{
  "name": "ti_maltiverse",
  "title": "Maltiverse",
  "version": "1.8.2",
  "release": "ga",
  "description": "Ingest threat intelligence indicators from Maltiverse feeds with Elastic Agent",
  "type": "integration",
  "download": "/epr/ti_maltiverse/ti_maltiverse-1.8.2.zip",
  "path": "/package/ti_maltiverse/1.8.2",
  "icons": [
    {
      "src": "/img/logo-maltiverse.svg",
      "path": "/package/ti_maltiverse/1.8.2/img/logo-maltiverse.svg",
      "title": "Maltiverse",
      "size": "678x566",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.19.2 || ^9.0.5"
    }
  },
  "owner": {
    "type": "partner",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "security",
    "threat_intel"
  ],
  "signature_path": "/epr/ti_maltiverse/ti_maltiverse-1.8.2.zip.sig",
  "format_version": "3.3.2",
  "readme": "/package/ti_maltiverse/1.8.2/docs/README.md",
  "license": "basic",
  "assets": [
    "/package/ti_maltiverse/1.8.2/LICENSE.txt",
    "/package/ti_maltiverse/1.8.2/changelog.yml",
    "/package/ti_maltiverse/1.8.2/manifest.yml",
    "/package/ti_maltiverse/1.8.2/validation.yml",
    "/package/ti_maltiverse/1.8.2/docs/README.md",
    "/package/ti_maltiverse/1.8.2/img/logo-maltiverse.svg",
    "/package/ti_maltiverse/1.8.2/kibana/tags.yml",
    "/package/ti_maltiverse/1.8.2/data_stream/indicator/lifecycle.yml",
    "/package/ti_maltiverse/1.8.2/data_stream/indicator/manifest.yml",
    "/package/ti_maltiverse/1.8.2/data_stream/indicator/sample_event.json",
    "/package/ti_maltiverse/1.8.2/data_stream/indicator/fields/base-fields.yml",
    "/package/ti_maltiverse/1.8.2/data_stream/indicator/fields/ecs.yml",
    "/package/ti_maltiverse/1.8.2/data_stream/indicator/fields/fields.yml",
    "/package/ti_maltiverse/1.8.2/data_stream/indicator/fields/is-ioc-transform-source-true.yml",
    "/package/ti_maltiverse/1.8.2/elasticsearch/transform/latest/manifest.yml",
    "/package/ti_maltiverse/1.8.2/elasticsearch/transform/latest/transform.yml",
    "/package/ti_maltiverse/1.8.2/data_stream/indicator/agent/stream/stream.yml.hbs",
    "/package/ti_maltiverse/1.8.2/data_stream/indicator/elasticsearch/ilm/default_policy.json",
    "/package/ti_maltiverse/1.8.2/data_stream/indicator/elasticsearch/ingest_pipeline/default.yml",
    "/package/ti_maltiverse/1.8.2/elasticsearch/transform/latest/fields/fields.yml",
    "/package/ti_maltiverse/1.8.2/elasticsearch/transform/latest/fields/is-ioc-transform-source-false.yml"
  ],
  "policy_templates": [
    {
      "name": "ti_maltiverse",
      "title": "Maltiverse",
      "description": "Ingest threat intelligence indicators from Maltiverse feeds with Elastic Agent",
      "inputs": [
        {
          "type": "httpjson",
          "title": "Collect threat intelligence feeds from Maltiverse API.",
          "description": "Use Maltiverse API to fetch a feed"
        }
      ],
      "multiple": true,
      "deployment_modes": {
        "default": {
          "enabled": true
        },
        "agentless": {
          "enabled": true,
          "release": "ga"
        }
      }
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "ti_maltiverse.indicator",
      "ilm_policy": "logs-ti_maltiverse.indicator-default_policy",
      "title": "Maltiverse indicator",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "httpjson",
          "vars": [
            {
              "name": "api_token",
              "type": "password",
              "title": "API Token",
              "description": "Maltiverse API Token",
              "multi": false,
              "required": true,
              "show_user": false
            },
            {
              "name": "feed",
              "type": "text",
              "title": "Feed",
              "description": "Maltiverse feed to integrate. For example: VdhZV34B4jHUXfKt_gDi",
              "multi": false,
              "required": true,
              "show_user": false
            },
            {
              "name": "interval",
              "type": "text",
              "title": "Interval",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "60m"
            },
            {
              "name": "api_hostname",
              "type": "text",
              "title": "API Hostname",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "https://api.maltiverse.com"
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "forwarded",
                "ti_maltiverse-indicator"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "stream.yml.hbs",
          "title": "Maltiverse indicator feed",
          "description": "Fetches thread intelligence feeds from Maltiverse API",
          "enabled": true,
          "ingestion_method": "API"
        }
      ],
      "package": "ti_maltiverse",
      "path": "indicator"
    }
  ]
}