{ "name": "carbon_black_cloud", "title": "VMware Carbon Black Cloud", "version": "2.10.0", "release": "ga", "description": "Collect logs from VMWare Carbon Black Cloud with Elastic Agent.", "type": "integration", "download": "/epr/carbon_black_cloud/carbon_black_cloud-2.10.0.zip", "path": "/package/carbon_black_cloud/2.10.0", "icons": [ { "src": "/img/carbon_black_cloud-logo.svg", "path": "/package/carbon_black_cloud/2.10.0/img/carbon_black_cloud-logo.svg", "title": "Carbon Black Cloud logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.16.5" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "edr_xdr" ], "signature_path": "/epr/carbon_black_cloud/carbon_black_cloud-2.10.0.zip.sig", "format_version": "3.0.2", "readme": "/package/carbon_black_cloud/2.10.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/carbon_black_cloud-screenshot.png", "path": "/package/carbon_black_cloud/2.10.0/img/carbon_black_cloud-screenshot.png", "title": "Carbon Black Cloud alert dashboard screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/carbon_black_cloud/2.10.0/LICENSE.txt", "/package/carbon_black_cloud/2.10.0/changelog.yml", "/package/carbon_black_cloud/2.10.0/manifest.yml", "/package/carbon_black_cloud/2.10.0/validation.yml", "/package/carbon_black_cloud/2.10.0/docs/README.md", "/package/carbon_black_cloud/2.10.0/img/carbon_black_cloud-logo.svg", "/package/carbon_black_cloud/2.10.0/img/carbon_black_cloud-screenshot.png", "/package/carbon_black_cloud/2.10.0/kibana/tags.yml", "/package/carbon_black_cloud/2.10.0/data_stream/alert/manifest.yml", "/package/carbon_black_cloud/2.10.0/data_stream/alert/sample_event.json", "/package/carbon_black_cloud/2.10.0/data_stream/alert_v7/manifest.yml", "/package/carbon_black_cloud/2.10.0/data_stream/alert_v7/sample_event.json", "/package/carbon_black_cloud/2.10.0/data_stream/asset_vulnerability_summary/manifest.yml", "/package/carbon_black_cloud/2.10.0/data_stream/asset_vulnerability_summary/sample_event.json", "/package/carbon_black_cloud/2.10.0/data_stream/audit/manifest.yml", "/package/carbon_black_cloud/2.10.0/data_stream/audit/sample_event.json", "/package/carbon_black_cloud/2.10.0/data_stream/endpoint_event/manifest.yml", "/package/carbon_black_cloud/2.10.0/data_stream/endpoint_event/sample_event.json", "/package/carbon_black_cloud/2.10.0/data_stream/watchlist_hit/manifest.yml", "/package/carbon_black_cloud/2.10.0/data_stream/watchlist_hit/sample_event.json", "/package/carbon_black_cloud/2.10.0/kibana/dashboard/carbon_black_cloud-06a8d7f0-3b04-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/kibana/dashboard/carbon_black_cloud-0954fb80-3a5c-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/kibana/dashboard/carbon_black_cloud-0954fb80-3a6c-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/kibana/dashboard/carbon_black_cloud-44209d90-3a7b-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/kibana/dashboard/carbon_black_cloud-4d08ffd0-3b19-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/kibana/dashboard/carbon_black_cloud-a1f898e0-3a72-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/kibana/search/carbon_black_cloud-4ab86f30-3b10-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/kibana/search/carbon_black_cloud-9a5bb310-3a7c-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/kibana/search/carbon_black_cloud-b23c6730-3a6b-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/kibana/search/carbon_black_cloud-b23c6730-3a6e-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/kibana/search/carbon_black_cloud-d6f70aa0-3b20-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/kibana/search/carbon_black_cloud-e16671a0-3a77-11ed-a8e8-41eb8778c6de.json", "/package/carbon_black_cloud/2.10.0/data_stream/alert/fields/agent.yml", "/package/carbon_black_cloud/2.10.0/data_stream/alert/fields/base-fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/alert/fields/fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/alert_v7/fields/agent.yml", "/package/carbon_black_cloud/2.10.0/data_stream/alert_v7/fields/base-fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/alert_v7/fields/fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/asset_vulnerability_summary/fields/agent.yml", "/package/carbon_black_cloud/2.10.0/data_stream/asset_vulnerability_summary/fields/base-fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/asset_vulnerability_summary/fields/fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/audit/fields/agent.yml", "/package/carbon_black_cloud/2.10.0/data_stream/audit/fields/base-fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/audit/fields/fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/endpoint_event/fields/agent.yml", "/package/carbon_black_cloud/2.10.0/data_stream/endpoint_event/fields/base-fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/endpoint_event/fields/fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/watchlist_hit/fields/agent.yml", "/package/carbon_black_cloud/2.10.0/