{ "name": "xm_cyber", "title": "XM Cyber", "version": "0.2.0", "release": "beta", "description": "Collect logs from XM Cyber with Elastic Agent.", "type": "integration", "download": "/epr/xm_cyber/xm_cyber-0.2.0.zip", "path": "/package/xm_cyber/0.2.0", "icons": [ { "src": "/img/xm_cyber-logo.svg", "path": "/package/xm_cyber/0.2.0/img/xm_cyber-logo.svg", "title": "XM Cyber logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.18.0 || ^9.1.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security" ], "signature_path": "/epr/xm_cyber/xm_cyber-0.2.0.zip.sig", "format_version": "3.4.2", "readme": "/package/xm_cyber/0.2.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/xm_cyber-audit_trail.png", "path": "/package/xm_cyber/0.2.0/img/xm_cyber-audit_trail.png", "title": "Audit Trail Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/xm_cyber-vulnerability.png", "path": "/package/xm_cyber/0.2.0/img/xm_cyber-vulnerability.png", "title": "Vulnerability Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/xm_cyber-entity_inventory.png", "path": "/package/xm_cyber/0.2.0/img/xm_cyber-entity_inventory.png", "title": "Entity Inventory Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/xm_cyber-risk_score.png", "path": "/package/xm_cyber/0.2.0/img/xm_cyber-risk_score.png", "title": "Risk Score Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/xm_cyber-device.png", "path": "/package/xm_cyber/0.2.0/img/xm_cyber-device.png", "title": "Device Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/xm_cyber-product.png", "path": "/package/xm_cyber/0.2.0/img/xm_cyber-product.png", "title": "Product Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/xm_cyber/0.2.0/LICENSE.txt", "/package/xm_cyber/0.2.0/changelog.yml", "/package/xm_cyber/0.2.0/manifest.yml", "/package/xm_cyber/0.2.0/validation.yml", "/package/xm_cyber/0.2.0/docs/README.md", "/package/xm_cyber/0.2.0/img/xm_cyber-audit_trail.png", "/package/xm_cyber/0.2.0/img/xm_cyber-device.png", "/package/xm_cyber/0.2.0/img/xm_cyber-entity_inventory.png", "/package/xm_cyber/0.2.0/img/xm_cyber-logo.svg", "/package/xm_cyber/0.2.0/img/xm_cyber-product.png", "/package/xm_cyber/0.2.0/img/xm_cyber-risk_score.png", "/package/xm_cyber/0.2.0/img/xm_cyber-vulnerability.png", "/package/xm_cyber/0.2.0/data_stream/audit_trail/manifest.yml", "/package/xm_cyber/0.2.0/data_stream/audit_trail/sample_event.json", "/package/xm_cyber/0.2.0/data_stream/device/manifest.yml", "/package/xm_cyber/0.2.0/data_stream/device/sample_event.json", "/package/xm_cyber/0.2.0/data_stream/entity_inventory/manifest.yml", "/package/xm_cyber/0.2.0/data_stream/entity_inventory/sample_event.json", "/package/xm_cyber/0.2.0/data_stream/product/manifest.yml", "/package/xm_cyber/0.2.0/data_stream/product/sample_event.json", "/package/xm_cyber/0.2.0/data_stream/risk_score/manifest.yml", "/package/xm_cyber/0.2.0/data_stream/risk_score/sample_event.json", "/package/xm_cyber/0.2.0/data_stream/vulnerability/lifecycle.yml", "/package/xm_cyber/0.2.0/data_stream/vulnerability/manifest.yml", "/package/xm_cyber/0.2.0/data_stream/vulnerability/sample_event.json", "/package/xm_cyber/0.2.0/kibana/dashboard/xm_cyber-2170babe-e0a3-4289-a13b-fcb606f812a7.json", "/package/xm_cyber/0.2.0/kibana/dashboard/xm_cyber-73ae0dbf-0f50-4183-8f0a-6489ca47f1d6.json", "/package/xm_cyber/0.2.0/kibana/dashboard/xm_cyber-8591539b-edd7-42bb-bfa0-2ea26a334900.json", "/package/xm_cyber/0.2.0/kibana/dashboard/xm_cyber-96451398-d474-49d3-b76a-f328996127dd.json", "/package/xm_cyber/0.2.0/kibana/dashboard/xm_cyber-cbb01e78-83e3-4470-8047-209335be7d65.json", "/package/xm_cyber/0.2.0/kibana/dashboard/xm_cyber-e671cff1-1a11-4326-a51d-04b32831df5b.json", "/package/xm_cyber/0.2.0/kibana/search/xm_cyber-32f648df-d7e1-4757-af30-edf43a9a1299.json", "/package/xm_cyber/0.2.0/data_stream/audit_trail/fields/base-fields.yml", "/package/xm_cyber/0.2.0/data_stream/audit_trail/fields/beats.yml", "/package/xm_cyber/0.2.0/data_stream/audit_trail/fields/ecs.yml", "/package/xm_cyber/0.2.0/data_stream/audit_trail/fields/fields.yml", "/package/xm_cyber/0.2.0/data_stream/device/fields/base-fields.yml", "/package/xm_cyber/0.2.0/data_stream/device/fields/beats.yml", "/package/xm_cyber/0.2.0/data_stream/device/fields/ecs.yml", "/package/xm_cyber/0.2.0/data_stream/device/fields/fields.yml", "/package/xm_cyber/0.2.0/data_stream/entity_inventory/fields/base-fields.yml", "/package/xm_cyber/0.2.0/data_stream/entity_inventory/fields/beats.yml", "/package/xm_cyber/0.2.0/data_stream/entity_inventory/fields/ecs.yml", "/package/xm_cyber/0.2.0/data_stream/entity_inventory/fields/fields.yml", "/package/xm_cyber/0.2.0/data_stream/product/fields/base-fields.yml", "/package/xm_cyber/0.2.0/data_stream/product/fields/beats.yml", "/package/xm_cyber/0.2.0/data_stream/product/fields/ecs.yml", "/package/xm_cyber/0.2.0/data_stream/product/fields/fields.yml", "/package/xm_cyber/0.2.0/data_stream/risk_score/fields/base-fields.yml", "/package/xm_cyber/0.2.0/data_stream/risk_score/fields/beats.yml", "/package/xm_cyber/0.2.0/data_stream/risk_score/fields/ecs.yml", "/package/xm_cyber/0.2.0/data_stream/risk_score/fields/fields.yml", "/package/xm_cyber/0.2.0/data_stream/vulnerability/fields/base-fields.yml", "/package/xm_cyber/0.2.0/data_stream/vulnerability/fields/beats.yml", "/package/xm_cyber/0.2.0/data_stream/vulnerability/fields/ecs.yml", "/package/xm_cyber/0.2.0/data_stream/vulnerability/fields/fields.yml", "/package/xm_cyber/0.2.0/data_stream/vulnerability/fields/is-transform-source-true.yml", "/package/xm_cyber/0.2.0/elasticsearch/transform/latest_vulnerability/manifest.yml", "/package/xm_cyber/0.2.0/elasticsearch/transform/latest_vulnerability/transform.yml", "/package/xm_cyber/0.2.0/data_stream/audit_trail/agent/stream/cel.yml.hbs", "/package/xm_cyber/0.2.0/data_stream/audit_trail/elasticsearch/ingest_pipeline/default.yml", "/package/xm_cyber/0.2.0/data_stream/device/agent/stream/cel.yml.hbs", "/package/xm_cyber/0.2.0/data_stream/device/elasticsearch/ingest_pipeline/default.yml", "/package/xm_cyber/0.2.0/data_stream/entity_inventory/agent/stream/cel.yml.hbs", "/package/xm_cyber/0.2.0/data_stream/entity_inventory/elasticsearch/ingest_pipeline/default.yml", "/package/xm_cyber/0.2.0/data_stream/product/agent/stream/cel.yml.hbs", "/package/xm_cyber/0.2.0/data_stream/product/elasticsearch/ingest_pipeline/default.yml", "/package/xm_cyber/0.2.0/data_stream/risk_score/agent/stream/cel.yml.hbs", "/package/xm_cyber/0.2.0/data_stream/risk_score/elasticsearch/ingest_pipeline/default.yml", "/package/xm_cyber/0.2.0/data_stream/vulnerability/agent/stream/cel.yml.hbs", "/package/xm_cyber/0.2.0/data_stream/vulnerability/elasticsearch/ilm/default_policy.json", "/package/xm_cyber/0.2.0/data_stream/vulnerability/elasticsearch/ingest_pipeline/default.yml", "/package/xm_cyber/0.2.0/elasticsearch/transform/latest_vulnerability/fields/base-fields.yml", "/package/xm_cyber/0.2.0/elasticsearch/transform/latest_vulnerability/fields/beats.yml", "/package/xm_cyber/0.2.0/elasticsearch/transform/latest_vulnerability/fields/ecs.yml", "/package/xm_cyber/0.2.0/elasticsearch/transform/latest_vulnerability/fields/fields.yml", "/package/xm_cyber/0.2.0/elasticsearch/transform/latest_vulnerability/fields/is-transform-source-false.yml" ], "policy_templates": [ { "name": "xm_cyber", "title": "XM Cyber", "description": "Collect logs from XM Cyber.", "inputs": [ { "type": "cel", "vars": [ { "name": "url", "type": "url", "title": "XM Cyber Base URL", "description": "Full URL of your XM Cyber instance (e.g. https://tenant.clients.example.com). Do not include /api.", "multi": false, "required": true, "show_user": true }, { "name": "api_key", "type": "password", "title": "API Key", "description": "API key for XM Cyber authentication.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "url", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Please ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "TLS Configuration", "description": "i.e. certificate_authorities, supported_protocols, verification_mode etc, more examples found in the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config-reference).", "multi": false, "required": false, "show_user": false } ], "title": "Collect logs from XM Cyber API", "description": "Collecting logs via XM Cyber API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "xm_cyber.audit_trail", "title": "Audit Trail", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Polling interval", "description": "How often to poll the XM Cyber Audit Trail API. Supported time units: s, m, h.