{ "name": "sailpoint_identity_sc", "title": "Sailpoint Identity Security Cloud", "version": "0.3.0", "release": "beta", "source": { "license": "Elastic-2.0" }, "description": "Sailpoint identity security cloud provides enterprise identity governance and security capabilities. The integration allows users to extract audit information from their identity security cloud tenant using the ISC's AuditEvent API.", "type": "integration", "download": "/epr/sailpoint_identity_sc/sailpoint_identity_sc-0.3.0.zip", "path": "/package/sailpoint_identity_sc/0.3.0", "icons": [ { "src": "/img/sics.svg", "path": "/package/sailpoint_identity_sc/0.3.0/img/sics.svg", "title": "Logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.16.1 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/sailpoint_identity_sc/sailpoint_identity_sc-0.3.0.zip.sig", "format_version": "3.3.0", "readme": "/package/sailpoint_identity_sc/0.3.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/dashboard.png", "path": "/package/sailpoint_identity_sc/0.3.0/img/dashboard.png", "title": "Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/sailpoint_identity_sc/0.3.0/LICENSE.txt", "/package/sailpoint_identity_sc/0.3.0/changelog.yml", "/package/sailpoint_identity_sc/0.3.0/manifest.yml", "/package/sailpoint_identity_sc/0.3.0/docs/README.md", "/package/sailpoint_identity_sc/0.3.0/img/dashboard.png", "/package/sailpoint_identity_sc/0.3.0/img/sics.svg", "/package/sailpoint_identity_sc/0.3.0/data_stream/events/manifest.yml", "/package/sailpoint_identity_sc/0.3.0/data_stream/events/sample_event.json", "/package/sailpoint_identity_sc/0.3.0/kibana/dashboard/sailpoint_identity_sc-7b41587a-7abc-44f3-901e-1501ef78520e.json", "/package/sailpoint_identity_sc/0.3.0/data_stream/events/fields/base-fields.yml", "/package/sailpoint_identity_sc/0.3.0/data_stream/events/fields/event-fields.yml", "/package/sailpoint_identity_sc/0.3.0/data_stream/events/agent/stream/cel.yml.hbs", "/package/sailpoint_identity_sc/0.3.0/data_stream/events/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "sailpoint_identity_sc", "title": "Sailpoint identity security cloud events", "description": "Collect events from Sailpoint identity security cloud event reporting.", "inputs": [ { "type": "cel", "vars": [ { "name": "api_host", "type": "text", "title": "Base URL of the Sailpoint identity security cloud Host API", "description": "Enter the URL of the Sailpoint identity security cloud host API server, e.g., https://{tenant}.api.identitynow-demo.com/", "multi": false, "required": true, "show_user": true }, { "name": "client_id", "type": "text", "title": "Client ID for Sailpoint identity security cloud", "description": "Enter the client ID created on Sailpoint identity security cloud.", "multi": false, "required": true, "show_user": true }, { "name": "client_secret", "type": "text", "title": "Client Secret for Sailpoint identity security cloud Events API Server", "description": "Enter the Client Secret obtained from Sailpoint identity security cloud.", "multi": false, "required": true, "show_user": true }, { "name": "token_scopes", "type": "text", "title": "Token Scopes", "description": "Scopes for OAuth2 token.", "multi": true, "required": true, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable Request Tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Specifies the duration to wait before declaring a timeout. Valid units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "Enter the URL for proxy connections in the format: http[s]://:@:.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false } ], "title": "Collect Events from Sailpoint identity security cloud Events API", "description": "Extract all events from Sailpoint identity security cloud via the API." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "sailpoint_identity_sc.events", "title": "Events", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Data for all managed accounts will be re-fetched at this interval.", "multi": false, "required": true, "show_user": false, "default": "60s" }, { "name": "limit", "type": "integer", "title": "Limit", "description": "Specifies the number of events to fetch per request.", "multi": false, "required": true, "show_user": true, "default": 250 }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "Initial delay before the first data fetch.", "multi": false, "required": true, "show_user": false, "default": "2160h" }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags to be applied to events, such as 'forwarded' or 'Sailpoint Identity Security Cloud Event'.", "multi": true, "required": false, "show_user": false, "default": [ "forwarded", "sailpoint_identity_sc.events" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve Original Event", "description": "When enabled, keeps a raw copy of the original event in the `event.original` field.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors can alter the events by reducing the number of fields or adding additional metadata. This is performed in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Sailpoint Identity Security Cloud Events", "description": "Request settings for Sailpoint Identity Security Cloud.", "enabled": true, "ingestion_method": "API" } ], "package": "sailpoint_identity_sc", "path": "events" } ] }