data_stream/watchlist_hit/fields/base-fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/watchlist_hit/fields/fields.yml", "/package/carbon_black_cloud/2.10.0/data_stream/alert/agent/stream/aws-s3.yml.hbs", "/package/carbon_black_cloud/2.10.0/data_stream/alert/agent/stream/httpjson.yml.hbs", "/package/carbon_black_cloud/2.10.0/data_stream/alert/elasticsearch/ingest_pipeline/default.yml", "/package/carbon_black_cloud/2.10.0/data_stream/alert_v7/agent/stream/aws-s3.yml.hbs", "/package/carbon_black_cloud/2.10.0/data_stream/alert_v7/agent/stream/cel.yml.hbs", "/package/carbon_black_cloud/2.10.0/data_stream/alert_v7/elasticsearch/ingest_pipeline/default.yml", "/package/carbon_black_cloud/2.10.0/data_stream/asset_vulnerability_summary/agent/stream/cel.yml.hbs", "/package/carbon_black_cloud/2.10.0/data_stream/asset_vulnerability_summary/agent/stream/httpjson.yml.hbs", "/package/carbon_black_cloud/2.10.0/data_stream/asset_vulnerability_summary/elasticsearch/ingest_pipeline/default.yml", "/package/carbon_black_cloud/2.10.0/data_stream/audit/agent/stream/cel.yml.hbs", "/package/carbon_black_cloud/2.10.0/data_stream/audit/agent/stream/httpjson.yml.hbs", "/package/carbon_black_cloud/2.10.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml", "/package/carbon_black_cloud/2.10.0/data_stream/endpoint_event/agent/stream/aws-s3.yml.hbs", "/package/carbon_black_cloud/2.10.0/data_stream/endpoint_event/elasticsearch/ingest_pipeline/default.yml", "/package/carbon_black_cloud/2.10.0/data_stream/watchlist_hit/agent/stream/aws-s3.yml.hbs", "/package/carbon_black_cloud/2.10.0/data_stream/watchlist_hit/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "carbon_black_cloud", "title": "Carbon Black Cloud", "description": "Collect Logs from Carbon Black Cloud.", "inputs": [ { "type": "httpjson", "vars": [ { "name": "hostname", "type": "text", "title": "Hostname", "description": "Carbon Black Cloud console Hostname. Find hostname in the console dashboard at the beginning of the web address (Add https:// before the hostname).", "multi": false, "required": true, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false }, { "name": "org_key", "type": "text", "title": "Organization Key", "description": "Organization Key.", "multi": false, "required": true, "show_user": false }, { "name": "custom_api_id", "type": "text", "title": "Custom API ID", "description": "API ID with Custom Access Level type.", "multi": false, "required": true, "show_user": false }, { "name": "custom_api_secret_key", "type": "password", "title": "Custom API Secret Key", "description": "API Secret Key with Custom Access Level type.", "multi": false, "required": true, "show_user": false }, { "name": "api_id", "type": "text", "title": "API ID", "description": "API ID with API Access Level type.", "multi": false, "required": true, "show_user": false }, { "name": "api_secret_key", "type": "password", "title": "API Secret Key", "description": "API Secret Key with API Access Level type.", "multi": false, "required": true, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Carbon Black Cloud logs via API using HTTPJSON [Legacy]", "description": "Collect Carbon Black Cloud logs via API using HTTPJSON." }, { "type": "cel", "vars": [ { "name": "hostname", "type": "text", "title": "Hostname", "description": "Carbon Black Cloud console Hostname. Find hostname in the console dashboard at the beginning of the web address (Add https:// before the hostname).", "multi": false, "required": true, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "org_key", "type": "text", "title": "Organization Key", "description": "Organization Key.", "multi": false, "required": true, "show_user": false }, { "name": "custom_api_id", "type": "text", "title": "Custom API ID", "description": "API ID with Custom Access Level type.", "multi": false, "required": true, "show_user": false }, { "name": "custom_api_secret_key", "type": "password", "title": "Custom API Secret Key", "description": "API Secret Key with Custom Access Level type.", "multi": false, "required": true, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Carbon Black Cloud logs via API using CEL [Beta]", "description": "Collect Carbon Black Cloud logs via API using CEL." }, { "type": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "ARN of the AWS S3 bucket that will be polled for list operation. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "ARN of the AWS S3 Access Point that will be polled for list operation. Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "access_key_id", "type": "password", "title": "Access Key ID", "description": "First part of access key.", "multi": false, "required": false, "show_user": true }, { "name": "secret_access_key", "type": "password", "title": "Secret Access Key", "description": "Second part of access key.", "multi": false, "required": false, "show_user": true }, { "name": "session_token", "type": "password", "title": "Session Token", "description": "Required when using temporary security credentials.", "multi": false, "required": false, "show_user": true }, { "name": "shared_credential_file", "type": "text", "title": "Shared Credential File", "description": "Directory of the shared credentials file.", "multi": false, "required": false, "show_user": false }, { "name": "credential_profile_name", "type": "text", "title": "Credential Profile Name", "description": "Profile name in shared credentials file.", "multi": false, "required": false, "show_user": false }, { "name": "role_arn", "type": "text", "title": "Role ARN", "description": "AWS IAM Role to assume.", "multi": false, "required": false, "show_user": false }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service.", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false } ], "title": "Collect Carbon Black Cloud logs via AWS S3 or AWS SQS", "description": "Collect Carbon Black Cloud logs via AWS S3 or AWS SQS." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "carbon_black_cloud.alert", "title": "Alert", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval to fetch alerts from Carbon Black Cloud. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the alerts from the Carbon Black Cloud API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": true, "default": "2m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "carbon_black_cloud-alert" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Collect alerts from Carbon Black Cloud", "description": "Collect alerts from Carbon Black Cloud.", "enabled": true, "ingestion_method": "API" }, { "input": "aws-s3", "vars": [ { "name": "queue_url_alert", "type": "text", "title": "[SQS] Queue URL", "description": "URL of the AWS SQS queue that messages will be received from. This is only required if you want to collect logs via AWS SQS.\nThis is an alert data stream specific queue URL. In order to avoid data loss, do not configure the same SQS queue for more than one data stream.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true, "default": "alert_logs" }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. \nThis is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. \nIf file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. \nRegexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.\n[NOTE]: It is recommended to use data stream specific SQS queues instead of file_selectors to avoid data loss.", "multi": false, "required": false, "show_user": false, "default": "# - regex: \"alert_logs/\"\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "carbon_black_cloud-alert" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Collect alerts from Carbon Black Cloud", "description": "Collect alerts from Carbon Black Cloud.", "enabled": true, "ingestion_method": "AWS S3" } ], "package": "carbon_black_cloud", "path": "alert" }, { "type": "logs", "dataset": "carbon_black_cloud.alert_v7", "title": "Alert V7", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval to fetch alerts from Carbon Black Cloud. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the alerts from the Carbon Black Cloud API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": true, "default": "2m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "carbon_black_cloud-alert" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect alerts from Carbon Black Cloud using v7 API", "description": "Collect alerts from Carbon Black Cloud.", "enabled": true, "ingestion_method": "API" }, { "input": "aws-s3", "vars": [ { "name": "queue_url_alert", "type": "text", "title": "[SQS] Queue URL", "description": "URL of the AWS SQS queue that messages will be received from. This is only required if you want to collect logs via AWS SQS.\nThis is an alert data stream specific queue URL. In order to avoid data loss, do not configure the same SQS queue for more than one data stream.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true, "default": "alert_logs_v7" }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. \nThis is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. \nIf file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. \nRegexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.\n[NOTE]: It is recommended to use data stream specific SQS queues instead of file_selectors to avoid data loss.", "multi": false, "required": false, "show_user": false, "default": "# - regex: \"alert_logs/\"\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "carbon_black_cloud-alert" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Collect alerts from Carbon Black Cloud - Data Forwarder 2.0 Schema [Beta]", "description": "Collect alerts from Carbon Black Cloud.", "enabled": true, "ingestion_method": "AWS S3" } ], "package": "carbon_black_cloud", "path": "alert_v7" }, { "type": "logs", "dataset": "carbon_black_cloud.asset_vulnerability_summary", "title": "Asset Vulnerability Summary", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval to query asset vulnerability summary in Carbon Black Cloud. