{ "name": "infoblox_bloxone_ddi", "title": "Infoblox BloxOne DDI", "version": "1.25.0", "release": "ga", "description": "Collect logs from Infoblox BloxOne DDI with Elastic Agent.", "type": "integration", "download": "/epr/infoblox_bloxone_ddi/infoblox_bloxone_ddi-1.25.0.zip", "path": "/package/infoblox_bloxone_ddi/1.25.0", "icons": [ { "src": "/img/infoblox-bloxone-ddi-logo.svg", "path": "/package/infoblox_bloxone_ddi/1.25.0/img/infoblox-bloxone-ddi-logo.svg", "title": "Infoblox BloxOne DDI logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.4 || ~9.0.7 || ^9.1.4" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "network", "dns_security" ], "signature_path": "/epr/infoblox_bloxone_ddi/infoblox_bloxone_ddi-1.25.0.zip.sig", "format_version": "3.3.2", "readme": "/package/infoblox_bloxone_ddi/1.25.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/infoblox-bloxone-ddi-screenshot.png", "path": "/package/infoblox_bloxone_ddi/1.25.0/img/infoblox-bloxone-ddi-screenshot.png", "title": "Infoblox BloxOne DDI dashboard screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/infoblox_bloxone_ddi/1.25.0/LICENSE.txt", "/package/infoblox_bloxone_ddi/1.25.0/changelog.yml", "/package/infoblox_bloxone_ddi/1.25.0/manifest.yml", "/package/infoblox_bloxone_ddi/1.25.0/validation.yml", "/package/infoblox_bloxone_ddi/1.25.0/docs/README.md", "/package/infoblox_bloxone_ddi/1.25.0/img/infoblox-bloxone-ddi-logo.svg", "/package/infoblox_bloxone_ddi/1.25.0/img/infoblox-bloxone-ddi-screenshot.png", "/package/infoblox_bloxone_ddi/1.25.0/kibana/tags.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dhcp_lease/manifest.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dhcp_lease/sample_event.json", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_config/manifest.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_config/sample_event.json", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_data/manifest.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_data/sample_event.json", "/package/infoblox_bloxone_ddi/1.25.0/kibana/dashboard/infoblox_bloxone_ddi-85daef90-0ce7-11ed-8a96-d11b53f3d359.json", "/package/infoblox_bloxone_ddi/1.25.0/kibana/dashboard/infoblox_bloxone_ddi-b8497140-0cdd-11ed-8a96-d11b53f3d359.json", "/package/infoblox_bloxone_ddi/1.25.0/kibana/dashboard/infoblox_bloxone_ddi-d3f8a270-0ce3-11ed-8a96-d11b53f3d359.json", "/package/infoblox_bloxone_ddi/1.25.0/kibana/search/infoblox_bloxone_ddi-86860980-34f0-11ed-a2eb-7fc0c8a128fe.json", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dhcp_lease/fields/agent.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dhcp_lease/fields/base-fields.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dhcp_lease/fields/fields.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_config/fields/agent.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_config/fields/base-fields.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_config/fields/fields.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_data/fields/agent.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_data/fields/base-fields.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_data/fields/fields.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dhcp_lease/agent/stream/httpjson.yml.hbs", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dhcp_lease/elasticsearch/ingest_pipeline/default.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_config/agent/stream/httpjson.yml.hbs", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_config/elasticsearch/ingest_pipeline/default.yml", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_data/agent/stream/httpjson.yml.hbs", "/package/infoblox_bloxone_ddi/1.25.0/data_stream/dns_data/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "infoblox_bloxone_ddi", "title": "Infoblox BloxOne DDI", "description": "Collect logs from Infoblox BloxOne DDI.", "inputs": [ { "type": "httpjson", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Infoblox BloxOne DDI URL.", "multi": false, "required": true, "show_user": true, "default": "https://csp.infoblox.com" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "api_key", "type": "password", "title": "API Key", "description": "API Key.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Infoblox BloxOne DDI logs via API", "description": "Collecting Infoblox BloxOne DDI logs via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "infoblox_bloxone_ddi.dhcp_lease", "title": "Collect DHCP Lease logs from Infoblox BloxOne DDI", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the DHCP Lease events from Infoblox BloxOne DDI. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Infoblox BloxOne DDI API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "infoblox_bloxone_ddi-dhcp_lease" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve custom fields for all ECS mappings.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "DHCP Lease logs", "description": "Collect DHCP Lease logs from Infoblox BloxOne DDI.", "enabled": true, "ingestion_method": "API" } ], "package": "infoblox_bloxone_ddi", "path": "dhcp_lease" }, { "type": "logs", "dataset": "infoblox_bloxone_ddi.dns_config", "title": "Collect DNS Config logs from Infoblox BloxOne DDI", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the DNS configuration views from Infoblox BloxOne DDI. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Infoblox BloxOne DDI API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "infoblox_bloxone_ddi-dns_config" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve custom fields for all ECS mappings.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "DNS Config logs", "description": "Collect DNS Config logs from Infoblox BloxOne DDI.", "enabled": true, "ingestion_method": "API" } ], "package": "infoblox_bloxone_ddi", "path": "dns_config" }, { "type": "logs", "dataset": "infoblox_bloxone_ddi.dns_data", "title": "Collect DNS Data logs from Infoblox BloxOne DDI", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the DNS resource records from Infoblox BloxOne DDI. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the BloxOne DDI API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1m" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "bloxone_ddi-dns_data" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve custom fields for all ECS mappings.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "DNS Data logs", "description": "Collect DNS Data logs from Infoblox BloxOne DDI.", "enabled": true, "ingestion_method": "API" } ], "package": "infoblox_bloxone_ddi", "path": "dns_data" } ] }