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "page_size", "type": "integer", "title": "Page size", "description": "Number of audit records to request per page.", "multi": false, "required": false, "show_user": false, "default": 1000 }, { "name": "max_executions", "type": "integer", "title": "Maximum Pages Per Interval", "description": "Maximum Pages Per Interval is the maximum number of pages that can be collected at each interval. Note that this must be greater than zero.", "multi": false, "required": false, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before the HTTP client request times out (e.g. 60s).", "multi": false, "required": true, "show_user": false, "default": "60s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "Log HTTP request/response traces to the agent for debugging. Do not enable in production.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags to add to every collected event.", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "xm_cyber-audit_trail" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Keep a copy of the raw event in `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Audit Trail", "description": "Collect Audit Trail logs from XM Cyber.", "enabled": true, "ingestion_method": "API" } ], "package": "xm_cyber", "path": "audit_trail" }, { "type": "logs", "dataset": "xm_cyber.device", "title": "Device", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to poll the XM Cyber Device API. Supported time units are s, m, h.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "page_size", "type": "integer", "title": "Page size", "description": "Number of results per page. Must be between 1 and 20.", "multi": false, "required": true, "show_user": false, "default": 20 }, { "name": "max_executions", "type": "integer", "title": "Maximum Pages Per Interval", "description": "Maximum Pages Per Interval is the maximum number of pages that can be collected at each interval. Note that this must be greater than zero.", "multi": false, "required": false, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before the HTTP client request times out (e.g. 60s).", "multi": false, "required": true, "show_user": false, "default": "60s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "Log HTTP request/response traces to the agent for debugging. Do not enable in production.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags to add to every collected event.", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "xm_cyber-device" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Keep a copy of the raw event in `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Device", "description": "Collect Device logs from XM Cyber.", "enabled": true, "ingestion_method": "API" } ], "package": "xm_cyber", "path": "device" }, { "type": "logs", "dataset": "xm_cyber.entity_inventory", "title": "Entity Inventory", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to poll the XM Cyber Entity Inventory API. Supported time units are s, m, h.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "page_size", "type": "integer", "title": "Page size", "description": "Number of entity inventory records to request per page.", "multi": false, "required": true, "show_user": false, "default": 1000 }, { "name": "max_executions", "type": "integer", "title": "Maximum Pages Per Interval", "description": "Maximum Pages Per Interval is the maximum number of pages that can be collected at each interval. Note that this must be greater than zero.", "multi": false, "required": false, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before the HTTP client request times out (e.g. 60s).", "multi": false, "required": true, "show_user": false, "default": "60s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "Log HTTP request/response traces to the agent for debugging. Do not enable in production.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags to add to every collected event.", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "xm_cyber-entity_inventory" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Keep a copy of the raw event in `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Entity Inventory", "description": "Collect Entity Inventory logs from XM Cyber.", "enabled": true, "ingestion_method": "API" } ], "package": "xm_cyber", "path": "entity_inventory" }, { "type": "logs", "dataset": "xm_cyber.product", "title": "Product", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to poll the XM Cyber Product API. Supported time units are s, m, h.