{ "name": "anduril_lattice", "title": "Anduril Lattice", "version": "0.2.0", "release": "beta", "source": { "license": "Elastic-2.0" }, "description": "Collect entity events from Anduril Lattice — a software-defined command and control platform — using Elastic Agent for real-time situational awareness, threat monitoring, and asset tracking.", "type": "integration", "download": "/epr/anduril_lattice/anduril_lattice-0.2.0.zip", "path": "/package/anduril_lattice/0.2.0", "icons": [ { "src": "/img/anduril-logo.svg", "path": "/package/anduril_lattice/0.2.0/img/anduril-logo.svg", "title": "Anduril logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^9.2.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/anduril_lattice/anduril_lattice-0.2.0.zip.sig", "format_version": "3.6.3", "readme": "/package/anduril_lattice/0.2.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/entity-dashboard-map_kpis.png", "path": "/package/anduril_lattice/0.2.0/img/entity-dashboard-map_kpis.png", "title": "Entity map and key metrics", "size": "600x600", "type": "image/png" }, { "src": "/img/entity-dashboard-distributions.png", "path": "/package/anduril_lattice/0.2.0/img/entity-dashboard-distributions.png", "title": "Entity disposition and platform type distributions", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/anduril_lattice/0.2.0/LICENSE.txt", "/package/anduril_lattice/0.2.0/changelog.yml", "/package/anduril_lattice/0.2.0/manifest.yml", "/package/anduril_lattice/0.2.0/docs/README.md", "/package/anduril_lattice/0.2.0/img/anduril-logo.svg", "/package/anduril_lattice/0.2.0/img/entity-dashboard-distributions.png", "/package/anduril_lattice/0.2.0/img/entity-dashboard-map_kpis.png", "/package/anduril_lattice/0.2.0/data_stream/entity/manifest.yml", "/package/anduril_lattice/0.2.0/data_stream/entity/sample_event.json", "/package/anduril_lattice/0.2.0/kibana/dashboard/anduril_lattice-153d9e91-df65-45b8-9de4-9aaf86ef3f72.json", "/package/anduril_lattice/0.2.0/data_stream/entity/fields/base-fields.yml", "/package/anduril_lattice/0.2.0/data_stream/entity/fields/beats.yml", "/package/anduril_lattice/0.2.0/data_stream/entity/fields/ecs.yml", "/package/anduril_lattice/0.2.0/data_stream/entity/fields/fields.yml", "/package/anduril_lattice/0.2.0/data_stream/entity/agent/stream/cel.yml.hbs", "/package/anduril_lattice/0.2.0/data_stream/entity/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "anduril_lattice", "title": "Anduril Lattice", "description": "Collect entity events from Anduril Lattice", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "url", "title": "Lattice API URL", "description": "Base URL of the Anduril Lattice API (for example, https://lattice.example.com)", "multi": false, "required": true, "show_user": true }, { "name": "token", "type": "password", "title": "Lattice Bearer Token", "description": "Static bearer token for authentication. Used as Authorization: Bearer . Provide client_id and client_secret instead for OAuth2.", "multi": false, "required": false, "show_user": true }, { "name": "client_id", "type": "text", "title": "OAuth2 Client ID", "description": "OAuth2 client ID for automatic token management (30-minute tokens, auto-refreshed). Use instead of token for OAuth2.", "multi": false, "required": false, "show_user": true }, { "name": "client_secret", "type": "password", "title": "OAuth2 Client Secret", "description": "OAuth2 client secret for automatic token management.", "multi": false, "required": false, "show_user": true }, { "name": "sandbox_token", "type": "password", "title": "Sandbox Authorization Token", "description": "Token for Anduril sandbox environments. Sent as Anduril-Sandbox-Authorization: Bearer . Leave empty for production.", "multi": false, "required": false, "show_user": true } ], "title": "Collect entity events via REST API", "description": "Collect entity events from the Anduril Lattice long-poll API" } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "anduril_lattice.entity", "title": "Entity", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to poll the Lattice API for new entity events. Short intervals reduce latency; the API supports continuous long-polling. Supports duration strings such as 1s, 5s, 30s, 1m, 5m.", "multi": false, "required": true, "show_user": true, "default": "5s" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Maximum number of entity events returned per poll request (1–2000). Set higher values for environments with dense entity activity.", "multi": false, "required": true, "show_user": false, "default": 100 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring the HTTP client connection timed out. Default is 30s. Increase for slow or high-latency Lattice environments.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL of an HTTP proxy to route Lattice API requests through, in the form http[s]://[user:pass@]host:port.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "TLS settings for connecting to the Lattice API — certificate_authorities, verification_mode, and so on. See Filebeat SSL docs for available options.", "multi": false, "required": false, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable Request Tracer", "description": "Log HTTP requests and responses to the agent's local file system for debugging. Enabling this traces compromises security; use only for debugging.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve Original Event", "description": "If enabled, the raw API response is preserved in the event.original field.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors to apply to events before they are sent to Elasticsearch. See Beats processors documentation for available options.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect entity events via Lattice long-poll API", "description": "Collect entity events from the Anduril Lattice long-poll API. Each poll returns entity lifecycle events (created, updated, deleted) for all live entities in the Lattice environment.", "enabled": true, "ingestion_method": "API" } ], "package": "anduril_lattice", "path": "entity" } ] }