{
  "name": "microsoft_exchange_server",
  "title": "Microsoft Exchange Server",
  "version": "1.3.0",
  "release": "ga",
  "source": {
    "license": "Elastic-2.0"
  },
  "description": "Collect logs from Microsoft Exchange Server with Elastic Agent.",
  "type": "integration",
  "download": "/epr/microsoft_exchange_server/microsoft_exchange_server-1.3.0.zip",
  "path": "/package/microsoft_exchange_server/1.3.0",
  "icons": [
    {
      "src": "/img/exchange.svg",
      "path": "/package/microsoft_exchange_server/1.3.0/img/exchange.svg",
      "title": "Exchange Server logo",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.10.1 || ^9.0.0"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "community",
    "github": "elastic/sec-windows-platform"
  },
  "categories": [
    "security"
  ],
  "signature_path": "/epr/microsoft_exchange_server/microsoft_exchange_server-1.3.0.zip.sig",
  "format_version": "3.0.3",
  "readme": "/package/microsoft_exchange_server/1.3.0/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/screenshot_messagtracking.png",
      "path": "/package/microsoft_exchange_server/1.3.0/img/screenshot_messagtracking.png",
      "title": "Screenshot MessageTracking Dashboard",
      "size": "600x600",
      "type": "image/png"
    },
    {
      "src": "/img/screenshot_httpproxy.png",
      "path": "/package/microsoft_exchange_server/1.3.0/img/screenshot_httpproxy.png",
      "title": "Screenshot HTTPProxy Dashboard",
      "size": "600x600",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/microsoft_exchange_server/1.3.0/LICENSE.txt",
    "/package/microsoft_exchange_server/1.3.0/changelog.yml",
    "/package/microsoft_exchange_server/1.3.0/manifest.yml",
    "/package/microsoft_exchange_server/1.3.0/validation.yml",
    "/package/microsoft_exchange_server/1.3.0/docs/README.md",
    "/package/microsoft_exchange_server/1.3.0/img/exchange.svg",
    "/package/microsoft_exchange_server/1.3.0/img/screenshot_httpproxy.png",
    "/package/microsoft_exchange_server/1.3.0/img/screenshot_messagtracking.png",
    "/package/microsoft_exchange_server/1.3.0/data_stream/httpproxy/manifest.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/imap4_pop3/manifest.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/messagetracking/manifest.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/smtp/manifest.yml",
    "/package/microsoft_exchange_server/1.3.0/kibana/dashboard/microsoft_exchange_server-2b868ef0-c041-11ee-a682-0f218cc418af.json",
    "/package/microsoft_exchange_server/1.3.0/kibana/dashboard/microsoft_exchange_server-66a4ce40-1a00-4ced-9547-7e96def93f02.json",
    "/package/microsoft_exchange_server/1.3.0/kibana/search/microsoft_exchange_server-75b14bd0-c034-11ee-a682-0f218cc418af.json",
    "/package/microsoft_exchange_server/1.3.0/kibana/search/microsoft_exchange_server-ee0a5030-c03f-11ee-a682-0f218cc418af.json",
    "/package/microsoft_exchange_server/1.3.0/data_stream/httpproxy/fields/base-fields.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/httpproxy/fields/ecs.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/httpproxy/fields/fields.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/imap4_pop3/fields/base-fields.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/imap4_pop3/fields/ecs.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/imap4_pop3/fields/fields.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/messagetracking/fields/base-fields.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/messagetracking/fields/ecs.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/messagetracking/fields/fields.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/smtp/fields/base-fields.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/smtp/fields/ecs.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/smtp/fields/fields.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/httpproxy/agent/stream/filestream.yml.hbs",
    "/package/microsoft_exchange_server/1.3.0/data_stream/httpproxy/elasticsearch/ingest_pipeline/default.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/imap4_pop3/agent/stream/filestream.yml.hbs",
    "/package/microsoft_exchange_server/1.3.0/data_stream/imap4_pop3/elasticsearch/ingest_pipeline/default.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/messagetracking/agent/stream/filestream.yml.hbs",
    "/package/microsoft_exchange_server/1.3.0/data_stream/messagetracking/elasticsearch/ingest_pipeline/default.yml",
    "/package/microsoft_exchange_server/1.3.0/data_stream/smtp/agent/stream/filestream.yml.hbs",
    "/package/microsoft_exchange_server/1.3.0/data_stream/smtp/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "microsoft_exchange_server",
      "title": "Microsoft Exchange Server",
      "description": "Microsoft Exchange Server Logs",
