{ "name": "forgerock", "title": "ForgeRock", "version": "1.26.0", "release": "ga", "description": "Collect audit logs from ForgeRock with Elastic Agent.", "type": "integration", "download": "/epr/forgerock/forgerock-1.26.0.zip", "path": "/package/forgerock/1.26.0", "icons": [ { "src": "/img/forgerock-icon.svg", "path": "/package/forgerock/1.26.0/img/forgerock-icon.svg", "title": "ForgeRock Identity Platform", "size": "216x216", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.4 || ~9.0.7 || ^9.1.4" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/forgerock/forgerock-1.26.0.zip.sig", "format_version": "3.3.2", "readme": "/package/forgerock/1.26.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/forgerock-dashboard.png", "path": "/package/forgerock/1.26.0/img/forgerock-dashboard.png", "title": "ForgeRock Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/forgerock/1.26.0/LICENSE.txt", "/package/forgerock/1.26.0/changelog.yml", "/package/forgerock/1.26.0/manifest.yml", "/package/forgerock/1.26.0/validation.yml", "/package/forgerock/1.26.0/docs/README.md", "/package/forgerock/1.26.0/img/forgerock-dashboard.png", "/package/forgerock/1.26.0/img/forgerock-icon.svg", "/package/forgerock/1.26.0/kibana/tags.yml", "/package/forgerock/1.26.0/data_stream/am_access/manifest.yml", "/package/forgerock/1.26.0/data_stream/am_access/sample_event.json", "/package/forgerock/1.26.0/data_stream/am_activity/manifest.yml", "/package/forgerock/1.26.0/data_stream/am_activity/sample_event.json", "/package/forgerock/1.26.0/data_stream/am_authentication/manifest.yml", "/package/forgerock/1.26.0/data_stream/am_authentication/sample_event.json", "/package/forgerock/1.26.0/data_stream/am_config/manifest.yml", "/package/forgerock/1.26.0/data_stream/am_config/sample_event.json", "/package/forgerock/1.26.0/data_stream/am_core/manifest.yml", "/package/forgerock/1.26.0/data_stream/am_core/sample_event.json", "/package/forgerock/1.26.0/data_stream/idm_access/manifest.yml", "/package/forgerock/1.26.0/data_stream/idm_access/sample_event.json", "/package/forgerock/1.26.0/data_stream/idm_activity/manifest.yml", "/package/forgerock/1.26.0/data_stream/idm_activity/sample_event.json", "/package/forgerock/1.26.0/data_stream/idm_authentication/manifest.yml", "/package/forgerock/1.26.0/data_stream/idm_authentication/sample_event.json", "/package/forgerock/1.26.0/data_stream/idm_config/manifest.yml", "/package/forgerock/1.26.0/data_stream/idm_config/sample_event.json", "/package/forgerock/1.26.0/data_stream/idm_core/manifest.yml", "/package/forgerock/1.26.0/data_stream/idm_core/sample_event.json", "/package/forgerock/1.26.0/data_stream/idm_sync/manifest.yml", "/package/forgerock/1.26.0/data_stream/idm_sync/sample_event.json", "/package/forgerock/1.26.0/kibana/dashboard/forgerock-263aed30-7fa9-11ed-b53a-1b59fe8c1601.json", "/package/forgerock/1.26.0/data_stream/am_access/fields/base-fields.yml", "/package/forgerock/1.26.0/data_stream/am_access/fields/forgerock-fields.yml", "/package/forgerock/1.26.0/data_stream/am_activity/fields/base-fields.yml", "/package/forgerock/1.26.0/data_stream/am_activity/fields/forgerock-fields.yml", "/package/forgerock/1.26.0/data_stream/am_authentication/fields/base-fields.yml", "/package/forgerock/1.26.0/data_stream/am_authentication/fields/forgerock-fields.yml", "/package/forgerock/1.26.0/data_stream/am_config/fields/base-fields.yml", "/package/forgerock/1.26.0/data_stream/am_config/fields/forgerock-fields.yml", "/package/forgerock/1.26.0/data_stream/am_core/fields/base-fields.yml", "/package/forgerock/1.26.0/data_stream/am_core/fields/forgerock-fields.yml", "/package/forgerock/1.26.0/data_stream/idm_access/fields/base-fields.yml", "/package/forgerock/1.26.0/data_stream/idm_access/fields/forgerock-fields.yml", "/package/forgerock/1.26.0/data_stream/idm_activity/fields/base-fields.yml", "/package/forgerock/1.26.0/data_stream/idm_activity/fields/forgerock-fields.yml", "/package/forgerock/1.26.0/data_stream/idm_authentication/fields/base-fields.yml", "/package/forgerock/1.26.0/data_stream/idm_authentication/fields/forgerock-fields.yml", "/package/forgerock/1.26.0/data_stream/idm_config/fields/base-fields.yml", "/package/forgerock/1.26.0/data_stream/idm_config/fields/forgerock-fields.yml", "/package/forgerock/1.26.0/data_stream/idm_core/fields/base-fields.yml", "/package/forgerock