{ "name": "blacklens", "title": "blacklens.io", "version": "1.0.1", "release": "ga", "source": { "license": "Elastic-2.0" }, "description": "Collect logs from blacklens.io with Elastic Agent", "type": "integration", "download": "/epr/blacklens/blacklens-1.0.1.zip", "path": "/package/blacklens/1.0.1", "icons": [ { "src": "/img/blacklens-logo.svg", "path": "/package/blacklens/1.0.1/img/blacklens-logo.svg", "title": "blacklens.io Logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.4 || ~9.0.7 || ^9.1.4" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "community", "github": "elastic/security-service-integrations" }, "categories": [ "security", "vulnerability_management" ], "signature_path": "/epr/blacklens/blacklens-1.0.1.zip.sig", "format_version": "3.3.0", "readme": "/package/blacklens/1.0.1/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/blacklens-dashboard-alerts.png", "path": "/package/blacklens/1.0.1/img/blacklens-dashboard-alerts.png", "title": "blacklens.io Alerts Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/blacklens/1.0.1/LICENSE.txt", "/package/blacklens/1.0.1/changelog.yml", "/package/blacklens/1.0.1/manifest.yml", "/package/blacklens/1.0.1/docs/README.md", "/package/blacklens/1.0.1/img/blacklens-dashboard-alerts.png", "/package/blacklens/1.0.1/img/blacklens-logo.svg", "/package/blacklens/1.0.1/data_stream/alerts/manifest.yml", "/package/blacklens/1.0.1/data_stream/alerts/sample_event.json", "/package/blacklens/1.0.1/kibana/dashboard/blacklens-e718fd52-f1b3-400f-94c1-ead17da571f6.json", "/package/blacklens/1.0.1/kibana/tag/blacklens-f91e5a40-16bf-46d8-a366-e0f9a5ddb6a4.json", "/package/blacklens/1.0.1/data_stream/alerts/fields/base-fields.yml", "/package/blacklens/1.0.1/data_stream/alerts/fields/beats.yml", "/package/blacklens/1.0.1/data_stream/alerts/fields/ecs.yml", "/package/blacklens/1.0.1/data_stream/alerts/fields/fields.yml", "/package/blacklens/1.0.1/data_stream/alerts/agent/stream/httpjson.yml.hbs", "/package/blacklens/1.0.1/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "blacklens", "title": "blacklens.io logs", "description": "Collect blacklens.io logs", "inputs": [ { "type": "httpjson", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the blacklens.io API.", "multi": false, "required": true, "show_user": true }, { "name": "tenant_id", "type": "text", "title": "Tenant ID", "description": "Tenant ID of blacklens.io.", "multi": false, "required": true, "show_user": true }, { "name": "ws_id", "type": "text", "title": "Workspace ID", "description": "Workspace ID of blacklens.io.", "multi": false, "required": true, "show_user": true }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "api_key", "type": "password", "title": "API Key", "description": "API Key", "multi": false, "required": true, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect blacklens.io logs via API", "description": "Collecting blacklens.io via API." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "blacklens.alerts", "title": "Collect blacklens.io Alerts", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between HTTP requests to the blacklens.io. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the events from blacklens.io. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP client timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "blacklens-alert" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Alerts", "description": "Collect blacklens.io Alerts via API.", "enabled": true, "ingestion_method": "API" } ], "package": "blacklens", "path": "alerts" } ] }