{ "name": "cyera", "title": "Cyera", "version": "0.7.1", "release": "beta", "description": "Collect logs from Cyera with Elastic Agent.", "type": "integration", "download": "/epr/cyera/cyera-0.7.1.zip", "path": "/package/cyera/0.7.1", "icons": [ { "src": "/img/cyera-logo.svg", "path": "/package/cyera/0.7.1/img/cyera-logo.svg", "title": "Cyera logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.7 || ~9.1.7 || ~9.2.1 || ^9.3.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/cyera/cyera-0.7.1.zip.sig", "format_version": "3.3.2", "readme": "/package/cyera/0.7.1/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/cyera-classification-dashboard.png", "path": "/package/cyera/0.7.1/img/cyera-classification-dashboard.png", "title": "Classification Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/cyera-datastore-dashboard.png", "path": "/package/cyera/0.7.1/img/cyera-datastore-dashboard.png", "title": "Datastore Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/cyera-issue-dashboard.png", "path": "/package/cyera/0.7.1/img/cyera-issue-dashboard.png", "title": "Issue Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/cyera-event-dashboard.png", "path": "/package/cyera/0.7.1/img/cyera-event-dashboard.png", "title": "Event Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/cyera/0.7.1/LICENSE.txt", "/package/cyera/0.7.1/changelog.yml", "/package/cyera/0.7.1/lifecycle.yml", "/package/cyera/0.7.1/manifest.yml", "/package/cyera/0.7.1/validation.yml", "/package/cyera/0.7.1/docs/README.md", "/package/cyera/0.7.1/img/cyera-classification-dashboard.png", "/package/cyera/0.7.1/img/cyera-datastore-dashboard.png", "/package/cyera/0.7.1/img/cyera-event-dashboard.png", "/package/cyera/0.7.1/img/cyera-issue-dashboard.png", "/package/cyera/0.7.1/img/cyera-logo.svg", "/package/cyera/0.7.1/data_stream/classification/manifest.yml", "/package/cyera/0.7.1/data_stream/classification/sample_event.json", "/package/cyera/0.7.1/data_stream/datastore/manifest.yml", "/package/cyera/0.7.1/data_stream/datastore/sample_event.json", "/package/cyera/0.7.1/data_stream/event/manifest.yml", "/package/cyera/0.7.1/data_stream/event/sample_event.json", "/package/cyera/0.7.1/data_stream/issue/manifest.yml", "/package/cyera/0.7.1/data_stream/issue/sample_event.json", "/package/cyera/0.7.1/kibana/dashboard/cyera-6737957a-301f-446f-81a3-78c70251f7df.json", "/package/cyera/0.7.1/kibana/dashboard/cyera-cf848001-ffb2-40f0-baac-edd6d5eec631.json", "/package/cyera/0.7.1/kibana/dashboard/cyera-d44c2c43-2457-4c72-84ee-23639beeed1f.json", "/package/cyera/0.7.1/kibana/dashboard/cyera-db5aefa7-05b8-4a10-9cb6-55a71c617e29.json", "/package/cyera/0.7.1/kibana/search/cyera-2f5834ea-de53-47da-bfcb-ee4496a92784.json", "/package/cyera/0.7.1/kibana/search/cyera-635b25f0-ca36-438f-b885-477655a90816.json", "/package/cyera/0.7.1/kibana/search/cyera-6ace2d0a-df3d-4e67-9856-c4e29880646a.json", "/package/cyera/0.7.1/kibana/search/cyera-97c0ed14-10db-4fc8-b041-51d15c539fcb.json", "/package/cyera/0.7.1/kibana/search/cyera-e0a7c981-498b-44c2-8804-7771d265bad0.json", "/package/cyera/0.7.1/kibana/search/cyera-e1ffb4d3-c43c-4047-bb92-b2a2c46d8b1d.json", "/package/cyera/0.7.1/data_stream/classification/fields/base-fields.yml", "/package/cyera/0.7.1/data_stream/classification/fields/beats.yml", "/package/cyera/0.7.1/data_stream/classification/fields/ecs.yml", "/package/cyera/0.7.1/data_stream/classification/fields/fields.yml", "/package/cyera/0.7.1/data_stream/classification/fields/is-transform-source-true.yml", "/package/cyera/0.7.1/data_stream/datastore/fields/base-fields.yml", "/package/cyera/0.7.1/data_stream/datastore/fields/beats.yml", "/package/cyera/0.7.1/data_stream/datastore/fields/ecs.yml", "/package/cyera/0.7.1/data_stream/datastore/fields/fields.yml", "/package/cyera/0.7.1/data_stream/datastore/fields/is-transform-source-true.yml", "/package/cyera/0.7.1/data_stream/event/fields/base-fields.yml", "/package/cyera/0.7.1/data_stream/event/fields/beats.yml", "/package/cyera/0.7.1/data_stream/event/fields/ecs.yml", "/package/cyera/0.7.1/data_stream/event/fields/fields.yml", "/package/cyera/0.7.1/data_stream/issue/fields/base-fields.yml", "/package/cyera/0.7.1/data_stream/issue/fields/beats.yml", "/package/cyera/0.7.1/data_stream/issue/fields/ecs.yml", "/package/cyera/0.7.1/data_stream/issue/fields/fields.yml", "/package/cyera/0.7.1/data_stream/issue/fields/is-transform-source-true.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_classification/manifest.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_classification/transform.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_datastore/manifest.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_datastore/transform.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_issue/manifest.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_issue/transform.yml", "/package/cyera/0.7.1/data_stream/classification/agent/stream/cel.yml.hbs", "/package/cyera/0.7.1/data_stream/classification/elasticsearch/ilm/default_policy.json", "/package/cyera/0.7.1/data_stream/classification/elasticsearch/ingest_pipeline/default.yml", "/package/cyera/0.7.1/data_stream/datastore/agent/stream/cel.yml.hbs", "/package/cyera/0.7.1/data_stream/datastore/elasticsearch/ilm/default_policy.json", "/package/cyera/0.7.1/data_stream/datastore/elasticsearch/ingest_pipeline/default.yml", "/package/cyera/0.7.1/data_stream/event/agent/stream/cel.yml.hbs", "/package/cyera/0.7.1/data_stream/event/elasticsearch/ingest_pipeline/default.yml", "/package/cyera/0.7.1/data_stream/issue/agent/stream/cel.yml.hbs", "/package/cyera/0.7.1/data_stream/issue/elasticsearch/ilm/default_policy.json", "/package/cyera/0.7.1/data_stream/issue/elasticsearch/ingest_pipeline/default.