{ "name": "neon_cyber", "title": "Neon Cyber", "version": "0.3.0", "release": "beta", "source": { "license": "Elastic-2.0" }, "description": "The Neon Cyber integration for the Elastic Stack", "type": "integration", "download": "/epr/neon_cyber/neon_cyber-0.3.0.zip", "path": "/package/neon_cyber/0.3.0", "icons": [ { "src": "/img/neoncyber-logo.svg", "path": "/package/neon_cyber/0.3.0/img/neoncyber-logo.svg", "title": "Neon Cyber logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.17.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "partner", "github": "elastic/security-service-integrations" }, "categories": [ "security", "edr_xdr" ], "signature_path": "/epr/neon_cyber/neon_cyber-0.3.0.zip.sig", "format_version": "3.5.0", "readme": "/package/neon_cyber/0.3.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/neoncyber-screenshot.png", "path": "/package/neon_cyber/0.3.0/img/neoncyber-screenshot.png", "title": "Neon events screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/neon_cyber/0.3.0/LICENSE.txt", "/package/neon_cyber/0.3.0/changelog.yml", "/package/neon_cyber/0.3.0/manifest.yml", "/package/neon_cyber/0.3.0/docs/README.md", "/package/neon_cyber/0.3.0/img/neoncyber-logo.svg", "/package/neon_cyber/0.3.0/img/neoncyber-screenshot.png", "/package/neon_cyber/0.3.0/data_stream/detections/manifest.yml", "/package/neon_cyber/0.3.0/data_stream/detections/sample_event.json", "/package/neon_cyber/0.3.0/data_stream/events/manifest.yml", "/package/neon_cyber/0.3.0/data_stream/events/sample_event.json", "/package/neon_cyber/0.3.0/data_stream/detections/fields/base-fields.yml", "/package/neon_cyber/0.3.0/data_stream/detections/fields/beats.yml", "/package/neon_cyber/0.3.0/data_stream/detections/fields/ecs.yml", "/package/neon_cyber/0.3.0/data_stream/detections/fields/fields.yml", "/package/neon_cyber/0.3.0/data_stream/events/fields/base-fields.yml", "/package/neon_cyber/0.3.0/data_stream/events/fields/beats.yml", "/package/neon_cyber/0.3.0/data_stream/events/fields/ecs.yml", "/package/neon_cyber/0.3.0/data_stream/events/fields/fields.yml", "/package/neon_cyber/0.3.0/data_stream/detections/agent/stream/cel.yml.hbs", "/package/neon_cyber/0.3.0/data_stream/detections/elasticsearch/ingest_pipeline/default.yml", "/package/neon_cyber/0.3.0/data_stream/events/agent/stream/cel.yml.hbs", "/package/neon_cyber/0.3.0/data_stream/events/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "neon_cyber", "title": "Neon Cyber", "description": "Collect workforce logs from the Neon Cyber API", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "text", "title": "Neon Cyber API URL", "description": "Neon Cyber developer API URL", "multi": false, "required": true, "show_user": true, "default": "https://api.neoncyber.io" }, { "name": "api_token", "type": "password", "title": "API Token", "description": "Neon Cyber developer API token", "multi": false, "required": true, "show_user": true }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": true, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false } ], "title": "Collect Neon Cyber Data", "description": "Collecting Neon Cyber events and detections via API" } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "neon_cyber.detections", "title": "Neon Cyber Detections", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Detection Endpoint Interval", "description": "How often the API is polled, supports seconds, minutes and hours.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": false, "show_user": false, "default": [ "forwarded", "neon_cyber-detections" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Neon Cyber Detections", "description": "Collect workforce detections from the Neon Cyber Platform", "enabled": true, "ingestion_method": "API" } ], "package": "neon_cyber", "path": "detections" }, { "type": "logs", "dataset": "neon_cyber.events", "title": "Neon Cyber Events", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Events Endpoint Interval", "description": "How often the API is polled, supports seconds, minutes and hours.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": false, "show_user": false, "default": [ "forwarded", "neon_cyber-events" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Collect Neon Cyber Events", "description": "Collect workforce events from the Neon Cyber Platform", "enabled": true, "ingestion_method": "API" } ], "package": "neon_cyber", "path": "events" } ] }