{
  "name": "withsecure_elements",
  "title": "WithSecure Elements",
  "version": "0.4.0",
  "release": "beta",
  "source": {
    "license": "Elastic-2.0"
  },
  "description": "Ingest WithSecure Elements incidents and security events data",
  "type": "integration",
  "download": "/epr/withsecure_elements/withsecure_elements-0.4.0.zip",
  "path": "/package/withsecure_elements/0.4.0",
  "icons": [
    {
      "src": "/img/withsecure_elements.svg",
      "path": "/package/withsecure_elements/0.4.0/img/withsecure_elements.svg",
      "title": "WithSecure Elements",
      "size": "64x64",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.19.2 || ^9.0.5"
    },
    "elastic": {
      "subscription": "basic"
    }
  },
  "owner": {
    "type": "community",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "security",
    "edr_xdr"
  ],
  "signature_path": "/epr/withsecure_elements/withsecure_elements-0.4.0.zip.sig",
  "format_version": "3.3.2",
  "readme": "/package/withsecure_elements/0.4.0/docs/README.md",
  "license": "basic",
  "assets": [
    "/package/withsecure_elements/0.4.0/LICENSE.txt",
    "/package/withsecure_elements/0.4.0/changelog.yml",
    "/package/withsecure_elements/0.4.0/manifest.yml",
    "/package/withsecure_elements/0.4.0/docs/README.md",
    "/package/withsecure_elements/0.4.0/img/withsecure_elements.svg",
    "/package/withsecure_elements/0.4.0/data_stream/incidents/manifest.yml",
    "/package/withsecure_elements/0.4.0/data_stream/security_events/manifest.yml",
    "/package/withsecure_elements/0.4.0/data_stream/incidents/fields/base-fields.yml",
    "/package/withsecure_elements/0.4.0/data_stream/incidents/fields/beats.yml",
    "/package/withsecure_elements/0.4.0/data_stream/incidents/fields/ecs.yml",
    "/package/withsecure_elements/0.4.0/data_stream/incidents/fields/fields.yml",
    "/package/withsecure_elements/0.4.0/data_stream/security_events/fields/base-fields.yml",
    "/package/withsecure_elements/0.4.0/data_stream/security_events/fields/beats.yml",
    "/package/withsecure_elements/0.4.0/data_stream/security_events/fields/ecs.yml",
    "/package/withsecure_elements/0.4.0/data_stream/security_events/fields/fields.yml",
    "/package/withsecure_elements/0.4.0/data_stream/incidents/agent/stream/cel.yml.hbs",
    "/package/withsecure_elements/0.4.0/data_stream/incidents/elasticsearch/ingest_pipeline/default.yml",
    "/package/withsecure_elements/0.4.0/data_stream/security_events/agent/stream/cel.yml.hbs",
    "/package/withsecure_elements/0.4.0/data_stream/security_events/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "withsecure_elements",
      "title": "WithSecure Elements",
      "description": "Collect incidents and security events data from WithSecure Elements API",
      "inputs": [
        {
          "type": "cel",
          "vars": [
            {
              "name": "url",
              "type": "url",
              "title": "WithSecure Elements API URL",
              "description": "URL of the WithSecure Elements API",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "https://api.connect.withsecure.com"
            },
            {
              "name": "client_id",
              "type": "text",
              "title": "Client ID",
              "description": "WithSecure Elements API Client ID",
              "multi": false,
              "required": true,
              "show_user": true
            },
            {
              "name": "client_secret",
              "type": "password",
              "title": "Client Secret",
              "description": "WithSecure Elements API Client Secret",
              "multi": false,
              "required": true,
              "show_user": true
            },
            {
              "name": "organization_id",
              "type": "text",
              "title": "Organization ID",
              "description": "WithSecure Elements Organization ID",
              "multi": false,
              "required": true,
              "show_user": true
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": false
            },
            {
              "name": "proxy_url",
              "type": "text",
              "title": "Proxy URL",
              "description": "URL to proxy connections in the form of http[s]://<user>:<password>@<server name/ip>:<port>.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "ssl",
              "type": "yaml",
              "title": "SSL Configuration",
              "description": "SSL configuration options.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "http_client_timeout",
              "type": "text",
              "title": "HTTP Client Timeout",
              "description": "Duration before declaring that the HTTP client connection has timed out.",
              "multi": false,
              "required": false,
              "show_user": false,
              "default": "30s"
            }
          ],
          "title": "Collect WithSecure Elements Data",
          "description": "Collects incidents, security events, and detections from WithSecure Elements API"
        }
      ],
      "multiple": true,
      "deployment_modes": {
        "default": {
          "enabled": true
        },
        "agentless": {
          "enabled": true,
          "release": "ga"
        }
      }
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "withsecure_elements.incidents",
      "title": "WithSecure Elements Incidents (BCDs)",
      "release": "beta",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "cel",
          "vars": [
            {
              "name": "interval",
              "type": "text",
              "title": "Collection Interval",
              "description": "How often to collect data (e.g., 5m, 1h)",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "5m"
            },
            {
              "name": "batch_size",
              "type": "integer",
              "title": "Batch Size",
              "description": "Number of incidents to retrieve per API request. Min 1, Max 50 (API limit).",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": 50
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "Enables HTTP request/response tracing for debugging. Creates trace files in logs/cel/ directory.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "forwarded"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "preserve_duplicate_custom_fields",
              "type": "bool",
              "title": "Preserve duplicate custom fields",
              "description": "Preserve withsecure.incident fields that were copied to Elastic Common Schema (ECS) fields.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": true
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "cel.yml.hbs",
          "title": "WithSecure Elements Incidents",
          "description": "Collects Broad Context Detections (BCDs) from WithSecure Elements API",
          "enabled": true,
          "ingestion_method": "API"
        }
      ],
      "package": "withsecure_elements",
      "path": "incidents"
    },
    {
      "type": "logs",
      "dataset": "withsecure_elements.security_events",
      "title": "WithSecure Elements Security Events",
      "release": "beta",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "cel",
          "vars": [
            {
              "name": "interval",
              "type": "text",
              "title": "Collection Interval",
              "description": "How often to collect data (e.g., 5m, 1h)",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "5m"
            },
            {
              "name": "batch_size",
              "type": "integer",
              "title": "Batch Size",
              "description": "Number of security events to retrieve per API request. Min 1, Max 200 (API limit).",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": 200
            },
            {
              "name": "engine_groups",
              "type": "text",
              "title": "Engine Groups",
              "description": "Engine groups to collect events from. Options: epp (Endpoint Protection), edr (Detection and Response), ecp (Collaboration Protection), xm (Exposure Management).",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "epp",
                "edr"
              ]
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "Enables HTTP request/response tracing for debugging. Creates trace files in logs/cel/ directory.",
              "multi": false,
              "required": false,
              "show_user": true,
              "default": false
            },
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": false,
              "default": [
                "forwarded"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "preserve_duplicate_custom_fields",
              "type": "bool",
              "title": "Preserve duplicate custom fields",
              "description": "Preserve withsecure.security.event fields that were copied to Elastic Common Schema (ECS) fields.",
              "multi": false,
              "required": true,
              "show_user": false,
              "default": true
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "cel.yml.hbs",
          "title": "WithSecure Elements Security Events",
          "description": "Collects security events from WithSecure Elements API",
          "enabled": true,
          "ingestion_method": "API"
        }
      ],
      "package": "withsecure_elements",
      "path": "security_events"
    }
  ]
}