{
  "name": "arista_ngfw",
  "title": "Arista NG Firewall",
  "version": "1.3.0",
  "release": "ga",
  "source": {
    "license": "Elastic-2.0"
  },
  "description": "Collect logs and metrics from Arista NG Firewall.",
  "type": "integration",
  "download": "/epr/arista_ngfw/arista_ngfw-1.3.0.zip",
  "path": "/package/arista_ngfw/1.3.0",
  "icons": [
    {
      "src": "/img/arista-logo.svg",
      "path": "/package/arista_ngfw/1.3.0/img/arista-logo.svg",
      "title": "Arista logo",
      "size": "400x76",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.11.0"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "community",
    "github": "elastic/sec-deployment-and-devices"
  },
  "categories": [
    "network"
  ],
  "signature_path": "/epr/arista_ngfw/arista_ngfw-1.3.0.zip.sig",
  "format_version": "3.0.3",
  "readme": "/package/arista_ngfw/1.3.0/docs/README.md",
  "license": "basic",
  "assets": [
    "/package/arista_ngfw/1.3.0/LICENSE.txt",
    "/package/arista_ngfw/1.3.0/changelog.yml",
    "/package/arista_ngfw/1.3.0/manifest.yml",
    "/package/arista_ngfw/1.3.0/validation.yml",
    "/package/arista_ngfw/1.3.0/docs/README.md",
    "/package/arista_ngfw/1.3.0/img/arista-logo.svg",
    "/package/arista_ngfw/1.3.0/img/screenshot_add_integration.png",
    "/package/arista_ngfw/1.3.0/img/screenshot_package.png",
    "/package/arista_ngfw/1.3.0/kibana/tags.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/manifest.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/sample_event.json",
    "/package/arista_ngfw/1.3.0/kibana/dashboard/arista_ngfw-090e6d40-1dc4-11ee-b346-5b9e0073e798.json",
    "/package/arista_ngfw/1.3.0/kibana/dashboard/arista_ngfw-0f3dafe6-c66a-4d1e-a9e9-fa3fb418bfaf.json",
    "/package/arista_ngfw/1.3.0/kibana/dashboard/arista_ngfw-2b026f60-1cf1-11ee-b346-5b9e0073e798.json",
    "/package/arista_ngfw/1.3.0/kibana/dashboard/arista_ngfw-3565dc44-1886-49aa-b8d3-523623e605dc.json",
    "/package/arista_ngfw/1.3.0/kibana/dashboard/arista_ngfw-86b139ff-92ab-4aae-b0d8-c33e3be132f1.json",
    "/package/arista_ngfw/1.3.0/kibana/dashboard/arista_ngfw-93596b63-d808-4a2f-9cbf-d0e9c4003079.json",
    "/package/arista_ngfw/1.3.0/kibana/dashboard/arista_ngfw-a4bb8521-b9d4-4d33-be52-b4ccefb2eee1.json",
    "/package/arista_ngfw/1.3.0/kibana/dashboard/arista_ngfw-c61b1eb0-1cf7-11ee-b346-5b9e0073e798.json",
    "/package/arista_ngfw/1.3.0/kibana/search/arista_ngfw-6cf3b505-142c-436a-9625-97800660e36f.json",
    "/package/arista_ngfw/1.3.0/kibana/search/arista_ngfw-746674eb-991f-47d4-a42b-b7b205db4b9b.json",
    "/package/arista_ngfw/1.3.0/kibana/search/arista_ngfw-78edcde0-20ee-11ee-8ab3-fb5b73d7bd73.json",
    "/package/arista_ngfw/1.3.0/kibana/search/arista_ngfw-b0ac29e8-0a25-4f59-a59d-10065bb70af3.json",
    "/package/arista_ngfw/1.3.0/kibana/search/arista_ngfw-b0ca4590-1cf7-11ee-b346-5b9e0073e798.json",
    "/package/arista_ngfw/1.3.0/kibana/search/arista_ngfw-da69ba6a-8008-4b1c-9fa9-fde67de3d129.json",
    "/package/arista_ngfw/1.3.0/kibana/visualization/arista_ngfw-ffee4a67-2bf6-4c3a-881a-026232d2e8c3.json",
    "/package/arista_ngfw/1.3.0/data_stream/log/fields/agent.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/fields/base-fields.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/fields/ecs.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/fields/fields.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/agent/stream/tcp.yml.hbs",
    "/package/arista_ngfw/1.3.0/data_stream/log/agent/stream/udp.yml.hbs",
    "/package/arista_ngfw/1.3.0/data_stream/log/elasticsearch/ingest_pipeline/admin_login.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/elasticsearch/ingest_pipeline/default.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/elasticsearch/ingest_pipeline/http_event.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/elasticsearch/ingest_pipeline/interface_stats.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/elasticsearch/ingest_pipeline/intrusion_prevention.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/elasticsearch/ingest_pipeline/session_stats.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/elasticsearch/ingest_pipeline/system_stats.yml",
    "/package/arista_ngfw/1.3.0/data_stream/log/elasticsearch/ingest_pipeline/web_filter.yml"
  ],
  "policy_templates": [
    {
      "name": "log",
      "title": "Arista NG Firewall logs",
      "description": "Collect logs from Arista NG Firewall instances",
      "inputs": [
        {
          "type": "tcp",
          "title": "Collect logs from Arista NG Firewall via TCP",
          "description": "Collects logs from Arista NG Firewall via TCP"
        },
        {
          "type": "udp",
          "title": "Collect logs from Arista NG Firewall via UDP",