      "data_streams": [
        "smtp",
        "httpproxy",
        "messagetracking",
        "imap4_pop3"
      ],
      "inputs": [
        {
          "type": "filestream",
          "title": "Collect Microsoft Exchange Server Logs from file",
          "description": "Microsoft Exchange Server Logs"
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "microsoft_exchange_server.httpproxy",
      "title": "Exchange HTTPProxy",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\HttpProxy\\*\\*.LOG"
              ]
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": false,
              "show_user": false
            },
            {
              "name": "scanner",
              "type": "yaml",
              "title": "Scanner",
              "description": "You can modify the scanner settings if needed. See [the reference](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#_scanner_options) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "# fingerprint.length: 64\n"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Exchange HTTPProxy Logs",
          "description": "Collects HTTPProxy Logs",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "microsoft_exchange_server",
      "path": "httpproxy"
    },
    {
      "type": "logs",
      "dataset": "microsoft_exchange_server.imap4_pop3",
      "title": "Exchange Server IMAP4 POP3",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\Imap4\\IMAP*.LOG",
                "C:\\Program Files\\Microsoft\\Exchange Server\\V15\\Logging\\Pop3\\POP*.LOG"
              ]
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": false,
              "show_user": false
            },
            {
              "name": "scanner",
              "type": "yaml",
              "title": "Scanner",
              "description": "You can modify the scanner settings if needed. See [the reference](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#_scanner_options) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "# fingerprint.length: 64\n"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Exchange Server IMAP4 POP3 Logs",
          "description": "Collect Exchange Server IMAP4 POP3 logs",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "microsoft_exchange_server",
      "path": "imap4_pop3"
    },
    {
      "type": "logs",
      "dataset": "microsoft_exchange_server.messagetracking",
      "title": "Exchange Messagetracking",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "C:\\Program Files\\Microsoft\\Exchange Server\\V15\\TransportRoles\\Logs\\MessageTracking\\*.LOG"
              ]
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": false,
              "show_user": false
            },
            {
              "name": "scanner",
              "type": "yaml",
              "title": "Scanner",
              "description": "You can modify the scanner settings if needed. See [the reference](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#_scanner_options) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "# fingerprint.length: 64\n"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Exchange Messagetracking Logs",
          "description": "Collect Exchange Messagetracking logs",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "microsoft_exchange_server",
      "path": "messagetracking"
    },
    {
      "type": "logs",
      "dataset": "microsoft_exchange_server.smtp",
      "title": "Exchange SMTP",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "filestream",
          "vars": [
            {
              "name": "paths",
              "type": "text",
              "title": "Paths",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "C:\\Program Files\\Microsoft\\Exchange Server\\V15\\TransportRoles\\Logs\\Hub\\ProtocolLog\\SmtpSend\\*.LOG",
                "C:\\Program Files\\Microsoft\\Exchange Server\\V15\\TransportRoles\\Logs\\FrontEnd\\ProtocolLog\\SmtpReceive\\*.LOG"
              ]
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": false,
              "show_user": false
            },
            {
              "name": "scanner",
              "type": "yaml",
              "title": "Scanner",
              "description": "You can modify the scanner settings if needed. See [the reference](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-filestream.html#_scanner_options) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "# fingerprint.length: 64\n"
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/fleet/current/elastic-agent-processor-configuration.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Exchange SMTP logs",
          "description": "Collect Exchange SMTP logs",
          "enabled": true,
          "ingestion_method": "File"
        }
      ],
      "package": "microsoft_exchange_server",
      "path": "smtp"
    }
  ]
}