{ "name": "netskope", "title": "Netskope", "version": "3.1.4", "release": "ga", "description": "Collect logs from Netskope with Elastic Agent.", "type": "integration", "download": "/epr/netskope/netskope-3.1.4.zip", "path": "/package/netskope/3.1.4", "icons": [ { "src": "/img/netskope-logo.svg", "path": "/package/netskope/3.1.4/img/netskope-logo.svg", "title": "Netskope logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.9 || ^9.1.0" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "network" ], "signature_path": "/epr/netskope/netskope-3.1.4.zip.sig", "format_version": "3.0.3", "readme": "/package/netskope/3.1.4/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/netskope-alerts-screenshot.png", "path": "/package/netskope/3.1.4/img/netskope-alerts-screenshot.png", "title": "Netskope Alert logs screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/netskope-events-screenshot.png", "path": "/package/netskope/3.1.4/img/netskope-events-screenshot.png", "title": "Netskope Event logs screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/netskope-alerts-v2-screenshot.png", "path": "/package/netskope/3.1.4/img/netskope-alerts-v2-screenshot.png", "title": "Netskope Alert v2 logs screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/netskope-events_v2-screenshot.png", "path": "/package/netskope/3.1.4/img/netskope-events_v2-screenshot.png", "title": "Netskope Event v2 logs screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/netskope-transaction-screenshot.png", "path": "/package/netskope/3.1.4/img/netskope-transaction-screenshot.png", "title": "Netskope Transaction events screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/netskope/3.1.4/LICENSE.txt", "/package/netskope/3.1.4/changelog.yml", "/package/netskope/3.1.4/manifest.yml", "/package/netskope/3.1.4/validation.yml", "/package/netskope/3.1.4/docs/README.md", "/package/netskope/3.1.4/img/netskope-alerts-screenshot.png", "/package/netskope/3.1.4/img/netskope-alerts-v2-screenshot.png", "/package/netskope/3.1.4/img/netskope-events-screenshot.png", "/package/netskope/3.1.4/img/netskope-events_v2-screenshot.png", "/package/netskope/3.1.4/img/netskope-logo.svg", "/package/netskope/3.1.4/img/netskope-transaction-screenshot.png", "/package/netskope/3.1.4/kibana/tags.yml", "/package/netskope/3.1.4/data_stream/alerts/manifest.yml", "/package/netskope/3.1.4/data_stream/alerts/sample_event.json", "/package/netskope/3.1.4/data_stream/alerts_events_v2/manifest.yml", "/package/netskope/3.1.4/data_stream/alerts_events_v2/routing_rules.yml", "/package/netskope/3.1.4/data_stream/alerts_v2/manifest.yml", "/package/netskope/3.1.4/data_stream/events/manifest.yml", "/package/netskope/3.1.4/data_stream/events/sample_event.json", "/package/netskope/3.1.4/data_stream/events_v2/manifest.yml", "/package/netskope/3.1.4/data_stream/transaction/manifest.yml", "/package/netskope/3.1.4/data_stream/transaction/sample_event.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-0f68b070-71f8-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-114731b3-20a0-4dfb-9ac6-3cfcc580de86.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-1db9af70-71f4-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-388b1e00-72ae-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-40fb6505-86dc-45b1-8862-5927d7f5bbe7.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-4bdc8830-72af-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-93c4dce0-72a7-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-97349920-72b0-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-9e55e880-72b5-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-a03670f0-7208-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-ae3f6d70-71e3-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-e538e5c0-71ea-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-e6184f90-72b6-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-eaf804d1-abd2-438b-881d-5e47462f06fc.json", "/package/netskope/3.1.4/kibana/dashboard/netskope-f181cba0-71d9-11ec-8c4b-cb281099ee02.json", "/package/netskope/3.1.4/data_stream/alerts/fields/agent.yml", "/package/netskope/3.1.4/data_stream/alerts/fields/base-fields.yml", "/package/netskope/3.1.4/data_stream/alerts/fields/fields.yml", "/package/netskope/3.1.4/data_stream/alerts_events_v2/fields/base-fields.yml", "/package/netskope/3.1.4/data_stream/alerts_events_v2/fields/beats.yml", "/package/netskope/3.1.4/data_stream/alerts_events_v2/fields/fields.yml", "/package/netskope/3.1.4/data_stream/alerts_v2/fields/base-fields.yml", "/package/netskope/3.1.4/data_stream/alerts_v2/fields/beats.yml", "/package/netskope/3.1.4/data_stream/alerts_v2/fields/fields.yml", "/package/netskope/3.1.4/data_stream/events/fields/agent.yml", "/package/netskope/3.1.4/data_stream/events/fields/base-fields.yml", "/package/netskope/3.1.4/data_stream/events/fields/fields.yml", "/package/netskope/3.1.4/data_stream/events_v2/fields/base-fields.yml", "/package/netskope/3.1.4/data_stream/events_v2/fields/beats.yml", "/package/netskope/3.1.4/data_stream/events_v2/fields/fields.yml", "/package/netskope/3.1.4/data_stream/transaction/fields/base-fields.yml", "/package/netskope/3.1.4/data_stream/transaction/