": "Session Token", "description": "Required when using temporary security credentials.", "multi": false, "required": false, "show_user": true }, { "name": "shared_credential_file", "type": "text", "title": "Shared Credential File", "description": "Directory of the shared credentials file. This parameter is required if we are not providing value for the parameters - secret_access_key and access_key_id.", "multi": false, "required": false, "show_user": false }, { "name": "credential_profile_name", "type": "text", "title": "Credential Profile Name", "description": "Profile name in shared credentials file.", "multi": false, "required": false, "show_user": false }, { "name": "role_arn", "type": "text", "title": "Role ARN", "description": "AWS IAM Role to assume.", "multi": false, "required": false, "show_user": false }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false } ], "title": "Collect Tanium logs via AWS S3 or AWS SQS", "description": "Collecting logs from tanium via AWS S3 or AWS SQS." }, { "type": "http_endpoint", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for HTTP endpoint connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "secret_header", "type": "text", "title": "Secret Header", "description": "The header to check for a specific value specified by `secret.value`.", "multi": false, "required": false, "show_user": false }, { "name": "secret_value", "type": "password", "title": "Secret Value", "description": "The secret stored in the header name specified by `secret.header`.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Tanium logs via HTTP Endpoint", "description": "Collecting logs from Tanium via HTTP Endpoint." }, { "type": "tcp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Tanium logs via TCP input", "description": "Collecting Tanium logs via TCP input" } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "tanium.action_history", "title": "Collect Action History logs from Tanium.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true, "default": "action_history" }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.", "multi": false, "required": false, "show_user": false, "default": "- regex: \"action_history/\"\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-action_history" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.action_history fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Action History logs", "description": "Collect Action History logs.", "enabled": true, "ingestion_method": "AWS S3" }, { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number the listener binds to.", "multi": false, "required": true, "show_user": true, "default": 9577 }, { "name": "url", "type": "text", "title": "URL", "description": "This option specifies which URL path to accept requests on. Defaults to /.", "multi": false, "required": false, "show_user": false, "default": "/" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-action_history" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.action_history fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Action History logs", "description": "Collect Action History logs.", "enabled": false, "ingestion_method": "Webhook" }, { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9578 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-action_history" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.action_history fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Action History logs", "description": "Collect Action History logs.", "enabled": false, "ingestion_method": "Network Protocol" } ], "package": "tanium", "path": "action_history" }, { "type": "logs", "dataset": "tanium.client_status", "title": "Client Status", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number the listener binds to.", "multi": false, "required": true, "show_user": true, "default": 9579 }, { "name": "url", "type": "text", "title": "URL", "description": "This option specifies which URL path to accept requests on. Defaults to /.", "multi": false, "required": false, "show_user": false, "default": "/" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-client_status" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.client_status fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Client Status logs", "description": "Collect Client Status logs.", "enabled": false, "ingestion_method": "Webhook" }, { "input": "aws-s3", "vars": [ { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true, "default": "client_status" }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.", "multi": false, "required": false, "show_user": false, "default": "- regex: \"client_status/\"\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-client_status" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.client_status fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Client Status logs", "description": "Collect Client Status logs.", "enabled": true, "ingestion_method": "AWS S3" }, { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9580 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-client_status" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.client_status fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Client Status logs", "description": "Collect Client Status logs.", "enabled": false, "ingestion_method": "Network Protocol" } ], "package": "tanium", "path": "client_status" }, { "type": "logs", "dataset": "tanium.discover", "title": "Collect Tanium Discover logs from Tanium", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true, "default": "discover" }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.", "multi": false, "required": false, "show_user": false, "default": "- regex: \"discover/\"\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-discover" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.discover fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Discover logs", "description": "Collect Discover logs.", "enabled": true, "ingestion_method": "AWS S3" }, { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number the listener binds to.", "multi": false, "required": true, "show_user": true, "default": 9581 }, { "name": "url", "type": "text", "title": "URL", "description": "This option specifies which URL path to accept requests on. Defaults to /.", "multi": false, "required": false, "show_user": false, "default": "/" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-discover" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.discover fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Discover logs", "description": "Collect Discover logs.", "enabled": false, "ingestion_method": "Webhook" }, { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9582 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-discover" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.discover fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Discover logs", "description": "Collect Discover logs.", "enabled": false, "ingestion_method": "Network Protocol" } ], "package": "tanium", "path": "discover" }, { "type": "logs", "dataset": "tanium.endpoint_config", "title": "Collect Endpoint Config logs from Tanium", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true, "default": "endpoint_config" }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.", "multi": false, "required": false, "show_user": false, "default": "- regex: \"endpoint_config/\"\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-endpoint_config" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.endpoint_config fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Endpoint Config logs", "description": "Collect Endpoint Config logs.", "enabled": true, "ingestion_method": "AWS S3" }, { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number the listener binds to.", "multi": false, "required": true, "show_user": true, "default": 9583 }, { "name": "url", "type": "text", "title": "URL", "description": "This option specifies which URL path to accept requests on. Defaults to /.", "multi": false, "required": false, "show_user": false, "default": "/" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-endpoint_config" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.endpoint_config fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Endpoint Config logs", "description": "Collect Endpoint Config logs.", "enabled": false, "ingestion_method": "Webhook" }, { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9584 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-endpoint_config" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.endpoint_config fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Endpoint Config logs", "description": "Collect Endpoint Config logs.", "enabled": false, "ingestion_method": "Network Protocol" } ], "package": "tanium", "path": "endpoint_config" }, { "type": "logs", "dataset": "tanium.reporting", "title": "Reporting", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number the listener binds to.", "multi": false, "required": true, "show_user": true, "default": 9585 }, { "name": "url", "type": "text", "title": "URL", "description": "This option specifies which URL path to accept requests on. Defaults to /.", "multi": false, "required": false, "show_user": false, "default": "/" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-reporting" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.reporting fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Reporting logs", "description": "Collect Reporting logs.", "enabled": false, "ingestion_method": "Webhook" }, { "input": "aws-s3", "vars": [ { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true, "default": "reporting" }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.", "multi": false, "required": false, "show_user": false, "default": "- regex: \"reporting/\"\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-reporting" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.reporting fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Reporting logs", "description": "Collect Reporting logs.", "enabled": true, "ingestion_method": "AWS S3" }, { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9586 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-reporting" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.reporting fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Reporting logs", "description": "Collect Reporting logs.", "enabled": false, "ingestion_method": "Network Protocol" } ], "package": "tanium", "path": "reporting" }, { "type": "logs", "dataset": "tanium.threat_response", "title": "Collect Threat Response logs from Tanium.", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true, "default": "threat_response" }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. Interval should be greater than the Tanium scheduler time and supported units are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Multiple regexes are used [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match any of the regexes will not be processed.", "multi": false, "required": false, "show_user": false, "default": "- regex: \"threat_response/\"\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-threat_response" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.threat_response fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Threat Response logs", "description": "Collect threat response logs.", "enabled": true, "ingestion_method": "AWS S3" }, { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number the listener binds to.", "multi": false, "required": true, "show_user": true, "default": 9587 }, { "name": "url", "type": "text", "title": "URL", "description": "This option specifies which URL path to accept requests on. Defaults to /.", "multi": false, "required": false, "show_user": false, "default": "/" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-threat_response" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.threat_response fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Threat Response logs", "description": "Collect Threat Response logs.", "enabled": false, "ingestion_method": "Webhook" }, { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9588 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "tanium-threat_response" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve tanium.threat_response fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Threat Response logs", "description": "Collect Threat Response logs.", "enabled": false, "ingestion_method": "Network Protocol" } ], "package": "tanium", "path": "threat_response" } ] }