{ "name": "ti_mandiant_advantage", "title": "Mandiant Advantage", "version": "1.11.1", "release": "ga", "source": { "license": "Elastic-2.0" }, "description": "Collect Threat Intelligence from products within the Mandiant Advantage platform.", "type": "integration", "download": "/epr/ti_mandiant_advantage/ti_mandiant_advantage-1.11.1.zip", "path": "/package/ti_mandiant_advantage/1.11.1", "icons": [ { "src": "/img/mandiant-logo.svg", "path": "/package/ti_mandiant_advantage/1.11.1/img/mandiant-logo.svg", "title": "Mandiant logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.4 || ~9.0.7 || ^9.1.4" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "partner", "github": "elastic/security-service-integrations" }, "categories": [ "threat_intel", "security" ], "signature_path": "/epr/ti_mandiant_advantage/ti_mandiant_advantage-1.11.1.zip.sig", "format_version": "3.3.2", "readme": "/package/ti_mandiant_advantage/1.11.1/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/ti_mandiant_dashboard.png", "path": "/package/ti_mandiant_advantage/1.11.1/img/ti_mandiant_dashboard.png", "title": "Threat Intelligence Overview Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/ti_mandiant_indicators.png", "path": "/package/ti_mandiant_advantage/1.11.1/img/ti_mandiant_indicators.png", "title": "Threat Intelligence Indicators built-in dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/ti_mandiant_alert.png", "path": "/package/ti_mandiant_advantage/1.11.1/img/ti_mandiant_alert.png", "title": "Sample Alert being enriched with Indicator data", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/ti_mandiant_advantage/1.11.1/LICENSE.txt", "/package/ti_mandiant_advantage/1.11.1/changelog.yml", "/package/ti_mandiant_advantage/1.11.1/manifest.yml", "/package/ti_mandiant_advantage/1.11.1/docs/README.md", "/package/ti_mandiant_advantage/1.11.1/img/mandiant-logo.svg", "/package/ti_mandiant_advantage/1.11.1/img/ti_mandiant_alert.png", "/package/ti_mandiant_advantage/1.11.1/img/ti_mandiant_dashboard.png", "/package/ti_mandiant_advantage/1.11.1/img/ti_mandiant_indicators.png", "/package/ti_mandiant_advantage/1.11.1/data_stream/threat_intelligence/manifest.yml", "/package/ti_mandiant_advantage/1.11.1/data_stream/threat_intelligence/sample_event.json", "/package/ti_mandiant_advantage/1.11.1/kibana/dashboard/ti_mandiant_advantage-6c148130-314d-11ee-a289-f15ecff976b0.json", "/package/ti_mandiant_advantage/1.11.1/kibana/tag/ti_mandiant_advantage-3034d2e0-0a25-11ee-8156-4b7067bf551f.json", "/package/ti_mandiant_advantage/1.11.1/data_stream/threat_intelligence/fields/agent.yml", "/package/ti_mandiant_advantage/1.11.1/data_stream/threat_intelligence/fields/base-fields.yml", "/package/ti_mandiant_advantage/1.11.1/data_stream/threat_intelligence/fields/ecs.yml", "/package/ti_mandiant_advantage/1.11.1/data_stream/threat_intelligence/fields/fields.yml", "/package/ti_mandiant_advantage/1.11.1/data_stream/threat_intelligence/agent/stream/httpjson.yml.hbs", "/package/ti_mandiant_advantage/1.11.1/data_stream/threat_intelligence/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "ti_mandiant_advantage", "title": "Mandiant Advantage", "description": "Collect Threat Intelligence from products within the Mandiant Advantage platform.", "inputs": [ { "type": "httpjson", "vars": [ { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": true } ], "title": "Collect data from Mandiant Advantage products", "description": "Collect data from Mandiant Advantage products" } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "ti_mandiant_advantage.threat_intelligence", "title": "Mandiant Threat Intelligence", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "mati_api_key_id", "type": "text", "title": "Threat Intelligence API Key ID", "description": "Key ID for the Threat Intelligence API.", "multi": false, "required": true, "show_user": true }, { "name": "mati_api_key_secret", "type": "password", "title": "Threat Intelligence API Key Secret", "description": "Key Secret for the Threat Intelligence API.", "multi": false, "required": true, "show_user": true }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval at which the indicators will be pulled. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "The time in the past to start the collection of Indicator data from, based on an indicators last_update date. NOTE: Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "720h" }, { "name": "min_ic_score", "type": "text", "title": "Minimum IC-Score", "description": "Indicators that have an IC-Score greater than or equal to the given value will be collected. Indicators with any IC-Score will be collected if the value is set to 0.", "multi": false, "required": false, "show_user": true, "default": 80 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": false, "show_user": false, "default": [ "forwarded", "mandiant-threat-intelligence-indicator" ] }, { "name": "url", "type": "text", "title": "Threat Intelligence URL", "description": "Mandiant Threat Intelligence API Endpoint.", "multi": false, "required": true, "show_user": false, "default": "https://api.intelligence.mandiant.com" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "include_misp", "type": "bool", "title": "Include MISP fields", "description": "These fields show whether the indicator was found in MISP warning lists.", "multi": false, "required": true, "show_user": true, "default": true }, { "name": "include_reports", "type": "bool", "title": "Include releated reports", "description": "Mandiant Intel Reports.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "include_campaigns", "type": "bool", "title": "Include related campaigns", "description": "Threat Campaigns information from Mandiant.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Mandiant Threat Intelligence", "description": "Collect IOCs from Mandiant Threat Intelligence", "enabled": true, "ingestion_method": "API" } ], "package": "ti_mandiant_advantage", "path": "threat_intelligence" } ] }