fields/beats.yml", "/package/netskope/3.1.4/data_stream/transaction/fields/fields.yml", "/package/netskope/3.1.4/data_stream/alerts/agent/stream/tcp.yml.hbs", "/package/netskope/3.1.4/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml", "/package/netskope/3.1.4/data_stream/alerts_events_v2/agent/stream/abs.yml.hbs", "/package/netskope/3.1.4/data_stream/alerts_events_v2/agent/stream/aws-s3.yml.hbs", "/package/netskope/3.1.4/data_stream/alerts_events_v2/agent/stream/gcs.yml.hbs", "/package/netskope/3.1.4/data_stream/alerts_events_v2/elasticsearch/ingest_pipeline/default.yml", "/package/netskope/3.1.4/data_stream/alerts_events_v2/elasticsearch/ingest_pipeline/pipeline_alerts_v2.yml", "/package/netskope/3.1.4/data_stream/alerts_events_v2/elasticsearch/ingest_pipeline/pipeline_events_v2.yml", "/package/netskope/3.1.4/data_stream/events/agent/stream/tcp.yml.hbs", "/package/netskope/3.1.4/data_stream/events/elasticsearch/ingest_pipeline/default.yml", "/package/netskope/3.1.4/data_stream/transaction/agent/stream/abs.yml.hbs", "/package/netskope/3.1.4/data_stream/transaction/agent/stream/aws-s3.yml.hbs", "/package/netskope/3.1.4/data_stream/transaction/agent/stream/gcs.yml.hbs", "/package/netskope/3.1.4/data_stream/transaction/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "netskope", "title": "Netskope logs", "description": "Collect Netskope logs.", "inputs": [ { "type": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "access_key_id", "type": "password", "title": "Access Key ID", "description": "First part of access key. This parameter along with the secret_access_key parameter is required if we are not providing shared_credential_file.", "multi": false, "required": false, "show_user": true }, { "name": "secret_access_key", "type": "password", "title": "Secret Access Key", "description": "Second part of access key. This parameter along with the access_key_id parameter is required if we are not providing shared_credential_file.", "multi": false, "required": false, "show_user": true }, { "name": "region", "type": "text", "title": "[SQS] Region", "description": "The name of the AWS region of the end point. If this option is given it takes precedence over the region name obtained from the queue_url value.", "multi": false, "required": false, "show_user": true }, { "name": "session_token", "type": "password", "title": "Session Token", "description": "Required when using temporary security credentials.", "multi": false, "required": false, "show_user": true }, { "name": "shared_credential_file", "type": "text", "title": "Shared Credential File", "description": "Directory of the shared credentials file. This parameter is required if we are not providing value for the parameters - secret_access_key and access_key_id.", "multi": false, "required": false, "show_user": false }, { "name": "credential_profile_name", "type": "text", "title": "Credential Profile Name", "description": "Profile name in shared credentials file.", "multi": false, "required": false, "show_user": false }, { "name": "role_arn", "type": "text", "title": "Role ARN", "description": "AWS IAM Role to assume.", "multi": false, "required": false, "show_user": false }, { "name": "default_region", "type": "text", "title": "Default AWS Region", "description": "Default region to query if no other region is set. Most AWS services offer a regional endpoint that can be used to make requests. Some services, such as IAM, do not support regions. If a region is not provided by any other way (environment variable, credential or instance profile), the value set here will be used.", "multi": false, "required": false, "show_user": false, "default": "" }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service.", "multi": false, "required": false, "show_user": false }, { "name": "fips_enabled", "type": "bool", "title": "FIPS Enabled", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect logs from Netskope using Log Streaming via AWS S3 or AWS SQS", "description": "Collect logs from Netskope using Log Streaming via AWS S3 or AWS SQS." }, { "type": "gcs", "title": "Collect logs from Netskope using Log Streaming via GCS (Google Cloud Storage)", "description": "Collect logs from Netskope using Log Streaming via GCS (Google Cloud Storage)." }, { "type": "azure-blob-storage", "vars": [ { "name": "oauth2", "type": "bool", "title": "Collect logs using OAuth2 authentication", "description": "To collect logs using OAuth2 authentication enable the toggle switch. By default, it will collect logs using service account key or URI.", "multi": false, "required": true, "show_user": true, "default": false } ], "title": "Collect logs from Netskope using Log Streaming via Azure Blob Storage", "description": "Collect logs from Netskope using Log Streaming via Azure Blob Storage." }, { "type": "tcp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Netskope logs using Log Shipper (Legacy)", "description": "Collect Netskope logs using Log Shipper (Legacy)." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "netskope.alerts", "title": "Alerts", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9020 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "netskope-alerts" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input. See [TCP](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-tcp.html) for details.