{ "name": "lastpass", "title": "LastPass", "version": "1.23.1", "release": "ga", "description": "Collect logs from LastPass with Elastic Agent.", "type": "integration", "download": "/epr/lastpass/lastpass-1.23.1.zip", "path": "/package/lastpass/1.23.1", "icons": [ { "src": "/img/lastpass-logo.svg", "path": "/package/lastpass/1.23.1/img/lastpass-logo.svg", "title": "LastPass Logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.4 || ~9.0.7 || ^9.1.4" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "credential_management" ], "signature_path": "/epr/lastpass/lastpass-1.23.1.zip.sig", "format_version": "3.3.2", "readme": "/package/lastpass/1.23.1/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/lastpass-dashboard-screenshot.png", "path": "/package/lastpass/1.23.1/img/lastpass-dashboard-screenshot.png", "title": "LastPass Detailed Shared Folder Dashboard Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/lastpass/1.23.1/LICENSE.txt", "/package/lastpass/1.23.1/changelog.yml", "/package/lastpass/1.23.1/manifest.yml", "/package/lastpass/1.23.1/validation.yml", "/package/lastpass/1.23.1/docs/README.md", "/package/lastpass/1.23.1/img/lastpass-account-number-screenshot.png", "/package/lastpass/1.23.1/img/lastpass-dashboard-screenshot.png", "/package/lastpass/1.23.1/img/lastpass-logo.svg", "/package/lastpass/1.23.1/img/lastpass-provisioning-hash-screenshot.png", "/package/lastpass/1.23.1/kibana/tags.yml", "/package/lastpass/1.23.1/data_stream/detailed_shared_folder/manifest.yml", "/package/lastpass/1.23.1/data_stream/detailed_shared_folder/sample_event.json", "/package/lastpass/1.23.1/data_stream/event_report/manifest.yml", "/package/lastpass/1.23.1/data_stream/event_report/sample_event.json", "/package/lastpass/1.23.1/data_stream/user/manifest.yml", "/package/lastpass/1.23.1/data_stream/user/sample_event.json", "/package/lastpass/1.23.1/kibana/dashboard/lastpass-45d2e670-244b-11ed-80ca-25e921dc7ac2.json", "/package/lastpass/1.23.1/kibana/dashboard/lastpass-975ecef0-2450-11ed-80ca-25e921dc7ac2.json", "/package/lastpass/1.23.1/kibana/dashboard/lastpass-fa6ad220-2458-11ed-80ca-25e921dc7ac2.json", "/package/lastpass/1.23.1/kibana/search/lastpass-d8f5da30-245e-11ed-80ca-25e921dc7ac2.json", "/package/lastpass/1.23.1/kibana/search/lastpass-df784f50-2454-11ed-80ca-25e921dc7ac2.json", "/package/lastpass/1.23.1/data_stream/detailed_shared_folder/fields/agent.yml", "/package/lastpass/1.23.1/data_stream/detailed_shared_folder/fields/base-fields.yml", "/package/lastpass/1.23.1/data_stream/detailed_shared_folder/fields/fields.yml", "/package/lastpass/1.23.1/data_stream/event_report/fields/agent.yml", "/package/lastpass/1.23.1/data_stream/event_report/fields/base-fields.yml", "/package/lastpass/1.23.1/data_stream/event_report/fields/fields.yml", "/package/lastpass/1.23.1/data_stream/user/fields/agent.yml", "/package/lastpass/1.23.1/data_stream/user/fields/base-fields.yml", "/package/lastpass/1.23.1/data_stream/user/fields/fields.yml", "/package/lastpass/1.23.1/data_stream/detailed_shared_folder/agent/stream/httpjson.yml.hbs", "/package/lastpass/1.23.1/data_stream/detailed_shared_folder/elasticsearch/ingest_pipeline/default.yml", "/package/lastpass/1.23.1/data_stream/event_report/agent/stream/httpjson.yml.hbs", "/package/lastpass/1.23.1/data_stream/event_report/elasticsearch/ingest_pipeline/default.yml", "/package/lastpass/1.23.1/data_stream/user/agent/stream/httpjson.yml.hbs", "/package/lastpass/1.23.1/data_stream/user/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "lastpass", "title": "LastPass", "description": "Collect logs from LastPass.", "inputs": [ { "type": "httpjson", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "URL for the LastPass API.", "multi": false, "required": true, "show_user": false, "default": "https://lastpass.com/enterpriseapi.php" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "account_number", "type": "text", "title": "Account number", "description": "LastPass account number.", "multi": false, "required": true, "show_user": false }, { "name": "provisioning_hash", "type": "password", "title": "Provisioning hash", "description": "The API secret is also known as your provisioning hash, and is only displayed once it has been created.", "multi": false, "required": true, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect LastPass logs via API", "description": "Collecting LastPass logs via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "beta" } } } ], "data_streams": [ { "type": "logs", "dataset": "lastpass.detailed_shared_folder", "title": "Collect Detailed Shared Folder logs from LastPass", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "page_size", "type": "integer", "title": "Page Size", "description": "Limits the maximum number of items listed per page.", "multi": false, "required": false, "show_user": false, "default": "2000" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the LastPass API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "lastpass-detailed_shared_folder" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve lastpass.detailed_shared_folder fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Detailed Shared Folder logs", "description": "Collect detailed shared folder logs from LastPass.", "enabled": true, "ingestion_method": "API" } ], "package": "lastpass", "path": "detailed_shared_folder" }, { "type": "logs", "dataset": "lastpass.event_report", "title": "Collect Event Report logs from LastPass", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the event report from LastPass. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the LastPass API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "lastpass-event_report" ] }, { "name": "tz_offset", "type": "text", "title": "Timezone", "description": "IANA time zone or time offset (e.g. `America/Denver` or `-06:00`) to use when LastPass timestamps without a time zone.", "multi": false, "required": false, "show_user": false, "default": "US/Eastern" }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve lastpass.event_report fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Event Report logs", "description": "Collect event report logs from LastPass.", "enabled": true, "ingestion_method": "API" } ], "package": "lastpass", "path": "event_report" }, { "type": "logs", "dataset": "lastpass.user", "title": "Collect User logs from LastPass", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the LastPass API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "lastpass-user" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve lastpass.user fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "User logs", "description": "Collect user logs from LastPass.", "enabled": true, "ingestion_method": "API" } ], "package": "lastpass", "path": "user" } ] }