{
  "name": "zerofox",
  "title": "ZeroFox",
  "version": "1.30.1",
  "release": "ga",
  "description": "Collect logs from ZeroFox with Elastic Agent.",
  "type": "integration",
  "download": "/epr/zerofox/zerofox-1.30.1.zip",
  "path": "/package/zerofox/1.30.1",
  "icons": [
    {
      "src": "/img/logo.svg",
      "path": "/package/zerofox/1.30.1/img/logo.svg",
      "title": "logo ZeroFox",
      "size": "32x32",
      "type": "image/svg+xml"
    }
  ],
  "conditions": {
    "kibana": {
      "version": "^8.19.4 || ~9.0.7 || ^9.1.4"
    }
  },
  "owner": {
    "type": "partner",
    "github": "elastic/security-service-integrations"
  },
  "categories": [
    "security",
    "siem",
    "threat_intel"
  ],
  "signature_path": "/epr/zerofox/zerofox-1.30.1.zip.sig",
  "format_version": "3.3.2",
  "readme": "/package/zerofox/1.30.1/docs/README.md",
  "license": "basic",
  "assets": [
    "/package/zerofox/1.30.1/LICENSE.txt",
    "/package/zerofox/1.30.1/changelog.yml",
    "/package/zerofox/1.30.1/manifest.yml",
    "/package/zerofox/1.30.1/validation.yml",
    "/package/zerofox/1.30.1/docs/README.md",
    "/package/zerofox/1.30.1/img/logo.svg",
    "/package/zerofox/1.30.1/kibana/tags.yml",
    "/package/zerofox/1.30.1/data_stream/alerts/manifest.yml",
    "/package/zerofox/1.30.1/data_stream/alerts/sample_event.json",
    "/package/zerofox/1.30.1/data_stream/alerts/fields/agent.yml",
    "/package/zerofox/1.30.1/data_stream/alerts/fields/base-fields.yml",
    "/package/zerofox/1.30.1/data_stream/alerts/fields/beats.yml",
    "/package/zerofox/1.30.1/data_stream/alerts/fields/fields.yml",
    "/package/zerofox/1.30.1/data_stream/alerts/agent/stream/httpjson.yml.hbs",
    "/package/zerofox/1.30.1/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml"
  ],
  "policy_templates": [
    {
      "name": "zerofox",
      "title": "ZeroFox Alerts",
      "description": "Collect alert from the ZeroFox API",
      "inputs": [
        {
          "type": "httpjson",
          "vars": [
            {
              "name": "http_client_timeout",
              "type": "text",
              "title": "Http Client Timeout",
              "description": "Duration of the time limit on HTTP requests. Valid time units are ns, us, ms, s, m, h.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "60s"
            },
            {
              "name": "enable_request_tracer",
              "type": "bool",
              "title": "Enable request tracing",
              "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.",
              "multi": false,
              "required": false,
              "show_user": false
            },
            {
              "name": "url",
              "type": "text",
              "title": "ZeroFox API URL",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "https://api.zerofox.com/1.0/alerts/"
            },
            {
              "name": "zerofox_api_token",
              "type": "password",
              "title": "ZeroFox API Token",
              "description": "zerofox api token",
              "multi": false,
              "required": true,
              "show_user": true
            },
            {
              "name": "initial_interval",
              "type": "text",
              "title": "Initial Interval",
              "description": "How far back to pull the initial alerts. Supported units for this parameter are h/m/s.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "720h"
            },
            {
              "name": "interval",
              "type": "text",
              "title": "Periodic Polling Interval",
              "description": "How often to poll the ZeroFox API for new alerts. Supported units for this parameter are h/m/s.",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": "10m"
            }
          ],
          "title": "Collect alert logs (input: httpjson)",
          "description": "Collecting alert logs (input: httpjson)"
        }
      ],
      "multiple": true,
      "deployment_modes": {
        "default": {
          "enabled": true
        },
        "agentless": {
          "enabled": true,
          "release": "ga"
        }
      }
    }
  ],
  "data_streams": [
    {
      "type": "logs",
      "dataset": "zerofox.alerts",
      "title": "Alerts",
      "release": "ga",
      "ingest_pipeline": "default",
      "streams": [
        {
          "input": "httpjson",
          "vars": [
            {
              "name": "tags",
              "type": "text",
              "title": "Tags",
              "multi": true,
              "required": true,
              "show_user": true,
              "default": [
                "forwarded"
              ]
            },
            {
              "name": "preserve_original_event",
              "type": "bool",
              "title": "Preserve original event",
              "description": "Preserves a raw copy of the original event, added to the field `event.original`",
              "multi": false,
              "required": true,
              "show_user": true,
              "default": false
            },
            {
              "name": "processors",
              "type": "yaml",
              "title": "Processors",
              "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n",
              "multi": false,
              "required": false,
              "show_user": false
            }
          ],
          "template_path": "httpjson.yml.hbs",
          "title": "ZeroFox Alert logs (httpjson)",
          "description": "Collect alert logs using httpjson input",
          "enabled": true,
          "ingestion_method": "API"
        }
      ],
      "package": "zerofox",
      "path": "alerts"
    }
  ]
}