{ "name": "entro", "title": "Entro", "version": "0.5.0", "release": "beta", "description": "Collect logs from Entro with Elastic Agent.", "type": "integration", "download": "/epr/entro/entro-0.5.0.zip", "path": "/package/entro/0.5.0", "icons": [ { "src": "/img/entro_security-logo.svg", "path": "/package/entro/0.5.0/img/entro_security-logo.svg", "title": "Sample logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.2 || ^9.0.5" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "cloud", "security" ], "signature_path": "/epr/entro/entro-0.5.0.zip.sig", "format_version": "3.3.5", "readme": "/package/entro/0.5.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/audit-dashboard.png", "path": "/package/entro/0.5.0/img/audit-dashboard.png", "title": "Audit Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/entro/0.5.0/LICENSE.txt", "/package/entro/0.5.0/changelog.yml", "/package/entro/0.5.0/manifest.yml", "/package/entro/0.5.0/docs/README.md", "/package/entro/0.5.0/img/audit-dashboard.png", "/package/entro/0.5.0/img/entro_security-logo.svg", "/package/entro/0.5.0/data_stream/audit/manifest.yml", "/package/entro/0.5.0/data_stream/audit/sample_event.json", "/package/entro/0.5.0/kibana/dashboard/entro-9fc7e45e-e6b9-4f07-bd52-92636ecc22e0.json", "/package/entro/0.5.0/data_stream/audit/fields/agent.yml", "/package/entro/0.5.0/data_stream/audit/fields/base-fields.yml", "/package/entro/0.5.0/data_stream/audit/fields/fields.yml", "/package/entro/0.5.0/data_stream/audit/agent/stream/cel.yml.hbs", "/package/entro/0.5.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "entro", "title": "Entro audit events", "description": "Collect Entro audit events.", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "url", "title": "URL", "description": "Base URL of the Entro instance.", "multi": false, "required": true, "show_user": true }, { "name": "api_token", "type": "password", "title": "API Token", "description": "API Token used to authenticate the requests.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Entro audit via API requests", "description": "Collect Entro audit via API requests." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "entro.audit", "title": "Audit Logs", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Entro API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "10m" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "The amount of time the integration will look back when first initialized. Supported units for this parameter are h/m/s. Default is 60 days (1440h)", "multi": false, "required": true, "show_user": true, "default": "1440h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "120s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "entro-event" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Entro audit events via API requests", "description": "Collects audit events from Entro via API requests.", "enabled": true, "ingestion_method": "API" } ], "package": "entro", "elasticsearch": { "index_template.mappings": { "subobjects": false }, "ingest_pipeline.name": "default" }, "path": "audit" } ] }