{ "name": "nozomi_networks", "title": "Nozomi Networks", "version": "0.4.0", "release": "beta", "description": "Collect logs from Nozomi Networks with Elastic Agent.", "type": "integration", "download": "/epr/nozomi_networks/nozomi_networks-0.4.0.zip", "path": "/package/nozomi_networks/0.4.0", "icons": [ { "src": "/img/nozomi_networks-logo.svg", "path": "/package/nozomi_networks/0.4.0/img/nozomi_networks-logo.svg", "title": "Nozomi Networks logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.18.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "network" ], "signature_path": "/epr/nozomi_networks/nozomi_networks-0.4.0.zip.sig", "format_version": "3.3.2", "readme": "/package/nozomi_networks/0.4.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/alert-dashboard.png", "path": "/package/nozomi_networks/0.4.0/img/alert-dashboard.png", "title": "Alert Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/asset-dashboard.png", "path": "/package/nozomi_networks/0.4.0/img/asset-dashboard.png", "title": "Asset Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/audit-dashboard.png", "path": "/package/nozomi_networks/0.4.0/img/audit-dashboard.png", "title": "Audit Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/health-dashboard.png", "path": "/package/nozomi_networks/0.4.0/img/health-dashboard.png", "title": "Health Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/node-dashboard.png", "path": "/package/nozomi_networks/0.4.0/img/node-dashboard.png", "title": "Node Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/node_cve-dashboard.png", "path": "/package/nozomi_networks/0.4.0/img/node_cve-dashboard.png", "title": "Node CVE Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/session-dashboard.png", "path": "/package/nozomi_networks/0.4.0/img/session-dashboard.png", "title": "Session Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/variable-dashboard.png", "path": "/package/nozomi_networks/0.4.0/img/variable-dashboard.png", "title": "Variable Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/nozomi_networks/0.4.0/LICENSE.txt", "/package/nozomi_networks/0.4.0/changelog.yml", "/package/nozomi_networks/0.4.0/manifest.yml", "/package/nozomi_networks/0.4.0/validation.yml", "/package/nozomi_networks/0.4.0/docs/README.md", "/package/nozomi_networks/0.4.0/img/alert-dashboard.png", "/package/nozomi_networks/0.4.0/img/asset-dashboard.png", "/package/nozomi_networks/0.4.0/img/audit-dashboard.png", "/package/nozomi_networks/0.4.0/img/health-dashboard.png", "/package/nozomi_networks/0.4.0/img/node-dashboard.png", "/package/nozomi_networks/0.4.0/img/node_cve-dashboard.png", "/package/nozomi_networks/0.4.0/img/nozomi_networks-logo.svg", "/package/nozomi_networks/0.4.0/img/session-dashboard.png", "/package/nozomi_networks/0.4.0/img/variable-dashboard.png", "/package/nozomi_networks/0.4.0/data_stream/alert/manifest.yml", "/package/nozomi_networks/0.4.0/data_stream/alert/sample_event.json", "/package/nozomi_networks/0.4.0/data_stream/asset/manifest.yml", "/package/nozomi_networks/0.4.0/data_stream/asset/sample_event.json", "/package/nozomi_networks/0.4.0/data_stream/audit/manifest.yml", "/package/nozomi_networks/0.4.0/data_stream/audit/sample_event.json", "/package/nozomi_networks/0.4.0/data_stream/health/manifest.yml", "/package/nozomi_networks/0.4.0/data_stream/health/sample_event.json", "/package/nozomi_networks/0.4.0/data_stream/node/manifest.yml", "/package/nozomi_networks/0.4.0/data_stream/node/sample_event.json", "/package/nozomi_networks/0.4.0/data_stream/node_cve/manifest.yml", "/package/nozomi_networks/0.4.0/data_stream/node_cve/sample_event.json", "/package/nozomi_networks/0.4.0/data_stream/session/manifest.yml", "/package/nozomi_networks/0.4.0/data_stream/session/sample_event.json", "/package/nozomi_networks/0.4.0/data_stream/variable/manifest.yml", "/package/nozomi_networks/0.4.0/data_stream/variable/sample_event.json", "/package/nozomi_networks/0.4.0/kibana/dashboard/nozomi_networks-1b267947-931d-484b-bf52-52981e3c7a72.json", "/package/nozomi_networks/0.4.0/kibana/dashboard