{
  "name": "auth0",
  "title": "Auth0",
  "version": "1.26.1",
  "release": "ga",
  "description": "Collect logs from Auth0 with Elastic Agent.",
  "type": "integration",
  "download": "/epr/auth0/auth0-1.26.1.zip",
  "path": "/package/auth0/1.26.1",
  "icons": [
    {
      "src": "/img/auth0-logo.svg",
      "path": "/package/auth0/1.26.1/img/auth0-logo.svg",
      "title": "Auth0 logo",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.19.16 || ~9.3.5 || ^9.4.1"
    }
  },
  "owner": {
    "type": "elastic",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "security",
    "iam"
  ],
  "signature_path": "/epr/auth0/auth0-1.26.1.zip.sig",
  "format_version": "3.3.2",
  "readme": "/package/auth0/1.26.1/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/auth0-screenshot.png",
      "path": "/package/auth0/1.26.1/img/auth0-screenshot.png",
      "title": "Auth0 Dashboard",
      "size": "600x600",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/auth0/1.26.1/LICENSE.txt",
    "/package/auth0/1.26.1/changelog.yml",
    "/package/auth0/1.26.1/manifest.yml",
    "/package/auth0/1.26.1/validation.yml",
    "/package/auth0/1.26.1/docs/README.md",
    "/package/auth0/1.26.1/img/auth0-logo.svg",
    "/package/auth0/1.26.1/img/auth0-screenshot.png",
    "/package/auth0/1.26.1/kibana/tags.yml",
    "/package/auth0/1.26.1/data_stream/logs/manifest.yml",
    "/package/auth0/1.26.1/data_stream/logs/sample_event.json",
    "/package/auth0/1.26.1/kibana/dashboard/auth0-29fb7200-4062-11ec-b18d-ef6bf98b26bf.json",
    "/package/auth0/1.26.1/kibana/search/auth0-629b19e0-4061-11ec-b18d-ef6bf98b26bf.json",
    "/package/auth0/1.26.1/data_stream/logs/fields/agent.yml",
    "/package/auth0/1.26.1/data_stream/logs/fields/base-fields.yml",
    "/package/auth0/1.26.1/data_stream/logs/fields/fields.yml",
    "/package/auth0/1.26.1/data_stream/logs/agent/stream/cel.yml.hbs",
    "/package/auth0/1.26.1/data_stream/logs/agent/stream/http_endpoint.yml.hbs",
    "/package/auth0/1.26.1/data_stream/logs/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "auth0_events",
      "title": "Auth0 log stream events",
      "description": "Collect Auth0 log streams events.",
      "inputs": [
        {
          "type": "http_endpoint",
          "title": "Collect Auth0 log streams events via Webhooks",
          "description": "Collecting Auth0 log stream events via Webhooks."
        },
        {
          "type": "cel",
          "title": "Collect Auth0 log events via API requests",
          "description": "Collect Auth0 log events via API requests."
        }
      ],
      "multiple": true,
      "deployment_modes": {
        "default": {
          "enabled": true
        },
        "agentless": {
          "enabled": true,
          "release": "ga"
        }
      }
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "auth0.logs",
      "title": "Auth0 logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "http_endpoint",
          "vars": [
            {
              "name": "listen_address",
              "type": "text",
              "title": "Listen Address",
              "description": "Bind address for the listener. Use 0.0.0.0 to listen on all interfaces.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "localhost"
            },
            {
              "name": "listen_port",
              "type": "integer",
              "title": "Listen Port",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 8383
            },
            {
              "name": "url",
              "type": "text",
              "title": "Webhook Path",
              "description": "URL path where the webhook will accept requests. It must include a leading slash.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "/auth0/logs"
            },
            {
              "name": "secret_value",
              "type": "password",
              "title": "Authorization Token",
              "description": "A token that incoming requests must include in an Authorization header.",
              "multi": false,
              "required": false,
              "show_user": true
            },
            {
              "name": "ssl",
              "type": "yaml",
              "title": "SSL Configuration",
              "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "enabled: false\ncertificate: \"/etc/pki/client/cert.pem\"\nkey: \"/etc/pki/client/cert.key\"\n"
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "forwarded",
                "auth0-logstream"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "http_endpoint.yml.hbs",
          "title": "Auth0 log events via Webhooks",
          "description": "Receives log events from Auth0 via Webhooks",
          "enabled": false,
          "ingestion_method": "Webhook"
        },
        {
          "input": "cel",
          "vars": [
            {
              "name": "url",
              "type": "text",
              "title": "URL",
              "description": "Base URL of the Auth0 API.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "https://tenant.us.auth0.com"
            },
            {
              "name": "client_id",
              "type": "text",
              "title": "Client ID",
              "description": "Client ID for the Auth0 API.",
              "multi": false,
              "required": true,
              "show_user": true
            },
            {
              "name": "client_secret",
              "type": "password",
              "title": "Client Secret",
              "description": "Client Secret for the Auth0 API.",
              "multi": false,
              "required": true,
              "show_user": true
            },
            {
              "name": "initial_interval",
              "type": "text",
              "title": "Initial Interval",
              "description": "How far back to pull logs from the Auth0 API. Supported units for this parameter are h/m/s.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "24h"
            },
            {
              "name": "interval",
              "type": "text",
              "title": "Interval",
              "description": "Duration between requests to the Auth0 API. Supported units for this parameter are h/m/s.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "5m"
            },
            {
              "name": "batch_size",
              "type": "integer",
              "title": "Batch Size",
              "description": "Batch size for the response of the Auth0 API.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": 100
            },
            {
              "name": "http_client_timeout",
              "type": "text",
              "title": "HTTP Client Timeout",
              "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "30s"
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "forwarded",
                "auth0-logstream"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "cel.yml.hbs",
          "title": "Auth0 log events via API requests",
          "description": "Collects log events from Auth0 via API requests.",
          "enabled": false,
          "ingestion_method": "API"
        }
      ],
      "package": "auth0",
      "path": "logs"
    }
  ]
}