{
  "name": "hashicorp_vault",
  "title": "Hashicorp Vault",
  "version": "1.30.1",
  "release": "ga",
  "description": "Collect logs and metrics from Hashicorp Vault with Elastic Agent.",
  "type": "integration",
  "download": "/epr/hashicorp_vault/hashicorp_vault-1.30.1.zip",
  "path": "/package/hashicorp_vault/1.30.1",
  "icons": [
    {
      "src": "/img/Vault_VerticalLogo_Color_RGB.svg",
      "path": "/package/hashicorp_vault/1.30.1/img/Vault_VerticalLogo_Color_RGB.svg",
      "title": "Vault Logo",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.12.0 || ^9.0.0"
    }
  },
  "owner": {
    "type": "elastic",
    "github": "elastic/integration-experience"
  },
  "categories": [
    "security",
    "iam"
  ],
  "signature_path": "/epr/hashicorp_vault/hashicorp_vault-1.30.1.zip.sig",
  "format_version": "3.0.3",
  "readme": "/package/hashicorp_vault/1.30.1/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/hashicorp_vault-audit-dashboard.png",
      "path": "/package/hashicorp_vault/1.30.1/img/hashicorp_vault-audit-dashboard.png",
      "title": "Audit Log Dashboard",
      "size": "2742x2050",
      "type": "image/png"
    },
    {
      "src": "/img/hashicorp_vault-log-dashboard.png",
      "path": "/package/hashicorp_vault/1.30.1/img/hashicorp_vault-log-dashboard.png",
      "title": "Audit Log Dashboard",
      "size": "2752x1946",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/hashicorp_vault/1.30.1/LICENSE.txt",
    "/package/hashicorp_vault/1.30.1/changelog.yml",
    "/package/hashicorp_vault/1.30.1/manifest.yml",
    "/package/hashicorp_vault/1.30.1/validation.yml",
    "/package/hashicorp_vault/1.30.1/docs/README.md",
    "/package/hashicorp_vault/1.30.1/img/Vault_VerticalLogo_Color_RGB.svg",
    "/package/hashicorp_vault/1.30.1/img/hashicorp_vault-audit-dashboard.png",
    "/package/hashicorp_vault/1.30.1/img/hashicorp_vault-log-dashboard.png",
    "/package/hashicorp_vault/1.30.1/kibana/tags.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/audit/manifest.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/audit/sample_event.json",
    "/package/hashicorp_vault/1.30.1/data_stream/log/manifest.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/log/sample_event.json",
    "/package/hashicorp_vault/1.30.1/data_stream/metrics/manifest.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/metrics/sample_event.json",
    "/package/hashicorp_vault/1.30.1/docs/knowledge_base/service_info.md",
    "/package/hashicorp_vault/1.30.1/kibana/dashboard/hashicorp_vault-1f321db0-f4b8-11eb-a89a-7378b1713db5.json",
    "/package/hashicorp_vault/1.30.1/kibana/dashboard/hashicorp_vault-64b51280-f4ad-11eb-a89a-7378b1713db5.json",
    "/package/hashicorp_vault/1.30.1/data_stream/audit/fields/agent.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/audit/fields/base-fields.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/audit/fields/ecs.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/audit/fields/fields.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/log/fields/agent.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/log/fields/base-fields.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/log/fields/ecs.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/log/fields/fields.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/metrics/fields/base-fields.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/metrics/fields/ecs.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/metrics/fields/fields.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/audit/agent/stream/logfile.yml.hbs",
    "/package/hashicorp_vault/1.30.1/data_stream/audit/agent/stream/tcp.yml.hbs",
    "/package/hashicorp_vault/1.30.1/data_stream/audit/elasticsearch/ingest_pipeline/default.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/log/agent/stream/logfile.yml.hbs",
    "/package/hashicorp_vault/1.30.1/data_stream/log/elasticsearch/ingest_pipeline/default.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/log/elasticsearch/ingest_pipeline/json.yml",
    "/package/hashicorp_vault/1.30.1/data_stream/metrics/agent/stream/metrics.yml.hbs",
    "/package/hashicorp_vault/1.30.1/data_stream/metrics/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "hashicorp_vault",
      "title": "Hashicorp Vault",
      "description": "Collect logs and monitor Hashicorp Vault.",
      "inputs": [
        {
          "type": "logfile",
          "title": "Logs from file",
          "description": "Collect Vault logs from file."