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "page_size", "type": "integer", "title": "Page size", "description": "Number of results per page. Must be between 1 and 100.", "multi": false, "required": true, "show_user": false, "default": 100 }, { "name": "max_executions", "type": "integer", "title": "Maximum Pages Per Interval", "description": "Maximum Pages Per Interval is the maximum number of pages that can be collected at each interval. Note that this must be greater than zero.", "multi": false, "required": false, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before the HTTP client request times out (e.g. 60s).", "multi": false, "required": true, "show_user": false, "default": "60s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "Log HTTP request/response traces to the agent for debugging. Do not enable in production.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags to add to every collected event.", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "xm_cyber-product" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Keep a copy of the raw event in `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Product", "description": "Collect Product logs from XM Cyber.", "enabled": true, "ingestion_method": "API" } ], "package": "xm_cyber", "path": "product" }, { "type": "logs", "dataset": "xm_cyber.risk_score", "title": "Risk Score", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "initial_interval", "type": "select", "title": "Initial Interval", "description": "How far back to pull the initial Risk Score data from XM Cyber, in days.", "multi": false, "required": true, "show_user": true, "default": "30" }, { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the XM Cyber API. Supported time units are s, m, h.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "max_executions", "type": "integer", "title": "Maximum Pages Per Interval", "description": "Maximum Pages Per Interval is the maximum number of pages that can be collected at each interval. Note that this must be greater than zero.", "multi": false, "required": false, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before the HTTP client request times out (e.g. 60s).", "multi": false, "required": true, "show_user": false, "default": "60s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "Log HTTP request/response traces to the agent for debugging. Do not enable in production.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags to add to every collected event.", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "xm_cyber-risk_score" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Keep a copy of the raw event in `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Risk Score", "description": "Collect Risk Score logs from XM Cyber.", "enabled": true, "ingestion_method": "API" } ], "package": "xm_cyber", "path": "risk_score" }, { "type": "logs", "dataset": "xm_cyber.vulnerability", "ilm_policy": "logs-xm_cyber.vulnerability-default_policy", "title": "Vulnerability", "release": "beta", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "How often to poll the XM Cyber Vulnerability API. Supported time units are s, m, h.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "page_size", "type": "integer", "title": "Page size", "description": "Number of vulnerability records to request per page. Must be between 1 and 100.", "multi": false, "required": true, "show_user": false, "default": 100 }, { "name": "max_executions", "type": "integer", "title": "Maximum Pages Per Interval", "description": "Maximum Pages Per Interval is the maximum number of pages that can be collected at each interval. Note that this must be greater than zero.", "multi": false, "required": false, "show_user": false, "default": 1000 }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before the HTTP client request times out (e.g. 60s).", "multi": false, "required": true, "show_user": false, "default": "60s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "Log HTTP request/response traces to the agent for debugging. Do not enable in production.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "description": "Tags to add to every collected event.", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "xm_cyber-vulnerability" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Keep a copy of the raw event in `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Vulnerability", "description": "Collect Vulnerability logs from XM Cyber.", "enabled": true, "ingestion_method": "API" } ], "package": "xm_cyber", "path": "vulnerability" } ] }