{
  "name": "admin_by_request_epm",
  "title": "Admin By Request EPM",
  "version": "1.4.1",
  "release": "ga",
  "source": {
    "license": "Elastic-2.0"
  },
  "description": "Collect logs from Admin By Request EPM with Elastic Agent.",
  "type": "integration",
  "download": "/epr/admin_by_request_epm/admin_by_request_epm-1.4.1.zip",
  "path": "/package/admin_by_request_epm/1.4.1",
  "icons": [
    {
      "src": "/img/logo.svg",
      "path": "/package/admin_by_request_epm/1.4.1/img/logo.svg",
      "title": "Sample logo",
      "size": "832x101",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.19.2 || ^9.0.5"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "elastic",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "security",
    "iam",
    "credential_management"
  ],
  "signature_path": "/epr/admin_by_request_epm/admin_by_request_epm-1.4.1.zip.sig",
  "format_version": "3.3.2",
  "readme": "/package/admin_by_request_epm/1.4.1/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/auditlog_1.png",
      "path": "/package/admin_by_request_epm/1.4.1/img/auditlog_1.png",
      "title": "Auditlog and Events",
      "size": "3024x1640",
      "type": "image/png"
    },
    {
      "src": "/img/events_1.png",
      "path": "/package/admin_by_request_epm/1.4.1/img/events_1.png",
      "title": "Auditlog and Events",
      "size": "3024x1640",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/admin_by_request_epm/1.4.1/LICENSE.txt",
    "/package/admin_by_request_epm/1.4.1/changelog.yml",
    "/package/admin_by_request_epm/1.4.1/manifest.yml",
    "/package/admin_by_request_epm/1.4.1/docs/README.md",
    "/package/admin_by_request_epm/1.4.1/img/auditlog_1.png",
    "/package/admin_by_request_epm/1.4.1/img/events_1.png",
    "/package/admin_by_request_epm/1.4.1/img/logo.svg",
    "/package/admin_by_request_epm/1.4.1/data_stream/auditlog/manifest.yml",
    "/package/admin_by_request_epm/1.4.1/data_stream/auditlog/sample_event.json",
    "/package/admin_by_request_epm/1.4.1/data_stream/events/manifest.yml",
    "/package/admin_by_request_epm/1.4.1/data_stream/events/sample_event.json",
    "/package/admin_by_request_epm/1.4.1/kibana/dashboard/admin_by_request_epm-186f2f70-8c25-4de7-b2b6-950045f14a49.json",
    "/package/admin_by_request_epm/1.4.1/kibana/dashboard/admin_by_request_epm-aef4665f-b43e-46f4-a635-1be3117ffc9e.json",
    "/package/admin_by_request_epm/1.4.1/data_stream/auditlog/fields/base-fields.yml",
    "/package/admin_by_request_epm/1.4.1/data_stream/auditlog/fields/fields.yml",
    "/package/admin_by_request_epm/1.4.1/data_stream/events/fields/base-fields.yml",
    "/package/admin_by_request_epm/1.4.1/data_stream/events/fields/fields.yml",
    "/package/admin_by_request_epm/1.4.1/data_stream/auditlog/agent/stream/cel.yml.hbs",
    "/package/admin_by_request_epm/1.4.1/data_stream/auditlog/elasticsearch/ingest_pipeline/default.yml",
    "/package/admin_by_request_epm/1.4.1/data_stream/events/agent/stream/cel.yml.hbs",
    "/package/admin_by_request_epm/1.4.1/data_stream/events/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "admin_by_request_epm",
      "title": "Admin By Request EPM Events",
      "description": "Collect events and audit logs from Admin By Request EPM",
      "inputs": [
        {
          "type": "cel",
          "vars": [
            {
              "name": "url",
              "type": "text",
              "title": "URL of Admin By Request EPM API Server",
              "description": "URL of Admin By Request EPM API Server",
              "multi": false,
              "required": true,
              "show_user": true
            },
            {
              "name": "apikey",
              "type": "text",
              "title": "API Key token of Admin By Request EPM API Server",
              "description": "This is the API key token you have created on Admin By Request EPM.",
              "multi": false,
              "required": true,
              "show_user": true
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": false
            },
            {
              "name": "http_client_timeout",
              "type": "text",
              "title": "HTTP Client Timeout",
              "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.",
              "multi": false,
              "required": false,
              "show_user": true
            },
            {
              "name": "proxy_url",
              "type": "text",
              "title": "Proxy URL",
              "description": "URL to proxy connections in the form of http\\[s\\]://<user>:<password>@<server name/ip>:<port>",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "ssl",
              "type": "yaml",
              "title": "SSL Configuration",
              "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "title": "Collect events and audit logs from Admin By Request EPM API",
