{ "name": "servicenow", "title": "ServiceNow", "version": "2.0.1", "release": "ga", "description": "Collect logs from ServiceNow with Elastic Agent.", "type": "integration", "download": "/epr/servicenow/servicenow-2.0.1.zip", "path": "/package/servicenow/2.0.1", "icons": [ { "src": "/img/servicenow-logo.svg", "path": "/package/servicenow/2.0.1/img/servicenow-logo.svg", "title": "ServiceNow Logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.16.5 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/servicenow/servicenow-2.0.1.zip.sig", "format_version": "3.3.2", "readme": "/package/servicenow/2.0.1/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/servicenow-service_catalog-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-service_catalog-dashboard.png", "title": "Service Catalog Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/servicenow-services_and_cmn_location-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-services_and_cmn_location-dashboard.png", "title": "CMDB CI Services and CMN Location Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/servicenow-cmdb-ci-server-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-cmdb-ci-server-dashboard.png", "title": "CMDB CI Servers Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/servicenow-incident-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-incident-dashboard.png", "title": "Incident Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/servicenow-problem-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-problem-dashboard.png", "title": "Problem Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/servicenow-change_task_and_request-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-change_task_and_request-dashboard.png", "title": "Change Task and Request Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/servicenow-user_and_group-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-user_and_group-dashboard.png", "title": "User and Group Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/servicenow-knowledge-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-knowledge-dashboard.png", "title": "Knowledge Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/servicenow-alm_and_cmdb_ci_hardware_and_computer-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-alm_and_cmdb_ci_hardware_and_computer-dashboard.png", "title": "ALM and CMDB CI Hardware and Computer Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/servicenow-cmdb_ci_rel_and_db_instance_overview-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-cmdb_ci_rel_and_db_instance_overview-dashboard.png", "title": "CMDB CI, REL and DB Instance Overview Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/servicenow-business_application-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-business_application-dashboard.png", "title": "Business Application Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/servicenow-esx_and_hyper-v_server-dashboard.png", "path": "/package/servicenow/2.0.1/img/servicenow-esx_and_hyper-v_server-dashboard.png", "title": "ESX and Hyper-V Server Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/servicenow/2.0.1/LICENSE.txt", "/package/servicenow/2.0.1/changelog.yml", "/package/servicenow/2.0.1/manifest.yml", "/package/servicenow/2.0.1/validation.yml", "/package/servicenow/2.0.1/docs/README.md", "/package/servicenow/2.0.1/img/servicenow-alm_and_cmdb_ci_hardware_and_computer-dashboard.png", "/package/servicenow/2.0.1/img/servicenow-business_application-dashboard.png", "/package/servicenow/2.0.1/img/servicenow-change_task_and_request-dashboard.png", "/package/servicenow/2.0.1/img/servicenow-cmdb-ci-server-dashboard.png", "/package/servicenow/2.0.1/img/servicenow-cmdb_ci_rel_and_db_instance_overview-dashboard.png", "/package/servicenow/2.0.1/img/servicenow-esx_and_hyper-v_server-dashboard.png", "/package/servicenow/2.0.1/img/servicenow-incident-dashboard.png", "/package/servicenow/2.0.1/img/servicenow-knowledge-dashboard.png", "/package/servicenow/2.0.1/img/servicenow-logo.svg", "/package/servicenow/2.0.1/img/servicenow-problem-dashboard.png", "/package/servicenow/2.0.1/img/servicenow-service_catalog-dashboard.png", "/package/servicenow/2.0.1/img/servicenow-services_and_cmn_location-dashboard.png", "/package/servicenow/2.0.1/img/servicenow-user_and_group-dashboard.png", "/package/servicenow/2.0.1/kibana/tags.yml", "/package/servicenow/2.0.1/data_stream/event/manifest.yml", "/package/servicenow/2.0.1/data_stream/event/sample_event.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-014c13b4-59bc-4bfa-bcb2-fdc1828020bf.