{
  "name": "tines",
  "title": "Tines",
  "version": "1.17.1",
  "release": "ga",
  "description": "Tines Logs & Time Saved Reports",
  "type": "integration",
  "download": "/epr/tines/tines-1.17.1.zip",
  "path": "/package/tines/1.17.1",
  "icons": [
    {
      "src": "/img/tines-purple-logo.png",
      "path": "/package/tines/1.17.1/img/tines-purple-logo.png",
      "title": "Tines",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.19.4 || ~9.0.7 || ^9.1.4"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "community",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "cloud",
    "security"
  ],
  "signature_path": "/epr/tines/tines-1.17.1.zip.sig",
  "format_version": "3.3.2",
  "readme": "/package/tines/1.17.1/docs/README.md",
  "license": "basic",
  "screenshots": [
    {
      "src": "/img/tines-audit-logs-dashboard.png",
      "path": "/package/tines/1.17.1/img/tines-audit-logs-dashboard.png",
      "title": "Audit Logs",
      "size": "600x600",
      "type": "image/png"
    },
    {
      "src": "/img/tines-time-saved-dashboard.png",
      "path": "/package/tines/1.17.1/img/tines-time-saved-dashboard.png",
      "title": "Time Saved",
      "size": "600x600",
      "type": "image/png"
    }
  ],
  "assets": [
    "/package/tines/1.17.1/LICENSE.txt",
    "/package/tines/1.17.1/changelog.yml",
    "/package/tines/1.17.1/manifest.yml",
    "/package/tines/1.17.1/validation.yml",
    "/package/tines/1.17.1/docs/README.md",
    "/package/tines/1.17.1/img/tines-audit-logs-dashboard.png",
    "/package/tines/1.17.1/img/tines-integration-configuration.png",
    "/package/tines/1.17.1/img/tines-purple-logo.png",
    "/package/tines/1.17.1/img/tines-time-saved-dashboard.png",
    "/package/tines/1.17.1/kibana/tags.yml",
    "/package/tines/1.17.1/data_stream/audit_logs/manifest.yml",
    "/package/tines/1.17.1/data_stream/audit_logs/sample_event.json",
    "/package/tines/1.17.1/data_stream/time_saved/manifest.yml",
    "/package/tines/1.17.1/data_stream/time_saved/sample_event.json",
    "/package/tines/1.17.1/kibana/dashboard/tines-215e32f0-9e2a-11ed-9dee-d3f2ae7796f5.json",
    "/package/tines/1.17.1/kibana/dashboard/tines-c8ef4110-9a44-11ed-ad71-d13f8e88b6f1.json",
    "/package/tines/1.17.1/kibana/tag/tines-fleet-managed-default.json",
    "/package/tines/1.17.1/kibana/tag/tines-fleet-pkg-tines-default.json",
    "/package/tines/1.17.1/data_stream/audit_logs/fields/base-fields.yml",
    "/package/tines/1.17.1/data_stream/audit_logs/fields/ecs.yml",
    "/package/tines/1.17.1/data_stream/audit_logs/fields/fields.yml",
    "/package/tines/1.17.1/data_stream/time_saved/fields/base-fields.yml",
    "/package/tines/1.17.1/data_stream/time_saved/fields/ecs.yml",
    "/package/tines/1.17.1/data_stream/time_saved/fields/fields.yml",
    "/package/tines/1.17.1/data_stream/audit_logs/agent/stream/httpjson.yml.hbs",
    "/package/tines/1.17.1/data_stream/audit_logs/elasticsearch/ingest_pipeline/default.yml",
    "/package/tines/1.17.1/data_stream/time_saved/agent/stream/httpjson.yml.hbs",
    "/package/tines/1.17.1/data_stream/time_saved/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "tines_api",
      "title": "Tines API",
      "description": "Collect events from the Tines API",
      "inputs": [
        {
          "type": "httpjson",
          "vars": [
            {
              "name": "url",
              "type": "text",
              "title": "Tines Tenant URL",
              "description": "i.e. https://your-tenant-1234.tines.com",
              "multi": false,
              "required": true,
              "show_user": true
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "auth_email",
              "type": "text",
              "title": "Tines User Account Email",
              "description": "For all Tines cloud tenants, and self hosted tenants using v13+ an email address is [no longer required for authentication](https://www.tines.com/api/authentication#using-an-api-key).",
              "multi": false,
              "required": false,
              "show_user": true
            },
            {
              "name": "auth_token",
              "type": "password",
              "title": "Tines API User Account API Key",
              "multi": false,
              "required": true,
              "show_user": true
            }
          ],
          "title": "Collect Tines API Data",
          "description": "Collects data via Tines API"
        }
      ],
      "multiple": true,
      "deployment_modes": {
        "default": {
          "enabled": true
        },
        "agentless": {
          "enabled": true,
          "release": "ga"
        }
      }
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "tines.audit_logs",
      "title": "Tines Audit Logs",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "httpjson",
          "vars": [
            {
              "name": "ssl",
              "type": "yaml",
              "title": "SSL Configuration",
              "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#certificate_authorities:\n#  - |\n#    -----BEGIN CERTIFICATE-----\n#    MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n#    ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n#    MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n#    BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n#    fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n#    94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n#    /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n#    PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n#    CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n#    BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n#    8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n#    874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n#    3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n#    H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n#    8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n#    yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n#    sxSmbIUfc2SGJGCJD4I=\n#    -----END CERTIFICATE-----\n"