        },
        {
          "type": "tcp",
          "title": "Logs from TCP socket",
          "description": "Collect Vault audit logs sent via TCP."
        },
        {
          "type": "prometheus/metrics",
          "title": "Metrics",
          "description": "Collect Vault metrics via prometheus."
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "hashicorp_vault.audit",
      "title": "Hashicorp Vault Audit Logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "logfile",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": false,
              "show_user": true,
              "default": [
                "/var/log/vault/audit*.json*"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "hashicorp-vault-audit"
              ]
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.  This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "logfile.yml.hbs",
          "title": "Audit logs (file audit device)",
          "description": "Collect Vault audit logs from file.",
          "enabled": true,
          "ingestion_method": "File"
        },
        {
          "input": "tcp",
          "vars": [
            {
              "name": "listen_address",
              "type": "text",
              "title": "Listen Address",
              "description": "The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "localhost"
            },
            {
              "name": "listen_port",
              "type": "integer",
              "title": "Listen Port",
              "description": "The TCP port number to listen on.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": 9007
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "hashicorp-vault-audit",
                "forwarded"
              ]
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.  This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "tcp.yml.hbs",
          "title": "Audit logs (socket audit device)",
          "description": "Collect Vault audit logs from TCP socket.",
          "enabled": false,
          "ingestion_method": "Network Protocol"
        }
      ],
      "package": "hashicorp_vault",
      "path": "audit"
    },
    {
      "type": "logs",
      "dataset": "hashicorp_vault.log",
      "title": "Hashicorp Vault Operational Logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "logfile",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": false,
              "show_user": true,
              "default": [
                "/var/log/vault/log*.json*"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "hashicorp-vault-log"
              ]
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.  This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "logfile.yml.hbs",
          "title": "Operation logs",
          "description": "Collect Vault operational logs from file.",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "hashicorp_vault",
      "path": "log"
    },
    {
      "type": "metrics",
      "dataset": "hashicorp_vault.metrics",
      "title": "Hashicorp Vault Metrics",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "prometheus/metrics",
          "vars": [
            {
              "name": "period",
              "type": "text",
              "title": "Period",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "30s"
            },
            {
              "name": "hosts",
              "type": "text",
              "title": "Hosts",
              "description": "Vault addresses to monitor. `/v1/sys/metrics?format=prometheus` is automatically appended.",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "http://localhost:8200"
              ]
            },
            {
              "name": "vault_token",
              "type": "password",
              "title": "Vault Token",
              "description": "A Vault token with read access to the /sys/metrics API.",
              "multi": false,
              "required": true,
              "show_user": true
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/metricbeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "ssl",
              "type": "yaml",
              "title": "SSL Configuration",
              "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/metricbeat/current/configuration-ssl.html#ssl-common-config) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#certificate_authorities:\n#  - |\n#    -----BEGIN CERTIFICATE-----\n#    MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n#    -----END CERTIFICATE-----"
            }
          ],
          "template_path": "metrics.yml.hbs",
          "title": "Vault metrics (prometheus)",
          "description": "Collect prometheus metrics from Vault.",
          "enabled": true,
          "ingestion_method": "Prometheus"
        }
      ],
      "package": "hashicorp_vault",
      "elasticsearch": {
        "index_template.settings": {
          "index": {
            "mapping": {
              "dimension_fields": {
                "limit": 32
              }
            }
          }
        },
        "ingest_pipeline.name": "default"
      },
      "path": "metrics"
    }
  ]
}