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": true, "default": "2m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "carbon_black_cloud-asset_vulnerability_summary" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Collect asset vulnerability summary from Carbon Black Cloud", "description": "Collect asset vulnerability summary from Carbon Black Cloud.", "enabled": true, "ingestion_method": "API" }, { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval to query asset vulnerability summary in Carbon Black Cloud. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": true, "default": "2m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "carbon_black_cloud-asset_vulnerability_summary" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect asset vulnerability summary from Carbon Black Cloud", "description": "Collect asset vulnerability summary from Carbon Black Cloud.", "enabled": true, "ingestion_method": "API" } ], "package": "carbon_black_cloud", "path": "asset_vulnerability_summary" }, { "type": "logs", "dataset": "carbon_black_cloud.audit", "title": "Audit", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval to fetch audit logs from Carbon Black Cloud. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "carbon_black_cloud-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Collect audit logs from Carbon Black Cloud", "description": "Collect audit logs from Carbon Black Cloud.", "enabled": true, "ingestion_method": "API" }, { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval to fetch audit logs from Carbon Black Cloud. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "carbon_black_cloud-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect audit logs from Carbon Black Cloud", "description": "Collect audit logs from Carbon Black Cloud.", "enabled": true, "ingestion_method": "API" } ], "package": "carbon_black_cloud", "path": "audit" }, { "type": "logs", "dataset": "carbon_black_cloud.endpoint_event", "title": "Endpoint Event", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "queue_url_endpoint_event", "type": "text", "title": "[SQS] Queue URL", "description": "URL of the AWS SQS queue that messages will be received from. This is only required if you want to collect logs via AWS SQS.\nThis is an endpoint event data stream specific queue URL. In order to avoid data loss, do not configure the same SQS queue for more than one data stream.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true, "default": "endpoint_event_logs" }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. \nThis is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. \nIf file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. \nRegexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.\n[NOTE]: It is recommended to use data stream specific SQS queues instead of file_selectors to avoid data loss.", "multi": false, "required": false, "show_user": false, "default": "# - regex: \"endpoint_event_logs/\"\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "carbon_black_cloud-endpoint_event" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Collect endpoint events from Carbon Black Cloud", "description": "Collect endpoint events from Carbon Black Cloud.", "enabled": true, "ingestion_method": "AWS S3" } ], "package": "carbon_black_cloud", "path": "endpoint_event" }, { "type": "logs", "dataset": "carbon_black_cloud.watchlist_hit", "title": "Watchlist Hit", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "aws-s3", "vars": [ { "name": "queue_url_watchlist_hit", "type": "text", "title": "[SQS] Queue URL", "description": "URL of the AWS SQS queue that messages will be received from. This is only required if you want to collect logs via AWS SQS.\nThis is a watchlist hit data stream specific queue URL. In order to avoid data loss, do not configure the same SQS queue for more than one data stream.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true, "default": "watchlist_hit_logs" }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "The maximum number of SQS messages that can be inflight at any time.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. \nThis is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. \nIf file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. \nRegexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.\n[NOTE]: It is recommended to use data stream specific SQS queues instead of file_selectors to avoid data loss.", "multi": false, "required": false, "show_user": false, "default": "# - regex: \"watchlist_hit_logs/\"\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "carbon_black_cloud-watchlist_hit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Collect watchlist hit from Carbon Black Cloud", "description": "Collect watchlist hit from Carbon Black Cloud.", "enabled": true, "ingestion_method": "AWS S3" } ], "package": "carbon_black_cloud", "path": "watchlist_hit" } ] }