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-0305f883-12a8-4021-af73-fbe05e797c3f.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-22d413b7-ffb5-450f-b5f8-7dcd54fab22f.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-297414cc-3b65-40b1-b15b-e33cf676b3bf.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-488772bc-4ce5-48c6-9e8a-d948439dbf39.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-648308f9-ebdf-46fe-b6ce-b90dfcf2d1dd.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-b182c6a6-3b4e-413f-899d-dd255b1a3623.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-b4795d3e-8c8b-48b2-900e-edc89db4d336.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-d2eb3f0c-4ddb-4683-afab-2820d2616ca2.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-d8977587-d9b4-4487-b321-a8402da07d48.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-d929c3a1-7af8-428e-8357-8b2e8d3e3050.json", "/package/servicenow/2.0.1/kibana/dashboard/servicenow-e6093b0d-38a6-4b05-8354-4bbaef28b667.json", "/package/servicenow/2.0.1/kibana/search/servicenow-00004bce-eac2-46d4-bb4e-ce6849c50a36.json", "/package/servicenow/2.0.1/kibana/search/servicenow-01396f16-041b-4ec5-b104-d29fe68f09ad.json", "/package/servicenow/2.0.1/kibana/search/servicenow-046f04ce-7f31-4929-81fa-34561fb369f0.json", "/package/servicenow/2.0.1/kibana/search/servicenow-1c323098-190c-4592-aca5-dd9e64de540b.json", "/package/servicenow/2.0.1/kibana/search/servicenow-26f2b1af-7d7d-4578-b325-322ac4c783fa.json", "/package/servicenow/2.0.1/kibana/search/servicenow-44db573d-f3e6-4f59-b1a4-328040220991.json", "/package/servicenow/2.0.1/kibana/search/servicenow-722e7751-818d-41e2-b7ac-fcc90bb8241b.json", "/package/servicenow/2.0.1/kibana/search/servicenow-a5b0060e-4ace-4c9f-96e1-2d815bc9dd28.json", "/package/servicenow/2.0.1/kibana/search/servicenow-afa470f8-4e19-4fee-8b17-5649a7b0ae51.json", "/package/servicenow/2.0.1/kibana/search/servicenow-b9cc24b4-0cfe-458c-8645-23838623ca09.json", "/package/servicenow/2.0.1/kibana/search/servicenow-e28e5e66-d00d-4e2c-af2e-a09d0d261b05.json", "/package/servicenow/2.0.1/data_stream/event/fields/base-fields.yml", "/package/servicenow/2.0.1/data_stream/event/fields/beats.yml", "/package/servicenow/2.0.1/data_stream/event/fields/fields.yml", "/package/servicenow/2.0.1/data_stream/event/agent/stream/aws-s3.yml.hbs", "/package/servicenow/2.0.1/data_stream/event/agent/stream/cel.yml.hbs", "/package/servicenow/2.0.1/data_stream/event/elasticsearch/ingest_pipeline/default.yml", "/package/servicenow/2.0.1/data_stream/event/elasticsearch/ingest_pipeline/pipeline_alm_hardware.yml", "/package/servicenow/2.0.1/data_stream/event/elasticsearch/ingest_pipeline/pipeline_change_request.yml", "/package/servicenow/2.0.1/data_stream/event/elasticsearch/ingest_pipeline/pipeline_cmdb_ci_business_app.yml", "/package/servicenow/2.0.1/data_stream/event/elasticsearch/ingest_pipeline/pipeline_cmn_location.yml", "/package/servicenow/2.0.1/data_stream/event/elasticsearch/ingest_pipeline/pipeline_incident.yml", "/package/servicenow/2.0.1/data_stream/event/elasticsearch/ingest_pipeline/pipeline_kb_knowledge.yml", "/package/servicenow/2.0.1/data_stream/event/elasticsearch/ingest_pipeline/pipeline_problem.yml", "/package/servicenow/2.0.1/data_stream/event/elasticsearch/ingest_pipeline/pipeline_sc_req_item.yml", "/package/servicenow/2.0.1/data_stream/event/elasticsearch/ingest_pipeline/pipeline_sys_user.yml", "/package/servicenow/2.0.1/data_stream/event/elasticsearch/ingest_pipeline/pipeline_task_ci.yml" ], "policy_templates": [ { "name": "servicenow", "title": "ServiceNow logs", "description": "Collect ServiceNow logs.", "inputs": [ { "type": "cel", "title": "Collect ServiceNow tables via API", "description": "Collect tables from ServiceNow instance via API." }, { "type": "aws-s3", "title": "Collect ServiceNow tables via AWS S3 or AWS SQS", "description": "Collect tables from ServiceNow instance via AWS S3 or AWS SQS." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "servicenow.event", "title": "Event", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "url", "title": "URL", "description": "URL of ServiceNow instance. It should follow the given format, https://\\.service-now.com", "multi": false, "required": true, "show_user": true }, { "name": "username", "type": "text", "title": "Username", "description": "The username to be used with Basic Auth headers.", "multi": false, "required": false, "show_user": true }, { "name": "password", "type": "password", "title": "Password", "description": "The password to be used with Basic Auth headers.", "multi": false, "required": false, "show_user": true }, { "name": "client_id", "type": "text", "title": "Client ID", "description": "The client ID for OAuth2 authentication.", "multi": false, "required": false, "show_user": true }, { "name": "client_secret", "type": "password", "title": "Client Secret", "description": "The client secret for OAuth2 authentication.", "multi": false, "required": false, "show_user": true }, { "name": "token_url", "type": "text", "title": "OAuth2 Token URL", "description": "The OAuth2 token endpoint URL (e.g., https://instance.service-now.com/oauth2/token).", "multi": false, "required": false, "show_user": true }, { "name": "token_scopes", "type": "text", "title": "OAuth2 Scopes", "description": "OAuth2 scopes to request.", "multi": true, "required": false, "show_user": false }, { "name": "oauth_endpoint_params", "type": "yaml", "title": "OAuth2 Endpoint Params", "description": "Additional OAuth2 endpoint parameters as key-value pairs.", "multi": false, "required": false, "show_user": false }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the logs from ServiceNow API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the ServiceNow API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the ServiceNow API, with a maximum limit of 10,000.", "multi": false, "required": true, "show_user": true, "default": 10000 }, { "name": "table_name", "type": "text", "title": "Table Name", "description": "Name of the table from which to retrieve the records.", "multi": false, "required": true, "show_user": true }, { "name": "timestamp_field", "type": "text", "title": "Timestamp Field", "description": "Name of the timestamp field from the table to store inside cursor to retrieve tables after intervals.", "multi": false, "required": true, "show_user": true, "default": "sys_updated_on" }, { "name": "hide_sensitive", "type": "bool", "title": "Hide Sensitive Details", "description": "Hide sensitive user details such as phone number, street address etc.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "tz_offset", "type": "text", "title": "Time Zone Offset", "description": "By default, datetimes in the logs without a time zone will be interpreted as relative to the time zone configured in the host where the agent is running. If ingesting logs from a different time zone, use this field to set the time zone offset so that datetimes are correctly parsed. Acceptable time zone formats are: a canonical ID (e.g. \"Europe/Amsterdam\"), or an HH:mm differential (e.g. \"-05:00\") from UTC.", "multi": false, "required": true, "show_user": true, "default": "America/Los_Angeles" }, { "name": "date_format_preference", "type": "select", "title": "Date Format Preference", "description": "Choose the preferred date format for parsing ambiguous dates. This eliminates confusion between MM/dd/yyyy and dd/MM/yyyy formats and ensures consistent date interpretation.", "multi": false, "required": true, "show_user": true, "default": "ddMM" }, { "name": "query", "type": "text", "title": "Sysparm Query", "description": "Encoded query for filtering result sets with operators like `=`, `!=`, `^`, `^OR`, `LIKE`, `ORDERBY`, `ORDERBYDESC` (e.g. `active=true^ORDERBYname`). Note: Avoid using the timestamp field in the query, as it may affect pagination and cursor logic.", "multi": false, "required": false, "show_user": false }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "servicenow-event" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve servicenow.event fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "cel.yml.hbs", "title": "ServiceNow tables", "description": "Collect tables from ServiceNow.", "enabled": false, "ingestion_method": "API" }, { "input": "aws-s3", "vars": [ { "name": "collect_s3_logs", "type": "bool", "title": "Collect logs via S3 Bucket", "description": "To Collect logs via S3 bucket enable the toggle switch. By default, it will collect logs via SQS Queue.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "access_key_id", "type": "password", "title": "Access Key ID", "description": "First part of access key.", "multi": false, "required": false, "show_user": true }, { "name": "secret_access_key", "type": "password", "title": "Secret Access Key", "description": "Second part of access key.", "multi": false, "required": false, "show_user": true }, { "name": "session_token", "type": "password", "title": "Session Token", "description": "Required when using temporary security credentials.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_arn", "type": "text", "title": "[S3] Bucket ARN", "description": "ARN of the AWS S3 bucket that will be polled for list operation. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set an Access Point ARN. In case both configurations are added, this one takes precedence.", "multi": false, "required": false, "show_user": true }, { "name": "access_point_arn", "type": "text", "title": "[S3] Access Point ARN", "description": "ARN of the AWS S3 Access Point that will be polled for list operation. Mandatory if the \"Collect logs via S3 Bucket\" switch is on. It is a required parameter for collecting logs via the AWS S3 Bucket unless you set a Bucket ARN.", "multi": false, "required": false, "show_user": true }, { "name": "bucket_list_prefix", "type": "text", "title": "Bucket Prefix", "description": "Prefix to apply for the list request to the S3 bucket.", "multi": false, "required": false, "show_user": true }, { "name": "queue_url", "type": "text", "title": "[SQS] Queue URL", "description": "URL of the AWS SQS queue that messages will be received from. It is a required parameter for collecting logs via the AWS SQS.", "multi": false, "required": false, "show_user": true }, { "name": "interval", "type": "text", "title": "[S3] Interval", "description": "Time interval for polling listing of the S3 bucket. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "1m" }, { "name": "number_of_workers", "type": "integer", "title": "[S3] Number of Workers", "description": "Number of workers that will process the S3 objects listed.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "start_timestamp", "type": "text", "title": "[S3] Start Timestamp", "description": "If set, only read S3 objects with last modified timestamp newer than the given timestamp. Accepts a timestamp in `YYYY-MM-DDTHH:MM:SSZ` format. For example, \"2020-10-10T10:30:00Z\" (UTC) or \"2020-10-10T10:30:00Z+02:30\" (with zone offset).", "multi": false, "required": false, "show_user": false }, { "name": "ignore_older", "type": "text", "title": "[S3] Ignore Older Timespan", "description": "If set, ignore S3 objects whose Last-Modified time is before the ignore older timespan. Timespan is checked from the current time to S3 object's Last-Modified time. Accepts a duration like `48h`, `2h30m`.", "multi": false, "required": false, "show_user": false }, { "name": "visibility_timeout", "type": "text", "title": "[SQS] Visibility Timeout", "description": "The duration that the received messages are hidden from subsequent retrieve requests after being retrieved by a ReceiveMessage request. The maximum is 12 hours. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "300s" }, { "name": "api_timeout", "type": "text", "title": "[SQS] API Timeout", "description": "The maximum duration of AWS API can take. The maximum is half of the visibility timeout value. Supported units for this parameter are h/m/s.", "multi": false, "required": false, "show_user": true, "default": "120s" }, { "name": "region", "type": "text", "title": "[SQS] Region", "description": "The name of the AWS region of the end point. If this option is given it takes precedence over the region name obtained from the queue_url value. It is a required parameter for collecting logs via the AWS SQS.", "multi": false, "required": false, "show_user": true }, { "name": "max_number_of_messages", "type": "integer", "title": "[SQS] Maximum Concurrent SQS Messages", "description": "Deprecated in agent version 8.16.0, this parameter is ignored if present, use number_of_workers instead. The maximum number of SQS messages that can be inflight at any time.", "multi": false, "required": false, "show_user": true, "default": 5 }, { "name": "decode_parquet_enabled", "type": "bool", "title": "Parquet Codec", "description": "The parquet codec is used to decode parquet compressed data streams.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "decoding_parquet_batch_size", "type": "integer", "title": "Batch Size of Parquet Decoding", "description": "Number of records to read from the parquet stream at a time.", "multi": false, "required": false, "show_user": false, "default": 1 }, { "name": "decoding_parquet_process_parallel", "type": "bool", "title": "Process Parellel of Parquet Decoding", "description": "If set to true, functions which read multiple columns will read those columns in parallel from the parquet stream with a number of readers equal to the number of columns. See [Parquet Codec](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-aws-s3.html#attrib-decoding-parquet) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "table_name", "type": "text", "title": "Table Name", "description": "Name of the table from which to retrieve