{ "name": "ti_ticura", "title": "Ticura", "version": "0.1.0", "release": "beta", "description": "Ingest threat intelligence indicators from Ticura curated feeds.", "type": "integration", "download": "/epr/ti_ticura/ti_ticura-0.1.0.zip", "path": "/package/ti_ticura/0.1.0", "icons": [ { "src": "/img/logo.svg", "path": "/package/ti_ticura/0.1.0/img/logo.svg", "title": "Ticura logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.0 || ^9.0.0" }, "elastic": { "subscription": "basic", "capabilities": [ "security" ] } }, "owner": { "type": "partner", "github": "elastic/security-service-integrations" }, "categories": [ "security", "threat_intel" ], "signature_path": "/epr/ti_ticura/ti_ticura-0.1.0.zip.sig", "format_version": "3.4.0", "readme": "/package/ti_ticura/0.1.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/homepage.png", "path": "/package/ti_ticura/0.1.0/img/homepage.png", "title": "Ticura Threat Intelligence", "size": "1920x1024", "type": "image/png" }, { "src": "/img/overview.png", "path": "/package/ti_ticura/0.1.0/img/overview.png", "title": "Ticura Threat Intelligence overview dashboard", "size": "1920x1024", "type": "image/png" }, { "src": "/img/triage.png", "path": "/package/ti_ticura/0.1.0/img/triage.png", "title": "Ticura Threat Intelligence triage dashboard", "size": "1920x1024", "type": "image/png" }, { "src": "/img/trend.png", "path": "/package/ti_ticura/0.1.0/img/trend.png", "title": "Ticura Threat Intelligence trends dashboard", "size": "1920x1024", "type": "image/png" } ], "assets": [ "/package/ti_ticura/0.1.0/LICENSE.txt", "/package/ti_ticura/0.1.0/changelog.yml", "/package/ti_ticura/0.1.0/manifest.yml", "/package/ti_ticura/0.1.0/validation.yml", "/package/ti_ticura/0.1.0/docs/README.md", "/package/ti_ticura/0.1.0/img/homepage.png", "/package/ti_ticura/0.1.0/img/logo.svg", "/package/ti_ticura/0.1.0/img/overview.png", "/package/ti_ticura/0.1.0/img/trend.png", "/package/ti_ticura/0.1.0/img/triage.png", "/package/ti_ticura/0.1.0/data_stream/indicator/manifest.yml", "/package/ti_ticura/0.1.0/data_stream/indicator/sample_event.json", "/package/ti_ticura/0.1.0/kibana/dashboard/ti_ticura-cbe5bb92-2344-4506-a03b-3f4101e0952e.json", "/package/ti_ticura/0.1.0/kibana/dashboard/ti_ticura-trends-105f75be-f90e-4ca6-8d21-ee42bdc7b7f5.json", "/package/ti_ticura/0.1.0/kibana/dashboard/ti_ticura-triage-822b1516-7c47-427d-af3d-b78fbb76ff09.json", "/package/ti_ticura/0.1.0/kibana/map/ti_ticura-world-indicator-clusters.json", "/package/ti_ticura/0.1.0/kibana/search/ti_ticura-search-active-c2.json", "/package/ti_ticura/0.1.0/kibana/search/ti_ticura-search-critical-eu.json", "/package/ti_ticura/0.1.0/kibana/search/ti_ticura-search-expiring-soon.json", "/package/ti_ticura/0.1.0/kibana/search/ti_ticura-search-high-risk-today.json", "/package/ti_ticura/0.1.0/kibana/search/ti_ticura-search-inbound-only.json", "/package/ti_ticura/0.1.0/kibana/search/ti_ticura-search-malware-hashes.json", "/package/ti_ticura/0.1.0/kibana/search/ti_ticura-search-mitre-mapped.json", "/package/ti_ticura/0.1.0/kibana/search/ti_ticura-search-phishing-urls.json", "/package/ti_ticura/0.1.0/kibana/search/ti_ticura-search-recently-added.json", "/package/ti_ticura/0.1.0/data_stream/indicator/fields/base-fields.yml", "/package/ti_ticura/0.1.0/data_stream/indicator/fields/beats.yml", "/package/ti_ticura/0.1.0/data_stream/indicator/fields/fields.yml", "/package/ti_ticura/0.1.0/elasticsearch/transform/latest_indicator/manifest.yml", "/package/ti_ticura/0.1.0/elasticsearch/transform/latest_indicator/transform.yml", "/package/ti_ticura/0.1.0/data_stream/indicator/agent/stream/cel.yml.hbs", "/package/ti_ticura/0.1.0/data_stream/indicator/elasticsearch/ilm/default_policy.json", "/package/ti_ticura/0.1.0/data_stream/indicator/elasticsearch/ingest_pipeline/default.yml", "/package/ti_ticura/0.1.0/elasticsearch/transform/latest_indicator/fields/base-fields.yml", "/package/ti_ticura/0.1.0/elasticsearch/transform/latest_indicator/fields/beats.yml", "/package/ti_ticura/0.1.0/elasticsearch/transform/latest_indicator/fields/ecs.yml", "/package/ti_ticura/0.1.0/elasticsearch/transform/latest_indicator/fields/fields.yml" ], "policy_templates": [ { "name": "ticura_api", "title": "Indicator", "description": "Collect threat intelligence indicators from Ticura curated feeds.", "inputs": [ { "type": "cel", "title": "Collect threat intelligence indicators from Ticura curated feeds via API.", "description": "Collect threat intelligence indicators from Ticura curated feeds via the Ticura API." } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "ti_ticura.indicator", "ilm_policy": "logs-ti_ticura.indicator-default_policy", "title": "Indicator", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "url", "type": "text", "title": "Ticura URL", "description": "URL of the Ticura feed download endpoint. The `targetFormat=ECSV1` query parameter is required: it instructs the Ticura API to return indicators already formatted in Elastic Common Schema (ECS), which this integration ingests directly. Do not remove it.", "multi": false, "required": true, "show_user": true, "default": "https://api.ticura.io/v1/feeds/download/full?targetFormat=ECSV1" }, { "name": "api_token", "type": "password", "title": "Ticura API key", "description": "API key used to access the Ticura API instance", "multi": false, "required": true, "show_user": true }, { "name": "interval", "type": "text", "title": "Download Interval", "description": "How often the full feed is downloaded. **Keep this below 24 hours.** Indicators are re-asserted on every download, so this interval bounds freshness: indicators Ticura removes from the feed leave the active set within roughly a day, and never faster than one interval. An interval of 24 hours or longer can make still-active indicators briefly disappear from dashboards and Indicator Match rules between downloads.", "multi": false, "required": true, "show_user": true, "default": "1h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP client timeout", "description": "Maximum time to wait for a single feed download to complete. Feed size depends on your Ticura subscription and selected filters, ranging from a few MB for narrowly-scoped feeds to a few hundred MB for full feeds. Increase this value if your feed is large or your network is slow.", "multi": false, "required": true, "show_user": true, "default": "15m" }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http\\[s\\]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "ti_ticura-indicator" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Only applies to agent-based deployments. See the [CEL input `resource.tracer.filename` documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_filename) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Ticura Indicators", "description": "Collect threat intelligence indicators from Ticura curated feeds.", "enabled": true, "ingestion_method": "API" } ], "package": "ti_ticura", "path": "indicator" } ] }