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 20MiB\n#max_connections: 1\n#framing: delimiter\n#line_delimiter: \"\\n\"\n" }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Netskope Alerts", "description": "Collect Netskope Alerts using tcp input", "enabled": true, "ingestion_method": "Network Protocol" } ], "package": "netskope", "path": "alerts" }, { "type": "logs", "dataset": "netskope.alerts_events_v2", "title": "Alerts V2 and Events V2", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "azure-blob-storage", "vars": [ { "name": "account_name", "type": "text", "title": "Account Name", "description": "This attribute is required for various internal operations with respect to authentication, creating service clients and blob clients which are used internally for various processing purposes.\n", "multi": false, "required": true, "show_user": true }, { "name": "client_id", "type": "text", "title": "Client ID (OAuth2)", "description": "Client ID of Azure Account. This is required if 'Collect logs using OAuth2 authentication' is enabled.", "multi": false, "required": false, "show_user": true }, { "name": "client_secret", "type": "password", "title": "Client Secret (OAuth2)", "description": "Client Secret of Azure Account. This is required if 'Collect logs using OAuth2 authentication' is enabled.", "multi": false, "required": false, "show_user": true }, { "name": "tenant_id", "type": "text", "title": "Tenant ID (OAuth2)", "description": "Tenant ID of Azure Account. This is required if 'Collect logs using OAuth2 authentication' is enabled.", "multi": false, "required": false, "show_user": true }, { "name": "service_account_key", "type": "password", "title": "Service Account Key", "description": "This attribute contains the access key, found under the Access keys section on Azure Cloud, under the respective storage account. A single storage account can contain multiple containers, and they will all use this common access key.\n", "multi": false, "required": false, "show_user": true }, { "name": "service_account_uri", "type": "text", "title": "Service Account URI", "description": "This attribute contains the connection string, found under the Access keys section on Azure Cloud, under the respective storage account. A single storage account can contain multiple containers, and they will all use this common connection string.\n", "multi": false, "required": false, "show_user": false }, { "name": "storage_url", "type": "text", "title": "Storage URL", "description": "Use this attribute to specify a custom storage URL if required. By default it points to azure cloud storage. Only use this if there is a specific need to connect to a different environment where blob storage is available.\nURL format : {{protocol}}://{{account_name}}.{{storage_uri}}.\n", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Maximum number of workers", "description": "Determines how many workers are spawned per container. Maximum allowed value is 5000.", "multi": false, "required": false, "show_user": true, "default": 3 }, { "name": "poll", "type": "bool", "title": "Polling", "description": "Determines if the container will be continuously polled for new documents.", "multi": false, "required": false, "show_user": true, "default": true }, { "name": "poll_interval", "type": "text", "title": "Polling interval", "description": "Determines the time interval between polling operations.", "multi": false, "required": false, "show_user": true, "default": "15s" }, { "name": "containers", "type": "yaml", "title": "Containers", "description": "This attribute contains the details about a specific container like, name, number_of_workers, poll, poll_interval etc. The attribute 'name' is specific to a container as it describes the container name, while the fields number_of_workers, poll, poll_interval can exist both at the container level and at the global level. If you have already defined the attributes globally, then you can only specify the container name in this yaml config. If you want to override any specific attribute for a container, then, you can define it here. Any attribute defined in the yaml will override the global definitions. Please see the relevant [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-azure-blob-storage.html#attrib-containers) for further information.", "multi": false, "required": true, "show_user": true, "default": "#- name: azure-container1\n# max_workers: 3\n# poll: true\n# poll_interval: 15s\n#- name: azure-container2\n# max_workers: 3\n# poll: true\n# poll_interval: 10s\n" }, { "name": "file_selectors", "type": "yaml", "title": "File Selectors", "description": "If the container will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which is made up of regex patters. The regex should match the container filepath. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.", "multi": false, "required": false, "show_user": false, "default": "# - regex: \"event/\"\n" }, { "name": "timestamp_epoch", "type": "integer", "title": "Timestamp Epoch", "description": "This attribute can be used to filter out files/blobs which have a timestamp older than the specified value. The value of this attribute should be in unix epoch (seconds) format.", "multi": false, "required": false, "show_user": false }, { "name": "csv_comma", "type": "text", "title": "CSV Separator Character", "description": "The field separator character used by the CSV format.", "multi": false, "required": false, "show_user": false, "default": " " }, { "name": "content_type", "type": "text", "title": "Content Type", "description": "Sets the MIME content-type of the logs if there is no content-type specified in the file properties. If override_content_type is set to true, any existing content-type in the file properties will be overridden with the value of this attribute.", "multi": false, "required": false, "show_user": false }, { "name": "override_content_type", "type": "bool", "title": "Override Content Type", "description": "Overrides existing content-type of the logs with the value of the content_type attribute.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve netskope.alerts_v2 or netskope.events_v2 fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags to include in the published event.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "netskope-alerts_and_events" ] } ], "template_path": "abs.yml.hbs", "title": "Netskope Alert and Event Logs", "description": "Collect Netskope Alert and Event logs via Azure Blob Storage.", "enabled": false, "ingestion_method": "Azure Blob Storage" }, { "input": "aws-s3", "vars": [ { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "ARN of the AWS S3 bucket that will be polled for list operation. It is a required parameter for collecting logs via the AWS S3.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Listing of the S3 bucket will be polled according to the time interval defined by bucket_list_interval config. Default value is 120 secs. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "number_of_workers", "type": "integer", "title": "[S3/SQS] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "URL of the AWS SQS queue that messages will be received from. It is a required parameter for collecting logs via the AWS SQS.", "multi": false, "required": false, "show_user": true }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that do not match one of the regexes will not be processed.", "multi": false, "required": false, "show_user": false }, { "name": "external_id", "type": "text", "title": "External ID", "description": "External ID to use when assuming a role in another account.", "multi": false, "required": false, "show_user": false }, { "name": "csv_comma", "type": "text", "title": "CSV Comma", "description": "The field separator character used by the CSV format.", "multi": false, "required": false, "show_user": false, "default": " " }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "netskope-alerts_and_events" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve netskope.alerts_v2 and netskope.events_v2 fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Collect Alert and Event logs via AWS S3 or SQS", "description": "Collect Alert and Event logs via AWS S3 or SQS input.", "enabled": false, "ingestion_method": "AWS S3" }, { "input": "gcs", "vars": [ { "name": "project_id", "type": "text", "title": "Project Id", "description": "It is a required parameter to collect logs via GCS.", "multi": false, "required": true, "show_user": true, "default": "my-project-id" }, { "name": "service_account_key", "type": "password", "title": "Credentials json key", "description": "It is an optional parameter for authentication.", "multi": false, "required": false, "show_user": true }, { "name": "service_account_file", "type": "text", "title": "Credentials file path", "description": "It is an optional parameter for authentication.", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Maximum number of workers", "description": "Determines how many workers are spawned per bucket.", "multi": false, "required": false, "show_user": true, "default": 3 }, { "name": "poll", "type": "bool", "title": "Polling", "description": "Determines if the bucket will be continuously polled for new documents.", "multi": false, "required": false, "show_user": true, "default": true }, { "name": "poll_interval", "type": "text", "title": "Polling interval", "description": "Determines the time interval between polling operations.", "multi": false, "required": false, "show_user": true, "default": "15s" }, { "name": "bucket_timeout", "type": "text", "title": "Bucket Timeout", "description": "Defines the maximum time that the sdk will wait for a bucket api response before timing out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "buckets", "type": "yaml", "title": "Buckets", "description": "This attribute contains the details about a specific bucket like, name, max_workers, poll, poll_interval and bucket_timeout. The attribute 'name' is specific to a bucket as it describes the bucket name, while the fields max_workers, poll, poll_interval and bucket_timeout can exist both at the bucket level and at the global level. If you have already defined the attributes globally, then you can only specify the name in this yaml config. If you want to override any specific attribute for a specific bucket, then, you can define it here. Any attribute defined in the yaml will override the global definitions. Please see the relevant[Documentation](https://www.elastic.co/guide/en/beats/filebeat/8.5/filebeat-input-gcs.html#attrib-buckets) for further information.", "multi": false, "required": true, "show_user": true, "default": "# You can define as many buckets as you want here.