            },
            {
              "name": "interval",
              "type": "text",
              "title": "Interval",
              "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "5m"
            },
            {
              "name": "user_id",
              "type": "text",
              "title": "User ID",
              "description": "Only include logs from a matching user. Use the format user_id[]= to select multiple users, i.e. ?user_id[]=1&user_id[]=2",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "operation_name",
              "type": "text",
              "title": "Operation Name",
              "description": "Only include logs with a specific operation name. Use the format operation_name[]= to select multiple operation names, i.e. ?operation_name[]=StoryItemsMovement&operation_name[]=StoryItemsCreation",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "initial_interval",
              "type": "text",
              "title": "Initial Interval",
              "description": "Period of historical audit logs to collect when first collection request occurs. Supported units for this parameter are h/m/s.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "168h"
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "forwarded"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "preserve_duplicate_custom_fields",
              "type": "bool",
              "title": "Preserve all original fields",
              "description": "Preserves a raw copy of all originally parsed fields received from the API prior to ECS mapping",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.  This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "httpjson.yml.hbs",
          "title": "Audit Logs",
          "description": "Collect Tines Audit Logs",
          "enabled": true,
          "ingestion_method": "API"
        }
      ],
      "package": "tines",
      "elasticsearch": {
        "index_template.mappings": {
          "subobjects": false
        },
        "ingest_pipeline.name": "default"
      },
      "path": "audit_logs"
    },
    {
      "type": "logs",
      "dataset": "tines.time_saved",
      "title": "Tines Time Saved Reports",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "httpjson",
          "vars": [
            {
              "name": "ssl",
              "type": "yaml",
              "title": "SSL Configuration",
              "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "#certificate_authorities:\n#  - |\n#    -----BEGIN CERTIFICATE-----\n#    MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n#    ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n#    MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n#    BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n#    fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n#    94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n#    /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n#    PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n#    CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n#    BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n#    8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n#    874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n#    3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n#    H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n#    8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n#    yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n#    sxSmbIUfc2SGJGCJD4I=\n#    -----END CERTIFICATE-----\n"
            },
            {
              "name": "interval",
              "type": "text",
              "title": "Interval",
              "description": "Duration between requests to the API. Supported units for this parameter are h/m/s.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "1h"
            },
            {
              "name": "date_unit",
              "type": "text",
              "title": "Date Unit",
              "description": "Request data by hour, day, month, or year",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "hour"
            },
            {
              "name": "fill_gaps",
              "type": "text",
              "title": "Fill Gaps",
              "description": "If true, fill any empty rows with explicit 0 time saved.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": true
            },
            {
              "name": "team_id",
              "type": "text",
              "title": "Team ID",
              "description": "Only retrieve time saved data for a specific team ID",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "story_id",
              "type": "text",
              "title": "Story ID",
              "description": "Only retrieve time saved data for a specific story ID",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "initial_interval",
              "type": "text",
              "title": "Initial Interval",
              "description": "Period of historical audit logs to collect when first collection request occurs. Supported units for this parameter are h/m/s.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": "168h"
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "forwarded"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "preserve_duplicate_custom_fields",
              "type": "bool",
              "title": "Preserve all original fields",
              "description": "Preserves a raw copy of all originally parsed fields received from the API prior to ECS mapping",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.  This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "httpjson.yml.hbs",
          "title": "Time Saved Reports",
          "description": "Collect Tines Timed Saved Reports",
          "enabled": true,
          "ingestion_method": "API"
        }
      ],
      "package": "tines",
      "path": "time_saved"
    }
  ]
}