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_classification/fields/base-fields.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_classification/fields/beats.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_classification/fields/ecs.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_classification/fields/fields.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_classification/fields/is-transform-source-false.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_datastore/fields/base-fields.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_datastore/fields/beats.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_datastore/fields/ecs.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_datastore/fields/fields.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_datastore/fields/is-transform-source-false.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_issue/fields/base-fields.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_issue/fields/beats.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_issue/fields/ecs.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_issue/fields/fields.yml", "/package/cyera/0.7.1/elasticsearch/transform/latest_issue/fields/is-transform-source-false.yml" ], "policy_templates": [ { "name": "cyera", "title": "Cyera logs", "description": "Collect Cyera logs.", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of Cyera.", "multi": false, "required": true, "show_user": true, "default": "https://api.cyera.io" }, { "name": "client_id", "type": "text", "title": "Client ID", "description": "Client ID.", "multi": false, "required": true, "show_user": true }, { "name": "client_secret", "type": "password", "title": "Client Secret", "description": "Client Secret.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "proxy configuration in the form of https://:@:.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Cyera logs via API", "description": "Collecting logs from Cyera via CEL input." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } } ], "data_streams": [ { "type": "logs", "dataset": "cyera.classification", "ilm_policy": "logs-cyera.classification-default_policy", "title": "Classification", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Cyera API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Cyera API. The batch size can range from a minimum of 1 to a maximum of 100.", "multi": false, "required": true, "show_user": true, "default": 100 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "cyera-classification" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field event.original.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve cyera.classification fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Classification logs", "description": "Collect Classification logs from Cyera.", "enabled": true, "ingestion_method": "API" } ], "package": "cyera", "path": "classification" }, { "type": "logs", "dataset": "cyera.datastore", "ilm_policy": "logs-cyera.datastore-default_policy", "title": "Datastore", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Datastore logs from Cyera API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Cyera API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Cyera API. The batch size can range from a minimum of 1 to a maximum of 1000.", "multi": false, "required": true, "show_user": true, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "cyera-datastore" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field event.original.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve cyera.datastore fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Datastore logs", "description": "Collect Datastore logs from Cyera.", "enabled": true, "ingestion_method": "API" } ], "package": "cyera", "path": "datastore" }, { "type": "logs", "dataset": "cyera.event", "title": "Event", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Event logs from Cyera API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Cyera API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Cyera API. The batch size can range from a minimum of 1 to a maximum of 100.", "multi": false, "required": true, "show_user": true, "default": 100 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "cyera-event" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field event.original.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve cyera.event fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Event logs", "description": "Collect Event logs from Cyera.", "enabled": true, "ingestion_method": "API" } ], "package": "cyera", "path": "event" }, { "type": "logs", "dataset": "cyera.issue", "ilm_policy": "logs-cyera.issue-default_policy", "title": "Issue", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Issue logs from Cyera API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Cyera API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Cyera API. The batch size can range from a minimum of 1 to a maximum of 1000.", "multi": false, "required": true, "show_user": true, "default": 100 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "cyera-issue" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field event.original.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve cyera.issue fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Issue logs", "description": "Collect Issue logs from Cyera.", "enabled": true, "ingestion_method": "API" } ], "package": "cyera", "path": "issue" } ] }