/1.26.0/data_stream/idm_core/fields/fields.yml", "/package/forgerock/1.26.0/data_stream/idm_sync/fields/base-fields.yml", "/package/forgerock/1.26.0/data_stream/idm_sync/fields/forgerock-fields.yml", "/package/forgerock/1.26.0/data_stream/am_access/agent/stream/httpjson.yml.hbs", "/package/forgerock/1.26.0/data_stream/am_access/elasticsearch/ingest_pipeline/default.yml", "/package/forgerock/1.26.0/data_stream/am_activity/agent/stream/httpjson.yml.hbs", "/package/forgerock/1.26.0/data_stream/am_activity/elasticsearch/ingest_pipeline/default.yml", "/package/forgerock/1.26.0/data_stream/am_authentication/agent/stream/httpjson.yml.hbs", "/package/forgerock/1.26.0/data_stream/am_authentication/elasticsearch/ingest_pipeline/default.yml", "/package/forgerock/1.26.0/data_stream/am_config/agent/stream/httpjson.yml.hbs", "/package/forgerock/1.26.0/data_stream/am_config/elasticsearch/ingest_pipeline/default.yml", "/package/forgerock/1.26.0/data_stream/am_core/agent/stream/httpjson.yml.hbs", "/package/forgerock/1.26.0/data_stream/am_core/elasticsearch/ingest_pipeline/default.yml", "/package/forgerock/1.26.0/data_stream/idm_access/agent/stream/httpjson.yml.hbs", "/package/forgerock/1.26.0/data_stream/idm_access/elasticsearch/ingest_pipeline/default.yml", "/package/forgerock/1.26.0/data_stream/idm_activity/agent/stream/httpjson.yml.hbs", "/package/forgerock/1.26.0/data_stream/idm_activity/elasticsearch/ingest_pipeline/default.yml", "/package/forgerock/1.26.0/data_stream/idm_authentication/agent/stream/httpjson.yml.hbs", "/package/forgerock/1.26.0/data_stream/idm_authentication/elasticsearch/ingest_pipeline/default.yml", "/package/forgerock/1.26.0/data_stream/idm_config/agent/stream/httpjson.yml.hbs", "/package/forgerock/1.26.0/data_stream/idm_config/elasticsearch/ingest_pipeline/default.yml", "/package/forgerock/1.26.0/data_stream/idm_core/agent/stream/httpjson.yml.hbs", "/package/forgerock/1.26.0/data_stream/idm_core/elasticsearch/ingest_pipeline/default.yml", "/package/forgerock/1.26.0/data_stream/idm_sync/agent/stream/httpjson.yml.hbs", "/package/forgerock/1.26.0/data_stream/idm_sync/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "forgerock", "title": "Collect ForgeRock logs via API", "description": "Collecting ForgeRock logs via API with Elastic Agent.", "inputs": [ { "type": "httpjson", "vars": [ { "name": "tenant_url", "type": "text", "title": "Tenant environment URL", "description": "The url of your Identity Cloud.", "multi": false, "required": true, "show_user": true, "default": "https://example.forgeblocks.com" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": true, "default": "60s" }, { "name": "ssl", "type": "yaml", "title": "SSL", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "api_key", "type": "password", "title": "API Key", "multi": false, "required": true, "show_user": true }, { "name": "api_secret", "type": "password", "title": "API Secret", "multi": false, "required": true, "show_user": true }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull logs from ForgeRock. Can not be longer than 24 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the ForgeRock API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" } ], "title": "Collect ForgeRock logs via API", "description": "Collecting ForgeRock logs via API" } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "forgerock.am_access", "title": "AM-Access audit logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "forgerock-audit", "forgerock-am-access" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve forgerock.* fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "AM-Access audit logs", "description": "Collect am-access audit logs from ForgeRock.", "enabled": true, "ingestion_method": "API" } ], "package": "forgerock", "path": "am_access" }, { "type": "logs", "dataset": "forgerock.am_activity", "title": "AM-Activity audit logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "forgerock-audit", "forgerock-am-activity" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve forgerock.* fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "AM-Activity audit logs", "description": "Collect am-activity audit logs from ForgeRock.", "enabled": true, "ingestion_method": "API" } ], "package": "forgerock", "path": "am_activity" }, { "type": "logs", "dataset": "forgerock.am_authentication", "title": "AM-Authentication audit logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "forgerock-audit", "forgerock-am-authentication" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve forgerock.* fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "AM-Authentication audit logs", "description": "Collect am-authentication audit logs from ForgeRock.", "enabled": true, "ingestion_method": "API" } ], "package": "forgerock", "path": "am_authentication" }, { "type": "logs", "dataset": "forgerock.am_config", "title": "AM-Config audit logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "forgerock-audit", "forgerock-am-config" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve forgerock.* fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "AM-Config audit logs", "description": "Collect am-config audit logs from ForgeRock.", "enabled": true, "ingestion_method": "API" } ], "package": "forgerock", "path": "am_config" }, { "type": "logs", "dataset": "forgerock.am_core", "title": "AM-Core debug logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "forgerock-debug", "forgerock-am-core" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve forgerock.* fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "AM-Core debug logs", "description": "Collect am-core debug logs from ForgeRock.", "enabled": true, "ingestion_method": "API" } ], "package": "forgerock", "path": "am_core" }, { "type": "logs", "dataset": "forgerock.idm_access", "title": "IDM-Access audit logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "forgerock-audit", "forgerock-idm-access" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve forgerock.* fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "IDM-Access audit logs", "description": "Collect idm-access audit logs from ForgeRock.", "enabled": true, "ingestion_method": "API" } ], "package": "forgerock", "path": "idm_access" }, { "type": "logs", "dataset": "forgerock.idm_activity", "title": "IDM-Activity audit logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "forgerock-audit", "forgerock-idm-activity" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve forgerock.* fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "IDM-Activity audit logs", "description": "Collect idm-activity audit logs from ForgeRock.", "enabled": true, "ingestion_method": "API" } ], "package": "forgerock", "path": "idm_activity" }, { "type": "logs", "dataset": "forgerock.idm_authentication", "title": "IDM-Authentication audit logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "forgerock-audit", "forgerock-idm-authentication" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve forgerock.* fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "IDM-Authentication audit logs", "description": "Collect idm-authentication audit logs from ForgeRock.", "enabled": true, "ingestion_method": "API" } ], "package": "forgerock", "path": "idm_authentication" }, { "type": "logs", "dataset": "forgerock.idm_config", "title": "IDM-Config audit logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "forgerock-audit", "forgerock-idm-config" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve forgerock.* fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "IDM-Config audit logs", "description": "Collect idm-config audit logs from ForgeRock.", "enabled": true, "ingestion_method": "API" } ], "package": "forgerock", "path": "idm_config" }, { "type": "logs", "dataset": "forgerock.idm_core", "title": "IDM-Core debug logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "forgerock-debug", "forgerock-idm-core" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve forgerock.* fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "IDM-Core debug logs", "description": "Collect idm-core debug logs from ForgeRock.", "enabled": true, "ingestion_method": "API" } ], "package": "forgerock", "path": "idm_core" }, { "type": "logs", "dataset": "forgerock.idm_sync", "title": "IDM-Sync audit logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "forgerock-audit", "forgerock-idm-sync" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve forgerock.* fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "IDM-Sync audit logs", "description": "Collect idm-sync audit logs from ForgeRock.", "enabled": true, "ingestion_method": "API" } ], "package": "forgerock", "path": "idm_sync" } ] }