          "description": "Collecting events and audit logs from Admin By Request EPM API"
        }
      ],
      "multiple": true,
      "deployment_modes": {
        "default": {
          "enabled": true
        },
        "agentless": {
          "enabled": true,
          "release": "ga"
        }
      }
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "admin_by_request_epm.auditlog",
      "title": "Admin By Request EPM Auditlog Data Stream",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "cel",
          "vars": [
            {
              "name": "initial_interval_days",
              "type": "integer",
              "title": "Initial Interval",
              "description": "Number of days from today for which historical data will be fetched (e.g. `60`).",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": 60
            },
            {
              "name": "interval",
              "type": "text",
              "title": "Interval",
              "description": "Duration between requests to get data from API. Supported units for this parameter are h/m/s (e.g. `10s`).",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "60s"
            },
            {
              "name": "page_size",
              "type": "integer",
              "title": "Page Size",
              "description": "Number of auditlog events to fetch per request.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 1000
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "description": "Tags to be applied to the events, such as 'forwarded'",
              "multi": true,
              "required": false,
              "show_user": true,
              "default": [
                "forwarded",
                "admin_by_request_epm.auditlog"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve Original Event",
              "description": "Preserves a raw copy of the original event in the `event.original` field",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors can be used to reduce the number of fields in the exported event or to enhance the event with additional metadata. This executes in the agent before the logs are parsed.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "cel.yml.hbs",
          "title": "Admin By Request EPM Auditlog Logs",
          "description": "Request settings for Admin By Request EPM Auditlog Events",
          "enabled": true,
          "ingestion_method": "API"
        }
      ],
      "package": "admin_by_request_epm",
      "path": "auditlog"
    },
    {
      "type": "logs",
      "dataset": "admin_by_request_epm.events",
      "title": "Admin By Request EPM Events Data Stream",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "cel",
          "vars": [
            {
              "name": "initial_interval_days",
              "type": "integer",
              "title": "Initial Interval",
              "description": "Number of days from today for which historical data will be fetched (e.g. `60`).",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": 60
            },
            {
              "name": "interval",
              "type": "text",
              "title": "Interval",
              "description": "Duration between requests to get data from API. Supported units for this parameter are h/m/s (e.g. `10s`).",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "60s"
            },
            {
              "name": "page_size",
              "type": "integer",
              "title": "Page Size",
              "description": "Number of events to fetch per request.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 1000
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "description": "Tags to be applied to the event, such as 'forwarded'",
              "multi": true,
              "required": false,
              "show_user": true,
              "default": [
                "forwarded",
                "admin_by_request_epm.events"
              ]
            },
            {
              "name": "preserve_original_",
              "type": "bool",
              "title": "Preserve Original",
              "description": "Preserves a raw copy of the original  in the `.original` field",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors can be used to reduce the number of fields in the exported  or to enhance the  with additional metadata. This executes in the agent before the logs are parsed.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "cel.yml.hbs",
          "title": "Admin By Request EPM Events Logs",
          "description": "Request settings for Admin By Request EPM Events Data Stream",
          "enabled": true,
          "ingestion_method": "API"
        }
      ],
      "package": "admin_by_request_epm",
      "path": "events"
    }
  ]
}