/nozomi_networks-445285cb-457b-426c-9e27-f5130213f4f0.json", "/package/nozomi_networks/0.4.0/kibana/dashboard/nozomi_networks-627fed53-e5a9-4d4b-844b-ab08b7ea4b6e.json", "/package/nozomi_networks/0.4.0/kibana/dashboard/nozomi_networks-746a513f-0db6-4865-8752-9b8204476309.json", "/package/nozomi_networks/0.4.0/kibana/dashboard/nozomi_networks-a58e56a7-001f-4d72-b8f6-ab64f78ae4b9.json", "/package/nozomi_networks/0.4.0/kibana/dashboard/nozomi_networks-bbccdaca-9655-43d1-92d3-372b18416cfb.json", "/package/nozomi_networks/0.4.0/kibana/dashboard/nozomi_networks-c6154d1b-776c-4052-876f-672dc30d4d9b.json", "/package/nozomi_networks/0.4.0/kibana/dashboard/nozomi_networks-f899124c-9613-4c3d-9683-4eb6955fe6e1.json", "/package/nozomi_networks/0.4.0/kibana/search/nozomi_networks-19ad2e84-f2bc-4d1e-aa92-c77569d494dd.json", "/package/nozomi_networks/0.4.0/kibana/search/nozomi_networks-1c432ce9-4dac-4d29-8af0-753149442f93.json", "/package/nozomi_networks/0.4.0/kibana/search/nozomi_networks-5c8641d5-86a3-4416-aa1c-e4ea411e3977.json", "/package/nozomi_networks/0.4.0/kibana/search/nozomi_networks-6747716f-6b0f-4df5-a148-1ea4baaee099.json", "/package/nozomi_networks/0.4.0/kibana/search/nozomi_networks-a4451c02-96b0-421c-b194-675320626f93.json", "/package/nozomi_networks/0.4.0/kibana/search/nozomi_networks-c977f218-a7de-45c0-81ba-98b318209429.json", "/package/nozomi_networks/0.4.0/kibana/search/nozomi_networks-e1375950-71d1-4edf-bdc7-c796424137c9.json", "/package/nozomi_networks/0.4.0/kibana/search/nozomi_networks-f985cae2-2186-4c00-bbdd-a56da35740b4.json", "/package/nozomi_networks/0.4.0/data_stream/alert/fields/base-fields.yml", "/package/nozomi_networks/0.4.0/data_stream/alert/fields/beats.yml", "/package/nozomi_networks/0.4.0/data_stream/alert/fields/ecs.yml", "/package/nozomi_networks/0.4.0/data_stream/alert/fields/fields.yml", "/package/nozomi_networks/0.4.0/data_stream/asset/fields/base-fields.yml", "/package/nozomi_networks/0.4.0/data_stream/asset/fields/beats.yml", "/package/nozomi_networks/0.4.0/data_stream/asset/fields/ecs.yml", "/package/nozomi_networks/0.4.0/data_stream/asset/fields/fields.yml", "/package/nozomi_networks/0.4.0/data_stream/audit/fields/base-fields.yml", "/package/nozomi_networks/0.4.0/data_stream/audit/fields/beats.yml", "/package/nozomi_networks/0.4.0/data_stream/audit/fields/ecs.yml", "/package/nozomi_networks/0.4.0/data_stream/audit/fields/fields.yml", "/package/nozomi_networks/0.4.0/data_stream/health/fields/base-fields.yml", "/package/nozomi_networks/0.4.0/data_stream/health/fields/beats.yml", "/package/nozomi_networks/0.4.0/data_stream/health/fields/ecs.yml", "/package/nozomi_networks/0.4.0/data_stream/health/fields/fields.yml", "/package/nozomi_networks/0.4.0/data_stream/node/fields/base-fields.yml", "/package/nozomi_networks/0.4.0/data_stream/node/fields/beats.yml", "/package/nozomi_networks/0.4.0/data_stream/node/fields/ecs.yml", "/package/nozomi_networks/0.4.0/data_stream/node/fields/fields.yml", "/package/nozomi_networks/0.4.0/data_stream/node_cve/fields/base-fields.yml", "/package/nozomi_networks/0.4.0/data_stream/node_cve/fields/beats.yml", "/package/nozomi_networks/0.4.0/data_stream/node_cve/fields/ecs.yml", "/package/nozomi_networks/0.4.0/data_stream/node_cve/fields/fields.yml", "/package/nozomi_networks/0.4.0/data_stream/node_cve/fields/vulnerability.yml", "/package/nozomi_networks/0.4.0/data_stream/session/fields/base-fields.yml", "/package/nozomi_networks/0.4.0/data_stream/session/fields/beats.yml", "/package/nozomi_networks/0.4.0/data_stream/session/fields/ecs.yml", "/package/nozomi_networks/0.4.0/data_stream/session/fields/fields.yml", "/package/nozomi_networks/0.4.0/data_stream/variable/fields/base-fields.yml", "/package/nozomi_networks/0.4.0/data_stream/variable/fields/beats.yml", "/package/nozomi_networks/0.4.0/data_stream/variable/fields/ecs.yml", "/package/nozomi_networks/0.4.0/data_stream/variable/fields/fields.yml", "/package/nozomi_networks/0.4.0/data_stream/alert/agent/stream/cel.yml.hbs", "/package/nozomi_networks/0.4.0/data_stream/alert/elasticsearch/ingest_pipeline/default.yml", "/package/nozomi_networks/0.4.0/data_stream/asset/agent/stream/cel.yml.hbs", "/package/nozomi_networks/0.4.0/data_stream/asset/elasticsearch/ingest_pipeline/default.yml", "/package/nozomi_networks/0.4.0/data_stream/audit/agent/stream/cel.yml.hbs", "/package/nozomi_networks/0.4.