{
  "name": "gdacs",
  "title": "GDACS Disaster Alerts",
  "version": "0.1.0",
  "release": "beta",
  "source": {
    "license": "Elastic-2.0"
  },
  "description": "Ingest Global Disaster Alert and Coordination System (GDACS) events — earthquakes, tropical cyclones, floods, volcanoes, droughts, and wildfires.",
  "type": "integration",
  "download": "/epr/gdacs/gdacs-0.1.0.zip",
  "path": "/package/gdacs/0.1.0",
  "icons": [
    {
      "src": "/img/gdacs-logo.svg",
      "path": "/package/gdacs/0.1.0/img/gdacs-logo.svg",
      "title": "GDACS logo",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^9.3.1"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "community",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "custom"
  ],
  "signature_path": "/epr/gdacs/gdacs-0.1.0.zip.sig",
  "format_version": "3.5.8",
  "readme": "/package/gdacs/0.1.0/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/gdacs_events.png",
      "path": "/package/gdacs/0.1.0/img/gdacs_events.png",
      "title": "Dashboard Overview",
      "size": "600x600",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/gdacs/0.1.0/LICENSE.txt",
    "/package/gdacs/0.1.0/changelog.yml",
    "/package/gdacs/0.1.0/manifest.yml",
    "/package/gdacs/0.1.0/validation.yml",
    "/package/gdacs/0.1.0/docs/README.md",
    "/package/gdacs/0.1.0/img/gdacs-logo.svg",
    "/package/gdacs/0.1.0/img/gdacs_events.png",
    "/package/gdacs/0.1.0/data_stream/events/manifest.yml",
    "/package/gdacs/0.1.0/data_stream/events/sample_event.json",
    "/package/gdacs/0.1.0/kibana/dashboard/gdacs-998e30fb-8dff-4724-8186-fd9410478f8e.json",
    "/package/gdacs/0.1.0/kibana/search/gdacs-26c06442-da44-48b1-b0ef-420ecd086320.json",
    "/package/gdacs/0.1.0/data_stream/events/fields/base-fields.yml",
    "/package/gdacs/0.1.0/data_stream/events/fields/fields.yml",
    "/package/gdacs/0.1.0/data_stream/events/agent/stream/cel.yml.hbs",
    "/package/gdacs/0.1.0/data_stream/events/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "gdacs",
      "title": "GDACS Events",
      "description": "Collect natural disaster events from the GDACS API.",
      "inputs": [
        {
          "type": "cel",
          "title": "Collect GDACS events via API",
          "description": "Polls the GDACS Search API for natural disaster alerts and events."
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "gdacs.events",
      "title": "GDACS Events",
      "release": "beta",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "cel",
          "vars": [
            {
              "name": "url",
              "type": "text",
              "title": "GDACS API Base URL",
              "description": "Base URL for the GDACS API.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "https://www.gdacs.org/gdacsapi/api"
            },
            {
              "name": "interval",
              "type": "text",
              "title": "Poll Interval",
              "description": "How often to poll the GDACS API. Examples: 1h, 30m, 6h.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "1h"
            },
            {
              "name": "lookback_hours",
              "type": "integer",
              "title": "Lookback Window (hours)",
              "description": "Hours of history to fetch on first run (168 = 7 days).",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": 168
            },
            {
              "name": "event_types",
              "type": "text",
              "title": "Event Types",
              "description": "Semicolon-separated GDACS event codes: EQ, TC, FL, VO, DR, WF.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "EQ;TC;FL;VO;DR;WF"
            },
            {
              "name": "alert_levels",
              "type": "text",
              "title": "Alert Levels",
              "description": "Semicolon-separated alert levels: red, orange, green.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "red;orange;green"
            },
            {
              "name": "country",
              "type": "text",
              "title": "Country Filter (ISO3)",
              "description": "Optional ISO3 country code to filter events (e.g. USA, BRA, MMR). Leave empty to receive events for all countries.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "page_size",
              "type": "integer",
              "title": "Page Size",
              "description": "Number of events per API page (max 100).",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": 100
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`. If disabled, `event.original` is not included in the document.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": false,
              "show_user": false,
              "default": [
                "forwarded",
                "gdacs-events"
              ]
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "cel.yml.hbs",
          "title": "GDACS Events via CEL",
          "description": "Polls the GDACS Search API for natural disaster events, fetches detailed\ngeometry polygons for each event, and indexes them to this data stream.",
          "enabled": true,
          "ingestion_method": "API"
        }
      ],
      "package": "gdacs",
      "path": "events"
    }
  ]
}