{ "name": "sysdig", "title": "Sysdig", "version": "0.5.0", "release": "beta", "description": "Collect logs from Sysdig using Elastic Agent.", "type": "integration", "download": "/epr/sysdig/sysdig-0.5.0.zip", "path": "/package/sysdig/0.5.0", "icons": [ { "src": "/img/sysdig-logo-badge.svg", "path": "/package/sysdig/0.5.0/img/sysdig-logo-badge.svg", "title": "Sysdig logo", "size": "88x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.14.1 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "containers", "kubernetes", "monitoring", "security" ], "signature_path": "/epr/sysdig/sysdig-0.5.0.zip.sig", "format_version": "3.2.1", "readme": "/package/sysdig/0.5.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/sysdig-security-events-screenshot.png", "path": "/package/sysdig/0.5.0/img/sysdig-security-events-screenshot.png", "title": "Sysdig Security Events dashboard screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/sysdig-events-screenshot.png", "path": "/package/sysdig/0.5.0/img/sysdig-events-screenshot.png", "title": "Sysdig Events dashboard screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/sysdig/0.5.0/LICENSE.txt", "/package/sysdig/0.5.0/changelog.yml", "/package/sysdig/0.5.0/manifest.yml", "/package/sysdig/0.5.0/validation.yml", "/package/sysdig/0.5.0/docs/README.md", "/package/sysdig/0.5.0/img/sysdig-events-screenshot.png", "/package/sysdig/0.5.0/img/sysdig-logo-badge.svg", "/package/sysdig/0.5.0/img/sysdig-security-events-screenshot.png", "/package/sysdig/0.5.0/data_stream/alerts/manifest.yml", "/package/sysdig/0.5.0/data_stream/alerts/sample_event.json", "/package/sysdig/0.5.0/data_stream/event/manifest.yml", "/package/sysdig/0.5.0/data_stream/event/sample_event.json", "/package/sysdig/0.5.0/kibana/dashboard/sysdig-d0ac6062-d4da-4f63-948d-4aea617909bf.json", "/package/sysdig/0.5.0/kibana/dashboard/sysdig-fae0ccf1-e806-4876-a7fa-7258b094b15b.json", "/package/sysdig/0.5.0/kibana/search/sysdig-81a3c734-23e4-4acb-83dd-ae05dd98536c.json", "/package/sysdig/0.5.0/kibana/search/sysdig-de7b4ea8-76b6-43ba-97ee-6fb519bd610b.json", "/package/sysdig/0.5.0/data_stream/alerts/fields/base-fields.yml", "/package/sysdig/0.5.0/data_stream/alerts/fields/fields.yml", "/package/sysdig/0.5.0/data_stream/event/fields/base-fields.yml", "/package/sysdig/0.5.0/data_stream/event/fields/beats.yml", "/package/sysdig/0.5.0/data_stream/event/fields/fields.yml", "/package/sysdig/0.5.0/data_stream/alerts/agent/stream/http.yml.hbs", "/package/sysdig/0.5.0/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml", "/package/sysdig/0.5.0/data_stream/event/agent/stream/cel.yml.hbs", "/package/sysdig/0.5.0/data_stream/event/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "sysdig", "title": "Sysdig logs", "description": "Collect logs from Sysdig using Elastic Agent.", "inputs": [ { "type": "http_endpoint", "title": "Collect Sysdig Alerts via HTTP", "description": "Collect Sysdig Alerts via HTTP input" }, { "type": "cel", "vars": [ { "name": "url", "type": "url", "title": "URL", "description": "Sysdig API URL varies by region. To determine the correct URL for your region, refer to the [documentation](https://docs.sysdig.com/en/developer-tools/sysdig-api/#access-the-sysdig-api-using-the-regional-endpoints).", "multi": false, "required": true, "show_user": true }, { "name": "api_token", "type": "password", "title": "API Token", "description": "The API Token required for authentication.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Sysdig logs via API", "description": "Collecting Sysdig logs via API." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "sysdig.alerts", "title": "Sysdig", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "http_endpoint", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "Bind address for the HTTP listener. Use 0.0.0.0 to listen on all interfaces.\n", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "listen_port", "type": "text", "title": "Listen port", "description": "Bind port for the listener.\n", "multi": false, "required": true, "show_user": true, "default": 9035 }, { "name": "url", "type": "text", "title": "URL", "description": "This options specific which URL path to accept requests on. Defaults to /.", "multi": false, "required": false, "show_user": true }, { "name": "secret_header", "type": "text", "title": "Secret Header", "description": "The header to check for a specific value specified by `secret.value`.", "multi": false, "required": false, "show_user": false }, { "name": "secret_value", "type": "password", "title": "Secret Value", "description": "The secret stored in the header name specified by `secret.header`.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "# enabled: false\n# certificate: \"/etc/pki/client/cert.pem\"\n# key: \"/etc/pki/client/cert.key\"\n" }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve Original Event", "description": "This option copies the raw unmodified body of the incoming request to the event.original field as a string before sending the event to Elasticsearch.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags to include in the published event", "multi": true, "required": false, "show_user": true, "default": [ "forwarded", "sysdig-alerts" ] }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "http.yml.hbs", "title": "HTTP input", "description": "Collect Sysdig Alerts over an HTTP Webhook", "enabled": false, "ingestion_method": "Webhook" } ], "package": "sysdig", "path": "alerts" }, { "type": "logs", "dataset": "sysdig.event", "title": "Security Event", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the security events from Sysdig API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Sysdig API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Sysdig API. The maximum supported page size value is 200.", "multi": false, "required": true, "show_user": false, "default": 200 }, { "name": "max_executions", "type": "integer", "title": "Maximum Pages Per Interval", "description": "Maximum Pages Per Interval is the maximum number of pages that can be collected at each interval.", "multi": false, "required": false, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "sysdig-event" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve sysdig.event fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Security Event", "description": "Collecting security events via API.", "enabled": false, "ingestion_method": "API" } ], "package": "sysdig", "path": "event" } ] }