\n- name: siem_gcs_bucket_1\n- name: siem_gcs_bucket_2\n# The config below is an example of how to override the global config.\n#- name: siem_gcs_bucket_3\n# max_workers: 3\n# poll: true\n# poll_interval: 10s\n# bucket_timeout: 30s\n" }, { "name": "csv_comma", "type": "text", "title": "CSV Comma", "description": "The field separator character used by the CSV format.", "multi": false, "required": false, "show_user": false, "default": " " }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "netskope-alerts" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve netskope.alerts_v2 and netskope.events_v2 fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false } ], "template_path": "gcs.yml.hbs", "title": "Collect Netskope Alert and Event logs via Google Cloud Storage", "description": "Collect Netskope Alert and Event SIEM logs via Google Cloud Storage.", "enabled": false, "ingestion_method": "Google Cloud Storage" } ], "package": "netskope", "elasticsearch": { "ingest_pipeline.name": "default" }, "path": "alerts_events_v2" }, { "type": "logs", "dataset": "netskope.alerts_v2", "title": "Alerts V2", "release": "ga", "package": "netskope", "path": "alerts_v2" }, { "type": "logs", "dataset": "netskope.events", "title": "Events", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9021 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "netskope-events" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input. See [TCP](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-tcp.html) for details.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 20MiB\n#max_connections: 1\n#framing: delimiter\n#line_delimiter: \"\\n\"\n" }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Netskope Events", "description": "Collect Netskope Events using tcp input", "enabled": true, "ingestion_method": "Network Protocol" } ], "package": "netskope", "path": "events" }, { "type": "logs", "dataset": "netskope.events_v2", "title": "Events V2", "release": "ga", "package": "netskope", "path": "events_v2" }, { "type": "logs", "dataset": "netskope.transaction", "title": "Transaction Events", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "gcs", "vars": [ { "name": "project_id", "type": "text", "title": "Project ID", "description": "It is a required parameter to collect logs via GCS.", "multi": false, "required": true, "show_user": true, "default": "my-project-id" }, { "name": "service_account_key", "type": "password", "title": "Service Account Key", "description": "The json service account credentials string, which can be generated from the google cloud console, ref [Service Account Keys](https://cloud.google.com/iam/docs/creating-managing-service-account-keys).\nThis should be the entire JSON object that is present in the credentials.json file. Required if a Service Account Credentials File is not provided.\n", "multi": false, "required": false, "show_user": true }, { "name": "service_account_file", "type": "text", "title": "Service Account Credentials File", "description": "Path to a file containing the service account key text to authenticate to the data store, which can be generated from the google cloud console, ref [Service Account Keys](https://cloud.google.com/iam/docs/creating-managing-service-account-keys).\nRequired if a Service Account Key is not provided.\n", "multi": false, "required": false, "show_user": true }, { "name": "number_of_workers", "type": "integer", "title": "Maximum number of workers", "description": "Determines how many workers are spawned per bucket.", "multi": false, "required": false, "show_user": true, "default": 3 }, { "name": "poll", "type": "bool", "title": "Polling", "description": "Determines if the bucket will be continuously polled for new documents.", "multi": false, "required": false, "show_user": true, "default": true }, { "name": "poll_interval", "type": "text", "title": "Polling interval", "description": "Determines the time interval between polling operations.", "multi": false, "required": false, "show_user": true, "default": "15s" }, { "name": "retry", "type": "yaml", "title": "Retry", "description": "This attribute can be used to configure a list of sub attributes that directly control how the input should behave when a download for a file/object fails or gets interrupted.\nFor more information about each attribute, please see the relevant [Documentation](https://www.elastic.co/docs/reference/beats/filebeat/filebeat-input-gcs#attrib-retry-gcs).\n", "multi": false, "required": false, "show_user": false, "default": "# You can change values for below attributes.