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml", "/package/nozomi_networks/0.4.0/data_stream/health/agent/stream/cel.yml.hbs", "/package/nozomi_networks/0.4.0/data_stream/health/elasticsearch/ingest_pipeline/default.yml", "/package/nozomi_networks/0.4.0/data_stream/node/agent/stream/cel.yml.hbs", "/package/nozomi_networks/0.4.0/data_stream/node/elasticsearch/ingest_pipeline/default.yml", "/package/nozomi_networks/0.4.0/data_stream/node_cve/agent/stream/cel.yml.hbs", "/package/nozomi_networks/0.4.0/data_stream/node_cve/elasticsearch/ingest_pipeline/default.yml", "/package/nozomi_networks/0.4.0/data_stream/session/agent/stream/cel.yml.hbs", "/package/nozomi_networks/0.4.0/data_stream/session/elasticsearch/ingest_pipeline/default.yml", "/package/nozomi_networks/0.4.0/data_stream/variable/agent/stream/cel.yml.hbs", "/package/nozomi_networks/0.4.0/data_stream/variable/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "nozomi_networks", "title": "Nozomi Networks", "description": "Collect logs from Nozomi Networks.", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the Nozomi Networks API.", "multi": false, "required": true, "show_user": true }, { "name": "username", "type": "text", "title": "Username", "description": "Username of the Nozomi Networks API.", "multi": false, "required": true, "show_user": true }, { "name": "password", "type": "password", "title": "Password", "description": "Password of the Nozomi Networks API.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL config for host. i.e. certificate_authorities, supported_protocols, verification_mode etc.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Nozomi Networks logs via API", "description": "Collecting Nozomi Networks logs via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "nozomi_networks.alert", "title": "Collect Alert logs from Nozomi Networks", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Alert logs from Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "30m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Nozomi Networks API.", "multi": false, "required": true, "show_user": false, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve nozomi_networks.alert fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "nozomi_networks-alert" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Alert logs", "description": "Collect Alert logs from Nozomi Networks.", "enabled": true, "ingestion_method": "API" } ], "package": "nozomi_networks", "path": "alert" }, { "type": "logs", "dataset": "nozomi_networks.asset", "title": "Collect Asset logs from Nozomi Networks", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Asset logs from Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "60m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Nozomi Networks API.", "multi": false, "required": true, "show_user": false, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve nozomi_networks.asset fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "nozomi_networks-asset" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Asset logs", "description": "Collect Asset logs from Nozomi Networks.", "enabled": true, "ingestion_method": "API" } ], "package": "nozomi_networks", "path": "asset" }, { "type": "logs", "dataset": "nozomi_networks.audit", "title": "Collect Audit logs from Nozomi Networks", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Audit logs from Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "60m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Nozomi Networks API.", "multi": false, "required": true, "show_user": false, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve nozomi_networks.audit fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "nozomi_networks-audit" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Audit