{ "name": "vectra_detect", "title": "Vectra Detect", "version": "1.11.0", "release": "ga", "source": { "license": "Elastic-2.0" }, "description": "Collect logs from Vectra Detect with Elastic Agent.", "type": "integration", "download": "/epr/vectra_detect/vectra_detect-1.11.0.zip", "path": "/package/vectra_detect/1.11.0", "icons": [ { "src": "/img/vectra-logo.svg", "path": "/package/vectra_detect/1.11.0/img/vectra-logo.svg", "title": "Vectra Detect", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.13.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "network_security" ], "signature_path": "/epr/vectra_detect/vectra_detect-1.11.0.zip.sig", "format_version": "3.0.3", "readme": "/package/vectra_detect/1.11.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/account-detection-dashboard.png", "path": "/package/vectra_detect/1.11.0/img/account-detection-dashboard.png", "title": "Account Detection Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/account-lockdown-dashboard.png", "path": "/package/vectra_detect/1.11.0/img/account-lockdown-dashboard.png", "title": "Account Lockdown Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/account-scoring-dashboard.png", "path": "/package/vectra_detect/1.11.0/img/account-scoring-dashboard.png", "title": "Account Scoring Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/alert-dashboard.png", "path": "/package/vectra_detect/1.11.0/img/alert-dashboard.png", "title": "Alert Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/audit-dashboard.png", "path": "/package/vectra_detect/1.11.0/img/audit-dashboard.png", "title": "Audit Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/campaign-dashboard.png", "path": "/package/vectra_detect/1.11.0/img/campaign-dashboard.png", "title": "Campaign Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/health-dashboard.png", "path": "/package/vectra_detect/1.11.0/img/health-dashboard.png", "title": "Health Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/host-detection-dashboard.png", "path": "/package/vectra_detect/1.11.0/img/host-detection-dashboard.png", "title": "Host Detection Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/host-lockdown-dashboard.png", "path": "/package/vectra_detect/1.11.0/img/host-lockdown-dashboard.png", "title": "Host Lockdown Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/host-scoring-dashboard.png", "path": "/package/vectra_detect/1.11.0/img/host-scoring-dashboard.png", "title": "Host Scoring Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/vectra_detect/1.11.0/LICENSE.txt", "/package/vectra_detect/1.11.0/changelog.yml", "/package/vectra_detect/1.11.0/manifest.yml", "/package/vectra_detect/1.11.0/validation.yml", "/package/vectra_detect/1.11.0/docs/README.md", "/package/vectra_detect/1.11.0/img/account-detection-dashboard.png", "/package/vectra_detect/1.11.0/img/account-lockdown-dashboard.png", "/package/vectra_detect/1.11.0/img/account-scoring-dashboard.png", "/package/vectra_detect/1.11.0/img/alert-dashboard.png", "/package/vectra_detect/1.11.0/img/audit-dashboard.png", "/package/vectra_detect/1.11.0/img/campaign-dashboard.png", "/package/vectra_detect/1.11.0/img/health-dashboard.png", "/package/vectra_detect/1.11.0/img/host-detection-dashboard.png", "/package/vectra_detect/1.11.0/img/host-lockdown-dashboard.png", "/package/vectra_detect/1.11.0/img/host-scoring-dashboard.png", "/package/vectra_detect/1.11.0/img/vectra-logo.svg", "/package/vectra_detect/1.11.0/kibana/tags.yml", "/package/vectra_detect/1.11.0/data_stream/log/manifest.yml", "/package/vectra_detect/1.11.0/data_stream/log/sample_event.json", "/package/vectra_detect/1.11.0/kibana/dashboard/vectra_detect-088fd030-b923-11ed-a75d-1d76b4fe7223.json", "/package/vectra_detect/1.11.0/kibana/dashboard/vectra_detect-0bbae190-e96c-11ed-82b8-a7ddbad6a7d5.json", "/package/vectra_detect/1.11.0/kibana/dashboard/vectra_detect-346971c0-b919-11ed-a75d-1d76b4fe7223.json", "/package/vectra_detect/1.11.0/kibana/dashboard/vectra_detect-607bc370-b8f7-11ed-a75d-1d76b4fe7223.json", "/package/vectra_detect/1.11.0/kibana/dashboard/vectra_detect-74869ba0-bcb3-11ed-837c-8b9d01cca76e.json", "/package/vectra_detect/1.11.0/kibana/dashboard/vectra_detect-a8310570-bcb9-11ed-837c-8b9d01cca76e.json", "/package/vectra_detect/1.11.0/kibana/dashboard/vectra_detect-ce341d40-b91f-11ed-a75d-1d76b4fe7223.json", "/package/vectra_detect/1.11.0/kibana/dashboard/vectra_detect-d517be50-bcbc-11ed-837c-8b9d01cca76e.json", "/package/vectra_detect/1.11.0/kibana/dashboard/vectra_detect-e44852c0-b8e5-11ed-a75d-1d76b4fe7223.json", "/package/vectra_detect/1.11.0/kibana/dashboard/vectra_detect-f685b060-bcc1-11ed-837c-8b9d01cca76e.json", "/package/vectra_detect/1.11.0/kibana/search/vectra_detect-61ac42e0-e978-11ed-9360-39d3b55aa664.json", "/package/vectra_detect/1.11.0/data_stream/log/fields/base-fields.yml", "/package/vectra_detect/1.11.0/data_stream/log/fields/beats.yml", "/package/vectra_detect/1.11.0/data_stream/log/fields/fields.yml", "/package/vectra_detect/1.11.0/data_stream/log/agent/stream/tcp.yml.hbs", "/package/vectra_detect/1.11.0/data_stream/log/agent/stream/udp.yml.hbs", "/package/vectra_detect/1.11.0/data_stream/log/elasticsearch/ingest_pipeline/default.yml", "/package/vectra_detect/1.11.0/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-detection.yml", "/package/vectra_detect/1.11.0/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-lockdown.yml", "/package/vectra_detect/1.11.0/data_stream/log/elasticsearch/ingest_pipeline/pipeline-account-scoring.yml", "/package/vectra_detect/1.11.0/data_stream/log/elasticsearch/ingest_pipeline/pipeline-alert.yml", "/package/vectra_detect/1.11.0/data_stream/log/elasticsearch/ingest_pipeline/pipeline-audit.yml", "/package/vectra_detect/1.11.0/data_stream/log/elasticsearch/ingest_pipeline/pipeline-campaign.yml", "/package/vectra_detect/1.11.0/data_stream/log/elasticsearch/ingest_pipeline/pipeline-health.yml", "/package/vectra_detect/1.11.0/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-detection.yml", "/package/vectra_detect/1.11.0/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-lockdown.yml", "/package/vectra_detect/1.11.0/data_stream/log/elasticsearch/ingest_pipeline/pipeline-host-scoring.yml" ], "policy_templates": [ { "name": "vectra_detect", "title": "Vectra Detect logs", "description": "Collect logs from Vectra Detect instances.", "inputs": [ { "type": "tcp", "title": "Collect Vectra Detect logs via TCP input", "description": "Collecting logs from Vectra Detect instances via tcp input." }, { "type": "udp", "title": "Collect Vectra Detect logs via UDP input", "description": "Collecting logs from Vectra Detect instances via udp input." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "vectra_detect.log", "title": "Collect logs from Vectra Detect", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9025 }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 20MiB\n#max_connections: 1\n#framing: delimiter\n#line_delimiter: \"\\n\"\n" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "i.e. certificate_authorities, supported_protocols, verification_mode etc.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "vectra_detect-log" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve vectra_detect.log fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Vectra Detect logs", "description": "Collect Vectra Detect logs via TCP input.", "enabled": true, "ingestion_method": "Network Protocol" }, { "input": "udp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for UDP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The UDP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9025 }, { "name": "udp_options", "type": "yaml", "title": "Custom UDP Options", "description": "Specify custom configuration options for the UDP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 10KiB\n#timeout: 300s\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "vectra_detect-log" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve vectra_detect.log fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "udp.yml.hbs", "title": "Vectra Detect logs", "description": "Collect Vectra Detect logs via UDP input.", "enabled": true, "ingestion_method": "Network Protocol" } ], "package": "vectra_detect", "path": "log" } ] }