the records.", "multi": false, "required": true, "show_user": true }, { "name": "timestamp_field", "type": "text", "title": "Timestamp Field", "description": "Name of the timestamp field from the table to store inside cursor to retrieve tables after intervals.", "multi": false, "required": true, "show_user": true, "default": "sys_updated_on" }, { "name": "hide_sensitive", "type": "bool", "title": "Hide Sensitive Details", "description": "Hide sensitive user details such as phone number, street address etc.", "multi": false, "required": false, "show_user": false, "default": true }, { "name": "tz_offset", "type": "text", "title": "Time Zone Offset", "description": "By default, datetimes in the logs without a time zone will be interpreted as relative to the time zone configured in the host where the agent is running. If ingesting logs from a different time zone, use this field to set the time zone offset so that datetimes are correctly parsed. Acceptable time zone formats are: a canonical ID (e.g. \"Europe/Amsterdam\"), or an HH:mm differential (e.g. \"-05:00\") from UTC.", "multi": false, "required": true, "show_user": true, "default": "America/Los_Angeles" }, { "name": "date_format_preference", "type": "select", "title": "Date Format Preference", "description": "Choose the preferred date format for parsing ambiguous dates. This eliminates confusion between MM/dd/yyyy and dd/MM/yyyy formats and ensures consistent date interpretation.", "multi": false, "required": true, "show_user": true, "default": "ddMM" }, { "name": "data_has_display_values", "type": "bool", "title": "Data Has Only Display Values", "description": "By default, the data stored in S3 buckets should be either matching with API response schema, or scalar `value`s. But, if the data stored in S3 buckets contain scalars with human-readable `display_value`s, enable this option to parse the data accurately. For example, if this option is enabled, the raw data `\"install_status\":\"Installed\"` is converted to `\"install_status\":{\"display_value\":\"Installed\"}` by the pipeline. This option ensures field mappings and pipeline works as expected. This option should be only enabled if data in S3 cannot be matched with API's expected response. See integration's Troubleshooting section for more details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "shared_credential_file", "type": "text", "title": "Shared Credential File", "description": "Directory of the shared credentials file.", "multi": false, "required": false, "show_user": false }, { "name": "credential_profile_name", "type": "text", "title": "Credential Profile Name", "description": "Profile name in shared credentials file.", "multi": false, "required": false, "show_user": false }, { "name": "role_arn", "type": "text", "title": "Role ARN", "description": "AWS IAM Role to assume.", "multi": false, "required": false, "show_user": false }, { "name": "endpoint", "type": "text", "title": "Endpoint", "description": "URL of the entry point for an AWS web service.", "multi": false, "required": false, "show_user": false }, { "name": "fips_enabled", "type": "bool", "title": "Enable S3 FIPS", "description": "Enabling this option changes the service name from `s3` to `s3-fips` for connecting to the correct service endpoint.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "file_selectors", "type": "yaml", "title": "[SQS] File Selectors", "description": "If the SQS queue will have events that correspond to files that this integration shouldn't process, file_selectors can be used to limit the files that are downloaded. This is a list of selectors which are made up of regex and expand_event_list_from_field options. The regex should match the S3 object key in the SQS message, and the optional expand_event_list_from_field is the same as the global setting. If file_selectors is given, then any global expand_event_list_from_field value is ignored in favor of the ones specified in the file_selectors. Regexes use [RE2 syntax](https://pkg.go.dev/regexp/syntax). Files that don’t match one of the regexes will not be processed.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "servicenow-event" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve servicenow.event fields that were mapped to Elastic Common Schema (ECS) fields.", "multi": false, "required": true, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "template_path": "aws-s3.yml.hbs", "title": "ServiceNow tables", "description": "Collect tables from ServiceNow.", "enabled": false, "ingestion_method": "AWS S3" } ], "package": "servicenow", "path": "event" } ] }