\n\nmax_attempts: 3\ninitial_backoff_duration: 1s\nmax_backoff_duration: 30s\nbackoff_multiplier: 2\n" }, { "name": "buckets", "type": "yaml", "title": "Buckets", "description": "This attribute contains the details about a specific bucket like name, max_workers, poll and poll_interval. The attribute name is specific to a bucket as it describes the bucket name, while the fields max_workers, poll and poll_interval can exist both at the bucket level and the root level. \nIt is internally represented as an array, so multiple buckets can be provided.\nFor more information about each attribute, please see the relevant [Documentation](https://www.elastic.co/guide/en/beats/filebeat/8.18/filebeat-input-gcs.html#attrib-buckets).\n", "multi": false, "required": true, "show_user": true, "default": "# You can define as many buckets as you want here.\n\n- name: transaction_logs\n- name: transaction_logs_2\n\n# The config below is an example of how to override the global config.\n\n#- name: transaction_logs_3\n# number_of_workers: 3\n# poll: true\n# poll_interval: 10s\n" }, { "name": "file_selectors", "type": "yaml", "title": "[GCS] File Selectors", "description": "If the GCS bucket will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which is made up of regex patters. The regex should match the GCS bucket filepath. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.", "multi": false, "required": false, "show_user": false, "default": "# - regex: \"transaction/\"\n" }, { "name": "timestamp_epoch", "type": "integer", "title": "Timestamp Epoch", "description": "Defines the epoch time in seconds, which is used to filter out objects/files that are older than the specified timestamp.", "multi": false, "required": false, "show_user": false }, { "name": "csv_comma", "type": "text", "title": "CSV Separator Character", "description": "The field separator character used by the CSV format.", "multi": false, "required": false, "show_user": false, "default": " " }, { "name": "alternative_host", "type": "text", "title": "Alternative Host", "description": "Used to override the default host for the storage client (default is storage.googleapis.com)", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve panw_cortex_xdr.event fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "netskope-transaction" ] } ], "template_path": "gcs.yml.hbs", "title": "Collect Netskope Transaction logs via GCS", "description": "Collect Netskope transaction logs via GCS.", "enabled": false, "ingestion_method": "Google Cloud Storage" }, { "input": "azure-blob-storage", "vars": [ { "name": "account_name", "type": "text", "title": "Account Name", "description": "This attribute is required for various internal operations with respect to authentication, creating service clients and blob clients which are used internally for various processing purposes.\n", "multi": false, "required": true, "show_user": true }, { "name": "client_id", "type": "text", "title": "Client ID (OAuth2)", "description": "Client ID of Azure Account. This is required if 'Collect logs using OAuth2 authentication' is enabled.", "multi": false, "required": false, "show_user": true }, { "name": "client_secret", "type": "password", "title": "Client Secret (OAuth2)", "description": "Client Secret of Azure Account. This is required if 'Collect logs using OAuth2 authentication' is enabled.", "multi": false, "required": false, "show_user": true }, { "name": "tenant_id", "type": "text", "title": "Tenant ID (OAuth2)", "description": "Tenant ID of Azure Account. This is required if 'Collect logs using OAuth2 authentication' is enabled.", "multi": false, "required": false, "show_user": true }, { "name": "service_account_key", "type": "password", "title": "Service Account Key", "description": "This attribute contains the access key, found under the Access keys section on Azure Cloud, under the respective storage account. A single storage account can contain multiple containers, and they will all use this common access key.\n", "multi": false, "required": false, "show_user": true }, { "name": "service_account_uri", "type": "text", "title": "Service Account URI", "description": "This attribute contains the connection string, found under the Access keys section on Azure Cloud, under the respective storage account. A single storage account can contain multiple containers, and they will all use this common connection string.\n", "multi": false, "required": false, "show_user": false }, { "name": "storage_url", "type": "text", "title": "Storage URL", "description": "Use this attribute to specify a custom storage URL if required. By default it points to azure cloud storage. Only use this if there is a specific need to connect to a different environment where blob storage is available.\nURL format : {{protocol}}://{{account_name}}.{{storage_uri}}.