{ "name": "claroty_ctd", "title": "Claroty CTD", "version": "0.7.0", "release": "beta", "description": "Collect logs from Claroty CTD using Elastic Agent.", "type": "integration", "download": "/epr/claroty_ctd/claroty_ctd-0.7.0.zip", "path": "/package/claroty_ctd/0.7.0", "icons": [ { "src": "/img/claroty-ctd-logo.svg", "path": "/package/claroty_ctd/0.7.0/img/claroty-ctd-logo.svg", "title": "Claroty CTD logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.13.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/claroty_ctd/claroty_ctd-0.7.0.zip.sig", "format_version": "3.1.4", "readme": "/package/claroty_ctd/0.7.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/claroty_ctd-activity_log.png", "path": "/package/claroty_ctd/0.7.0/img/claroty_ctd-activity_log.png", "title": "Activity Log Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/claroty_ctd-alert.png", "path": "/package/claroty_ctd/0.7.0/img/claroty_ctd-alert.png", "title": "Alerts Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/claroty_ctd-asset.png", "path": "/package/claroty_ctd/0.7.0/img/claroty_ctd-asset.png", "title": "Asset Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/claroty_ctd-baseline.png", "path": "/package/claroty_ctd/0.7.0/img/claroty_ctd-baseline.png", "title": "Baseline Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/claroty_ctd-event.png", "path": "/package/claroty_ctd/0.7.0/img/claroty_ctd-event.png", "title": "Events Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/claroty_ctd-health_check.png", "path": "/package/claroty_ctd/0.7.0/img/claroty_ctd-health_check.png", "title": "Health Check Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/claroty_ctd-insight.png", "path": "/package/claroty_ctd/0.7.0/img/claroty_ctd-insight.png", "title": "Insights Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/claroty_ctd-overview.png", "path": "/package/claroty_ctd/0.7.0/img/claroty_ctd-overview.png", "title": "Overview Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/claroty_ctd/0.7.0/LICENSE.txt", "/package/claroty_ctd/0.7.0/changelog.yml", "/package/claroty_ctd/0.7.0/manifest.yml", "/package/claroty_ctd/0.7.0/validation.yml", "/package/claroty_ctd/0.7.0/docs/README.md", "/package/claroty_ctd/0.7.0/img/claroty-ctd-logo.svg", "/package/claroty_ctd/0.7.0/img/claroty_ctd-activity_log.png", "/package/claroty_ctd/0.7.0/img/claroty_ctd-alert.png", "/package/claroty_ctd/0.7.0/img/claroty_ctd-asset.png", "/package/claroty_ctd/0.7.0/img/claroty_ctd-baseline.png", "/package/claroty_ctd/0.7.0/img/claroty_ctd-event.png", "/package/claroty_ctd/0.7.0/img/claroty_ctd-health_check.png", "/package/claroty_ctd/0.7.0/img/claroty_ctd-insight.png", "/package/claroty_ctd/0.7.0/img/claroty_ctd-overview.png", "/package/claroty_ctd/0.7.0/kibana/tags.yml", "/package/claroty_ctd/0.7.0/data_stream/asset/manifest.yml", "/package/claroty_ctd/0.7.0/data_stream/asset/sample_event.json", "/package/claroty_ctd/0.7.0/data_stream/baseline/manifest.yml", "/package/claroty_ctd/0.7.0/data_stream/baseline/sample_event.json", "/package/claroty_ctd/0.7.0/data_stream/event/manifest.yml", "/package/claroty_ctd/0.7.0/data_stream/event/sample_event.json", "/package/claroty_ctd/0.7.0/kibana/dashboard/claroty_ctd-0f0d9db1-dbf3-4d2f-b87c-c5d75e6ea62d.json", "/package/claroty_ctd/0.7.0/kibana/dashboard/claroty_ctd-1051aba6-db32-473c-a24d-3b9200f22f17.json", "/package/claroty_ctd/0.7.0/kibana/dashboard/claroty_ctd-3ff35f11-fb3c-40b1-bb47-a0d5345fc0c7.json", "/package/claroty_ctd/0.7.0/kibana/dashboard/claroty_ctd-66d8c2cc-eeb7-420e-8c83-9c0cae66a7fe.json", "/package/claroty_ctd/0.7.0/kibana/dashboard/claroty_ctd-a91b7c98-8dd4-479e-bc35-71641c85db97.json", "/package/claroty_ctd/0.7.0/kibana/dashboard/claroty_ctd-b7e0ad66-86c3-4b72-ae19-0576ed9fb1d6.json", "/package/claroty_ctd/0.7.0/kibana/dashboard/claroty_ctd-ce5edf6b-6671-4d1e-adc0-834a76ff9169.json", "/package/claroty_ctd/0.7.0/kibana/dashboard/claroty_ctd-e2106b06-3d16-4014-9343-f63ebb90a114.json", "/package/claroty_ctd/0.7.0/kibana/search/claroty_ctd-0cab445c-f2f9-4549-8224-2c66b114e973.json", "/package/claroty_ctd/0.7.0/kibana/search/claroty_ctd-4c469790-a269-4d9f-8616-816379cbc3ad.json", "/package/claroty_ctd/0.7.0/kibana/search/claroty_ctd-9334e7c2-86b7-4aa4-8b0e-26b52c58bfd0.json", "/package/claroty_ctd/0.7.0/kibana/search/claroty_ctd-afa635ef-ec61-44f6-8eb3-c61332a6f987.json", "/package/claroty_ctd/0.7.0/kibana/search/claroty_ctd-d7b4f221-71ef-4c93-b875-d03cd10a6743.json", "/package/claroty_ctd/0.7.0/kibana/tag/claroty_ctd-security-solution-default.json", "/package/claroty_ctd/0.7.0/data_stream/asset/fields/base-fields.yml", "/package/claroty_ctd/0.7.0/data_stream/asset/fields/beats.yml", "/package/claroty_ctd/0.7.0/data_stream/asset/fields/fields.yml", "/package/claroty_ctd/0.7.0/data_stream/baseline/fields/base-fields.yml", "/package/claroty_ctd/0.7.0/data_stream/baseline/fields/beats.yml", "/package/claroty_ctd/0.7.0/data_stream/baseline/fields/fields.yml", "/package/claroty_ctd/0.7.0/data_stream/event/fields/base-fields.yml", "/package/claroty_ctd/0.7.0/data_stream/event/fields/beats.yml", "/package/claroty_ctd/0.7.0/data_stream/event/fields/ecs.yml", "/package/claroty_ctd/0.7.0/data_stream/event/fields/fields.yml", "/package/claroty_ctd/0.7.0/data_stream/asset/agent/stream/cel.yml.hbs", "/package/claroty_ctd/0.7.0/data_stream/asset/elasticsearch/ingest_pipeline/default.yml", "/package/claroty_ctd/0.7.0/data_stream/baseline/agent/stream/cel.yml.hbs", "/package/claroty_ctd/0.7.0/data_stream/baseline/elasticsearch/ingest_pipeline/default.yml", "/package/claroty_ctd/0.7.0/data_stream/event/agent/stream/tcp.yml.hbs", "/package/claroty_ctd/0.7.0/data_stream/event/agent/stream/udp.yml.hbs", "/package/claroty_ctd/0.7.0/data_stream/event/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "claroty_ctd", "title": "claroty CTD logs", "description": "Collect sample logs", "inputs": [ { "type": "tcp", "title": "Collect Claroty CTD logs via TCP", "description": "Collecting logs from Claroty CTD via TCP input." }, { "type": "udp", "title": "Collect Claroty CTD logs via UDP", "description": "Collecting logs from Claroty CTD via UDP input." }, { "type": "cel", "vars": [ { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "proxy configuration in the form of https://:@:.", "multi": false, "required": false, "show_user": false }, { "name": "url", "type": "text", "title": "URL", "description": "URL of CTD instance of Claroty.", "multi": false, "required": true, "show_user": true }, { "name": "username", "type": "text", "title": "Username", "description": "Username for CTD instance of Claroty.", "multi": false, "required": true, "show_user": true }, { "name": "password", "type": "password", "title": "Password", "description": "Password for CTD instance of Claroty.", "multi": false, "required": true, "show_user": true }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Claroty CTD logs via API", "description": "Collecting logs from Claroty CTD via CEL input." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "claroty_ctd.asset", "title": "Asset logs", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Claroty CTD API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Claroty CTD API.", "multi": false, "required": true, "show_user": true, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "claroty_ctd-asset" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field event.original.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Claroty CTD fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Asset logs", "description": "Collect Asset logs from Claroty CTD.", "enabled": false, "ingestion_method": "API" } ], "package": "claroty_ctd", "path": "asset" }, { "type": "logs", "dataset": "claroty_ctd.baseline", "title": "Baseline logs", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Claroty CTD API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Claroty CTD API.", "multi": false, "required": true, "show_user": true, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "claroty_ctd-baseline" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field event.original.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Claroty CTD fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Baseline logs", "description": "Collect Baseline logs from Claroty CTD.", "enabled": false, "ingestion_method": "API" } ], "package": "claroty_ctd", "path": "baseline" }, { "type": "logs", "dataset": "claroty_ctd.event", "title": "Event logs", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9537 }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#max_connections: 1\n" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "claroty_ctd-event" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Claroty CTD fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Event logs", "description": "Collecting Claroty CTD Event logs via syslog over TCP.", "enabled": false, "ingestion_method": "Network Protocol" }, { "input": "udp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for UDP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The UDP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9536 }, { "name": "udp_options", "type": "yaml", "title": "Custom UDP Options", "description": "Specify custom configuration options for the UDP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#timeout: 300s\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "claroty_ctd-event" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Claroty CTD fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "udp.yml.hbs", "title": "Event logs", "description": "Collecting Claroty CTD Event logs via syslog over UDP.", "enabled": false, "ingestion_method": "Network Protocol" } ], "package": "claroty_ctd", "path": "event" } ] }