logs", "description": "Collect Audit logs from Nozomi Networks.", "enabled": true, "ingestion_method": "API" } ], "package": "nozomi_networks", "path": "audit" }, { "type": "logs", "dataset": "nozomi_networks.health", "title": "Collect Health logs from Nozomi Networks", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Health logs from Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "60m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Nozomi Networks API.", "multi": false, "required": true, "show_user": false, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve nozomi_networks.health fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "nozomi_networks-health" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Health logs", "description": "Collect Health logs from Nozomi Networks.", "enabled": true, "ingestion_method": "API" } ], "package": "nozomi_networks", "path": "health" }, { "type": "logs", "dataset": "nozomi_networks.node", "title": "Collect Node logs from Nozomi Networks", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Node logs from Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "30m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Nozomi Networks API.", "multi": false, "required": true, "show_user": false, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve nozomi_networks.node fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "nozomi_networks-node" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Node logs", "description": "Collect Node logs from Nozomi Networks.", "enabled": true, "ingestion_method": "API" } ], "package": "nozomi_networks", "path": "node" }, { "type": "logs", "dataset": "nozomi_networks.node_cve", "title": "Collect Node CVE logs from Nozomi Networks", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Node CVE logs from Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "30m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Nozomi Networks API.", "multi": false, "required": true, "show_user": false, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve nozomi_networks.node_cve fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "nozomi_networks-node_cve" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Node CVE logs", "description": "Collect Node CVE logs from Nozomi Networks.", "enabled": true, "ingestion_method": "API" } ], "package": "nozomi_networks", "path": "node_cve" }, { "type": "logs", "dataset": "nozomi_networks.session", "title": "Collect Session logs from Nozomi Networks", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Session logs from Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "60m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Nozomi Networks API.", "multi": false, "required": true, "show_user": false, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve nozomi_networks.session fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "nozomi_networks-session" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Session logs", "description": "Collect Session logs from Nozomi Networks.", "enabled": true, "ingestion_method": "API" } ], "package": "nozomi_networks", "path": "session" }, { "type": "logs", "dataset": "nozomi_networks.variable", "title": "Collect Variable logs from Nozomi Networks", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Variable logs from Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Nozomi Networks API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "60m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Nozomi Networks API.", "multi": false, "required": true, "show_user": false, "default": 500 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve nozomi_networks.variable fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "nozomi_networks-variable" ] }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Variable logs", "description": "Collect Variable logs from Nozomi Networks.", "enabled": true, "ingestion_method": "API" } ], "package": "nozomi_networks", "path": "variable" } ] }