{
  "name": "ti_domaintools",
  "title": "DomainTools Real Time Unified Feeds",
  "version": "0.3.0",
  "release": "beta",
  "source": {
    "license": "Elastic-2.0"
  },
  "description": "The DomainTools NOD Feed provides real-time access to newly registered and observed domains, enabling proactive threat detection and defense.",
  "type": "integration",
  "download": "/epr/ti_domaintools/ti_domaintools-0.3.0.zip",
  "path": "/package/ti_domaintools/0.3.0",
  "icons": [
    {
      "src": "/img/logo.png",
      "path": "/package/ti_domaintools/0.3.0/img/logo.png",
      "title": "DomainTools logo",
      "size": "250x250",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.15.3 || ^9.0.0"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "partner",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "security",
    "threat_intel"
  ],
  "signature_path": "/epr/ti_domaintools/ti_domaintools-0.3.0.zip.sig",
  "format_version": "3.3.0",
  "readme": "/package/ti_domaintools/0.3.0/docs/README.md",
  "license": "basic",
  "assets": [
    "/package/ti_domaintools/0.3.0/LICENSE.txt",
    "/package/ti_domaintools/0.3.0/changelog.yml",
    "/package/ti_domaintools/0.3.0/manifest.yml",
    "/package/ti_domaintools/0.3.0/docs/README.md",
    "/package/ti_domaintools/0.3.0/img/logo.png",
    "/package/ti_domaintools/0.3.0/data_stream/nod_feed/lifecycle.yml",
    "/package/ti_domaintools/0.3.0/data_stream/nod_feed/manifest.yml",
    "/package/ti_domaintools/0.3.0/data_stream/nod_feed/sample_event.json",
    "/package/ti_domaintools/0.3.0/data_stream/nod_feed/fields/base-fields.yml",
    "/package/ti_domaintools/0.3.0/data_stream/nod_feed/fields/fields.yml",
    "/package/ti_domaintools/0.3.0/data_stream/nod_feed/fields/is-ioc-transform-source-true.yml",
    "/package/ti_domaintools/0.3.0/elasticsearch/transform/latest_nod/manifest.yml",
    "/package/ti_domaintools/0.3.0/elasticsearch/transform/latest_nod/transform.yml",
    "/package/ti_domaintools/0.3.0/data_stream/nod_feed/agent/stream/cel.yml.hbs",
    "/package/ti_domaintools/0.3.0/data_stream/nod_feed/elasticsearch/ilm/default_policy.json",
    "/package/ti_domaintools/0.3.0/data_stream/nod_feed/elasticsearch/ingest_pipeline/default.yml",
    "/package/ti_domaintools/0.3.0/elasticsearch/transform/latest_nod/fields/base-fields.yml",
    "/package/ti_domaintools/0.3.0/elasticsearch/transform/latest_nod/fields/beats.yml",
    "/package/ti_domaintools/0.3.0/elasticsearch/transform/latest_nod/fields/ecs.yml",
    "/package/ti_domaintools/0.3.0/elasticsearch/transform/latest_nod/fields/fields.yml",
    "/package/ti_domaintools/0.3.0/elasticsearch/transform/latest_nod/fields/is-ioc-transform-source-false.yml"
  ],
  "policy_templates": [
    {
      "name": "domaintools",
      "title": "DomainTools Newly Observed Domains",
      "description": "DomainTools Newly Observed Domains provides real-time access to newly registered and observed domains, enabling proactive threat detection and defense",
      "inputs": [
        {
          "type": "cel",
          "title": "DomainTools Newly Observed Domains",
          "description": "DomainTools Newly Observed Domains provides real-time access to newly registered and observed domains, enabling proactive threat detection and defense"
        }
      ],
      "multiple": true
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "ti_domaintools.nod_feed",
      "ilm_policy": "logs-ti_domaintools.nod_feed-default_policy",
      "title": "DomainTools Real Time Unified Feeds",
      "release": "beta",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "cel",
          "vars": [
            {
              "name": "api_url",
              "type": "text",
              "title": "DomainTools API URL",
              "description": "The URL of the DomainTools API.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "https://api.domaintools.com/v1"
            },
            {
              "name": "interval",
              "type": "text",
              "title": "Interval",
              "description": "Interval at which the feed will be pulled. Supported units for this parameter are h/m/s.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10m"
            },
            {
              "name": "api_username",
              "type": "text",
              "title": "DomainTools API Username",
              "description": "DomainTools API Username",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "DomainTools API Username"
            },
            {
              "name": "api_key",
              "type": "password",
              "title": "DomainTools API Key",
              "description": "DomainTools API Key",
              "multi": false,
              "required": true,
              "show_user": true
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "cel.yml.hbs",
          "title": "DomainTools Real Time Unified Feeds",
          "description": "Subscribe to DomainTools Real Time Unified Feeds",
          "enabled": true,
          "ingestion_method": "API"
        }
      ],
      "package": "ti_domaintools",
      "path": "nod_feed"
    }
  ]
}