          "description": "Collects logs from Arista NG Firewall via UDP"
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "arista_ngfw.log",
      "title": "Firewall Event",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "tcp",
          "vars": [
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "arista-ngfw",
                "forwarded"
              ]
            },
            {
              "name": "tcp_host",
              "type": "text",
              "title": "TCP host to listen on",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "localhost"
            },
            {
              "name": "tcp_port",
              "type": "integer",
              "title": "TCP Port to listen on",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 9010
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "tz_offset",
              "type": "text",
              "title": "Timezone",
              "description": "IANA time zone or time offset (e.g. `America/Denver` or `-06:00`) to use when interpreting syslog timestamps without a time zone.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "UTC"
            },
            {
              "name": "interface_id_1_name",
              "type": "text",
              "title": "Device name for interface ID 1",
              "description": "Optional device name of the firewall's interface with ID 1 (e.g. `eth0`).",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "interface_id_1_alias",
              "type": "text",
              "title": "Alias for interface ID 1",
              "description": "Optional alias of the firewall's interface with ID 1 (e.g. `External` or `WAN`).",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "interface_id_2_name",
              "type": "text",
              "title": "Device name for interface ID 2",
              "description": "Optional device name of the firewall's interface with ID 2 (e.g. `eth1`).",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "interface_id_2_alias",
              "type": "text",
              "title": "Alias for interface ID 2",
              "description": "Optional alias of the firewall's interface with ID 2 (e.g. `Internal` or `LAN`).",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "tcp.yml.hbs",
          "title": "Arista NG Firewall logs",
          "description": "Collect Arista NG Firewall logs via TCP",
          "enabled": true,
          "ingestion_method": "Network Protocol"
        },
        {
          "input": "udp",
          "vars": [
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "arista-ngfw",
                "forwarded"
              ]
            },
            {
              "name": "udp_host",
              "type": "text",
              "title": "UDP host to listen on",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "localhost"
            },
            {
              "name": "udp_port",
              "type": "integer",
              "title": "UDP Port to listen on",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 9010
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "tz_offset",
              "type": "text",
              "title": "Timezone",
              "description": "IANA time zone or time offset (e.g. `America/Denver` or `-06:00`) to use when interpreting syslog timestamps without a time zone.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "UTC"
            },
            {
              "name": "interface_id_1_name",
              "type": "text",
              "title": "Device name for interface ID 1",
              "description": "Optional device name of the firewall's interface with ID 1 (e.g. `eth0`).",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "interface_id_1_alias",
              "type": "text",
              "title": "Alias for interface ID 1",
              "description": "Optional alias of the firewall's interface with ID 1 (e.g. `External` or `WAN`).",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "interface_id_2_name",
              "type": "text",
              "title": "Device name for interface ID 2",
              "description": "Optional device name of the firewall's interface with ID 2 (e.g. `eth1`).",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "interface_id_2_alias",
              "type": "text",
              "title": "Alias for interface ID 2",
              "description": "Optional alias of the firewall's interface with ID 2 (e.g. `Internal` or `LAN`).",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "udp.yml.hbs",
          "title": "Arista NG Firewall logs",
          "description": "Collect Arista NG Firewall logs via UDP",
          "enabled": true,
          "ingestion_method": "Network Protocol"
        }
      ],
      "package": "arista_ngfw",
      "path": "log"
    }
  ]
}