{ "name": "ti_cybersixgill", "title": "Cybersixgill", "version": "1.36.2", "release": "ga", "description": "Ingest threat intelligence indicators from Cybersixgill with Elastic Agent.", "type": "integration", "download": "/epr/ti_cybersixgill/ti_cybersixgill-1.36.2.zip", "path": "/package/ti_cybersixgill/1.36.2", "icons": [ { "src": "/img/cybersixgill.svg", "path": "/package/ti_cybersixgill/1.36.2/img/cybersixgill.svg", "title": "Cybersixgill", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.2 || ^9.0.5" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "threat_intel" ], "signature_path": "/epr/ti_cybersixgill/ti_cybersixgill-1.36.2.zip.sig", "format_version": "3.3.2", "readme": "/package/ti_cybersixgill/1.36.2/docs/README.md", "license": "basic", "assets": [ "/package/ti_cybersixgill/1.36.2/LICENSE.txt", "/package/ti_cybersixgill/1.36.2/changelog.yml", "/package/ti_cybersixgill/1.36.2/manifest.yml", "/package/ti_cybersixgill/1.36.2/validation.yml", "/package/ti_cybersixgill/1.36.2/docs/README.md", "/package/ti_cybersixgill/1.36.2/img/cybersixgill.svg", "/package/ti_cybersixgill/1.36.2/kibana/tags.yml", "/package/ti_cybersixgill/1.36.2/data_stream/threat/lifecycle.yml", "/package/ti_cybersixgill/1.36.2/data_stream/threat/manifest.yml", "/package/ti_cybersixgill/1.36.2/data_stream/threat/sample_event.json", "/package/ti_cybersixgill/1.36.2/kibana/dashboard/ti_cybersixgill-63c9fee0-5bea-11ec-9302-152fd766c738.json", "/package/ti_cybersixgill/1.36.2/kibana/dashboard/ti_cybersixgill-717013b0-5bed-11ec-9302-152fd766c738.json", "/package/ti_cybersixgill/1.36.2/kibana/dashboard/ti_cybersixgill-c75353f0-5be8-11ec-9302-152fd766c738.json", "/package/ti_cybersixgill/1.36.2/kibana/tag/ti_cybersixgill-7186bf10-5be4-11ec-9302-152fd766c738.json", "/package/ti_cybersixgill/1.36.2/data_stream/threat/fields/agent.yml", "/package/ti_cybersixgill/1.36.2/data_stream/threat/fields/base-fields.yml", "/package/ti_cybersixgill/1.36.2/data_stream/threat/fields/ecs.yml", "/package/ti_cybersixgill/1.36.2/data_stream/threat/fields/fields.yml", "/package/ti_cybersixgill/1.36.2/data_stream/threat/fields/is-ioc-transform-source-true.yml", "/package/ti_cybersixgill/1.36.2/elasticsearch/transform/latest_ioc/manifest.yml", "/package/ti_cybersixgill/1.36.2/elasticsearch/transform/latest_ioc/transform.yml", "/package/ti_cybersixgill/1.36.2/data_stream/threat/agent/stream/httpjson.yml.hbs", "/package/ti_cybersixgill/1.36.2/data_stream/threat/elasticsearch/ilm/default_policy.json", "/package/ti_cybersixgill/1.36.2/data_stream/threat/elasticsearch/ingest_pipeline/default.yml", "/package/ti_cybersixgill/1.36.2/elasticsearch/transform/latest_ioc/fields/agent.yml", "/package/ti_cybersixgill/1.36.2/elasticsearch/transform/latest_ioc/fields/base-fields.yml", "/package/ti_cybersixgill/1.36.2/elasticsearch/transform/latest_ioc/fields/ecs.yml", "/package/ti_cybersixgill/1.36.2/elasticsearch/transform/latest_ioc/fields/fields.yml", "/package/ti_cybersixgill/1.36.2/elasticsearch/transform/latest_ioc/fields/is-ioc-transform-source-false.yml" ], "policy_templates": [ { "name": "cybersixgill", "title": "Cybersixgill Threat Intel", "description": "Ingest threat intelligence indicators from Cybersixgill with Elastic Agent.", "inputs": [ { "type": "httpjson", "title": "Ingest threat intelligence indicators from Cybersixgill Darkfeed with Elastic Agent.", "description": "Ingest threat intelligence indicators from Cybersixgill Darkfeed with Elastic Agent." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "ti_cybersixgill.threat", "ilm_policy": "logs-ti_cybersixgill.threat-default_policy", "title": "Cybersixgill Darkfeed Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "username", "type": "text", "title": "Cybersixgill Darkfeed Client ID", "multi": false, "required": true, "show_user": true }, { "name": "password", "type": "password", "title": "Cybersixgill Darkfeed Client Secret", "multi": false, "required": true, "show_user": true }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false }, { "name": "url", "type": "text", "title": "Cybersixgill Darkfeed URL", "multi": false, "required": true, "show_user": false, "default": "https://api.cybersixgill.com/taxii/sixgill-taxii/collections/102/objects" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": false, "default": "30s" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "ioc_expiration_duration", "type": "text", "title": "IOC Expiration Duration", "description": "Enforces all IOCs to expire after this duration since their creation time indicated in the feed. Use [Elasticsearch time units](https://www.elastic.co/guide/en/elasticsearch/reference/current/api-conventions.html#time-units) in days, hours, or minutes (e.g 10d)", "multi": false, "required": true, "show_user": true, "default": "90d" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval at which the logs will be pulled. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "10m" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to look for indicators the first time the agent is started. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": false, "default": "2160h" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "ti_cybersixgill" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Cybersixgill Darkfeed Logs", "description": "Collect Cybersixgill Darkfeed Logs", "enabled": true, "ingestion_method": "API" } ], "package": "ti_cybersixgill", "path": "threat" } ] }