{ "name": "workday", "title": "Workday", "version": "0.2.0", "release": "beta", "description": "Collect logs from Workday with Elastic Agent.", "type": "integration", "download": "/epr/workday/workday-0.2.0.zip", "path": "/package/workday/0.2.0", "icons": [ { "src": "/img/workday-logo.svg", "path": "/package/workday/0.2.0/img/workday-logo.svg", "title": "Workday logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.18.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/workday/workday-0.2.0.zip.sig", "format_version": "3.3.2", "readme": "/package/workday/0.2.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/workday-activity-dashboard.png", "path": "/package/workday/0.2.0/img/workday-activity-dashboard.png", "title": "Activity Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/workday/0.2.0/LICENSE.txt", "/package/workday/0.2.0/changelog.yml", "/package/workday/0.2.0/manifest.yml", "/package/workday/0.2.0/validation.yml", "/package/workday/0.2.0/docs/README.md", "/package/workday/0.2.0/img/workday-activity-dashboard.png", "/package/workday/0.2.0/img/workday-logo.svg", "/package/workday/0.2.0/data_stream/activity/manifest.yml", "/package/workday/0.2.0/data_stream/activity/sample_event.json", "/package/workday/0.2.0/kibana/dashboard/workday-972e856e-47c4-4c27-966e-b9dfcd380d72.json", "/package/workday/0.2.0/kibana/search/workday-b1b11266-913a-4ae4-9565-8c836b79ad2f.json", "/package/workday/0.2.0/data_stream/activity/fields/base-fields.yml", "/package/workday/0.2.0/data_stream/activity/fields/beats.yml", "/package/workday/0.2.0/data_stream/activity/fields/ecs.yml", "/package/workday/0.2.0/data_stream/activity/fields/fields.yml", "/package/workday/0.2.0/data_stream/activity/agent/stream/cel.yml.hbs", "/package/workday/0.2.0/data_stream/activity/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "workday", "title": "Workday logs", "description": "Collect Workday logs.", "inputs": [ { "type": "cel", "vars": [ { "name": "hostname", "type": "text", "title": "Hostname", "description": "Hostname of Workday instance. Example: .workday.com", "multi": false, "required": true, "show_user": true }, { "name": "tenant", "type": "text", "title": "Tenant", "description": "Tenant of Workday instance.", "multi": false, "required": true, "show_user": true }, { "name": "client_id", "type": "text", "title": "Client ID", "description": "Client ID.", "multi": false, "required": true, "show_user": true }, { "name": "client_secret", "type": "password", "title": "Client Secret", "description": "Client Secret.", "multi": false, "required": true, "show_user": true }, { "name": "refresh_token", "type": "text", "title": "Refresh Token", "description": "Refresh token for Workday instance.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "proxy configuration in the form of https://:@:.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Workday logs via API", "description": "Collecting logs from Workday via CEL input." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } } ], "data_streams": [ { "type": "logs", "dataset": "workday.activity", "title": "Activity", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Activity logs from Workday API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Workday API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "batch_size", "type": "integer", "title": "Batch Size", "description": "Batch size for the response of the Workday API. The batch size can range from a minimum of 1 to a maximum of 1000.", "multi": false, "required": true, "show_user": true, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "workday-activity" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field event.original.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata.\nThis executes in the agent before the logs are parsed.\nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Activity logs", "description": "Collect Activity logs from Workday.", "enabled": true, "ingestion_method": "API" } ], "package": "workday", "path": "activity" } ] }