\n", "multi": false, "required": false, "show_user": false }, { "name": "number_of_workers", "type": "integer", "title": "Maximum number of workers", "description": "Determines how many workers are spawned per container. Maximum allowed value is 5000.", "multi": false, "required": false, "show_user": true, "default": 3 }, { "name": "poll", "type": "bool", "title": "Polling", "description": "Determines if the container will be continuously polled for new documents.", "multi": false, "required": false, "show_user": true, "default": true }, { "name": "poll_interval", "type": "text", "title": "Polling interval", "description": "Determines the time interval between polling operations.", "multi": false, "required": false, "show_user": true, "default": "15s" }, { "name": "containers", "type": "yaml", "title": "Containers", "description": "This attribute contains the details about a specific container like, name, number_of_workers, poll, poll_interval etc. \nThe attribute 'name' is specific to a container as it describes the container name, while the fields number_of_workers, poll, poll_interval can exist both at the container level and at the global level. \nIf you have already defined the attributes globally, then you can only specify the container name in this yaml config. \nIf you want to override any specific attribute for a container, then, you can define it here. \nAny attribute defined in the yaml will override the global definitions. Please see the relevant [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-azure-blob-storage.html#attrib-containers) for further information.\n", "multi": false, "required": true, "show_user": true, "default": "#- name: azure-container1\n# max_workers: 3\n# poll: true\n# poll_interval: 15s\n#- name: azure-container2\n# max_workers: 3\n# poll: true\n# poll_interval: 10s\n" }, { "name": "file_selectors", "type": "yaml", "title": "File Selectors", "description": "If the container will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which is made up of regex patters. \nThe regex should match the container filepath. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.\n", "multi": false, "required": false, "show_user": false, "default": "# - regex: \"transaction/\"\n" }, { "name": "timestamp_epoch", "type": "integer", "title": "Timestamp Epoch", "description": "This attribute can be used to filter out files/blobs which have a timestamp older than the specified value. The value of this attribute should be in unix epoch (seconds) format.", "multi": false, "required": false, "show_user": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "csv_comma", "type": "text", "title": "CSV Separator Character", "description": "The field separator character used by the CSV format.", "multi": false, "required": false, "show_user": false, "default": " " }, { "name": "content_type", "type": "text", "title": "Content Type", "description": "Sets the MIME content-type of the logs if there is no content-type specified in the file properties. If override_content_type is set to true, any existing content-type in the file properties will be overridden with the value of this attribute.", "multi": false, "required": false, "show_user": false }, { "name": "override_content_type", "type": "bool", "title": "Override Content Type", "description": "Overrides existing content-type of the logs with the value of the content_type attribute.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags to include in the published event.", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "netskope-transaction" ] } ], "template_path": "abs.yml.hbs", "title": "Collect Netskope Transaction logs via Azure Blob Storage", "description": "Collect Netskope Transaction logs via Azure Blob Storage.", "enabled": false, "ingestion_method": "Azure Blob Storage" }, { "input": "aws-s3", "vars": [ { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "ARN of the AWS S3 bucket that will be polled for list operation. It is a required parameter for collecting logs via the AWS S3.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "[S3] Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Listing of the S3 bucket will be polled according to the time interval defined by bucket_list_interval config. Default value is 120 secs. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "URL of the AWS SQS queue that messages will be received from. It is a required parameter for collecting logs via the AWS SQS.", "multi": false, "required": false, "show_user": true }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn’t process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that do not match one of the regexes will not be processed.", "multi": false, "required": false, "show_user": false }, { "name": "external_id", "type": "text", "title": "External ID", "description": "External ID to use when assuming a role in another account.", "multi": false, "required": false, "show_user": false }, { "name": "csv_comma", "type": "text", "title": "CSV Separator Character", "description": "The field separator character used by the CSV format.", "multi": false, "required": false, "show_user": false, "default": " " }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "netskope-transaction" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve netskope.transaction fields that were mapped to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "aws-s3.yml.hbs", "title": "Collect Netskope Transaction logs via AWS S3 or SQS", "description": "Collect Netskope Transaction logs via AWS S3 or SQS input.", "enabled": false, "ingestion_method": "AWS S3" } ], "package": "netskope", "path": "transaction" } ] }