{
  "name": "bitsight",
  "title": "Bitsight",
  "version": "0.5.0",
  "release": "beta",
  "source": {
    "license": "Elastic-2.0"
  },
  "description": "Ingest data from the Bitsight API.",
  "type": "integration",
  "download": "/epr/bitsight/bitsight-0.5.0.zip",
  "path": "/package/bitsight/0.5.0",
  "icons": [
    {
      "src": "/img/bitsight.svg",
      "path": "/package/bitsight/0.5.0/img/bitsight.svg",
      "title": "Bitsight Logo",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.19.2 || ^9.0.5"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "partner",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "custom",
    "security"
  ],
  "signature_path": "/epr/bitsight/bitsight-0.5.0.zip.sig",
  "format_version": "3.3.2",
  "readme": "/package/bitsight/0.5.0/docs/README.md",
  "license": "basic",
  "assets": [
    "/package/bitsight/0.5.0/LICENSE.txt",
    "/package/bitsight/0.5.0/changelog.yml",
    "/package/bitsight/0.5.0/manifest.yml",
    "/package/bitsight/0.5.0/docs/README.md",
    "/package/bitsight/0.5.0/img/bitsight.svg",
    "/package/bitsight/0.5.0/data_stream/vulnerability/manifest.yml",
    "/package/bitsight/0.5.0/data_stream/vulnerability/sample_event.json",
    "/package/bitsight/0.5.0/data_stream/vulnerability/fields/base-fields.yml",
    "/package/bitsight/0.5.0/data_stream/vulnerability/fields/beats.yml",
    "/package/bitsight/0.5.0/data_stream/vulnerability/fields/fields.yml",
    "/package/bitsight/0.5.0/data_stream/vulnerability/agent/stream/cel.yml.hbs",
    "/package/bitsight/0.5.0/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "bitsight",
      "title": "Bitsight",
      "description": "Collect data from Bitsight API",
      "inputs": [
        {
          "type": "cel",
          "vars": [
            {
              "name": "url",
              "type": "text",
              "title": "Bitsight API Base URL",
              "description": "Base URL for the Bitsight API (include https://)",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "https://api.bitsighttech.com"
            },
            {
              "name": "token",
              "type": "password",
              "title": "Bitsight API Token",
              "description": "Bitsight API token to authenticate with Basic auth (username as token, empty password)",
              "multi": false,
              "required": true,
              "show_user": false
            },
            {
              "name": "proxy_url",
              "type": "text",
              "title": "Proxy URL",
              "description": "URL to proxy connections (http[s]://<user>:<password>@<server>:<port>).",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "ssl",
              "type": "yaml",
              "title": "SSL Configuration",
              "description": "SSL configuration options. See documentation for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#verification_mode: none\n#certificate_authorities:\n#  - |-\n#    -----BEGIN CERTIFICATE-----\n#    ...\n#    -----END CERTIFICATE-----\n"
            }
          ],
          "title": "Bitsight",
          "description": "Collect data from Bitsight API"
        }
      ],
      "multiple": true,
      "deployment_modes": {
        "default": {
          "enabled": true
        },
        "agentless": {
          "enabled": true,
          "release": "ga"
        }
      }
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "bitsight.vulnerability",
      "title": "Bitsight Vulnerability",
      "release": "beta",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "cel",
          "vars": [
            {
              "name": "batch_size",
              "type": "integer",
              "title": "Batch Size",
              "description": "Number of records retrieved per request.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 100
            },
            {
              "name": "interval",
              "type": "text",
              "title": "Poll Interval",
              "description": "Defines how often data is collected from the Bitsight API.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "5m"
            },
            {
              "name": "initial_interval",
              "type": "text",
              "title": "Initial Lookback Interval",
              "description": "Defines how far back the first query should go when no cursor is set. Allowed time units are \"s\", \"m\", \"h\".",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "720h"
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "description": "Tags to apply to each event.",
              "multi": true,
              "required": false,
              "show_user": false,
              "default": [
                "forwarded",
                "bitsight-vulnerability"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the evidence payload in `event.original`.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": false
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.  This executes in the agent before the data is parsed. See  [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "# - drop:\n#     when:\n#       equals:\n#         evidence.identifier: some-value\n"
            }
          ],
          "template_path": "cel.yml.hbs",
          "title": "Bitsight Vulnerability",
          "description": "Collect vulnerability data from Bitsight Threats API",
          "enabled": true,
          "ingestion_method": "API"
        }
      ],
      "package": "bitsight",
      "path": "vulnerability"
    }
  ]
}