{ "name": "zeronetworks", "title": "Zero Networks", "version": "1.20.1", "release": "ga", "source": { "license": "Elastic-2.0" }, "description": "Zero Networks Logs integration", "type": "integration", "download": "/epr/zeronetworks/zeronetworks-1.20.1.zip", "path": "/package/zeronetworks/1.20.1", "icons": [ { "src": "/img/logo.svg", "path": "/package/zeronetworks/1.20.1/img/logo.svg", "title": "Logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.4 || ~9.0.7 || ^9.1.4" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "partner", "github": "elastic/security-service-integrations" }, "categories": [ "security", "siem", "network_security" ], "signature_path": "/epr/zeronetworks/zeronetworks-1.20.1.zip.sig", "format_version": "3.3.2", "readme": "/package/zeronetworks/1.20.1/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/screenshot.png", "path": "/package/zeronetworks/1.20.1/img/screenshot.png", "title": "Screenshot", "size": "600x600", "type": "image/png" }, { "src": "/img/zeronetworks-audit-dashboard.png", "path": "/package/zeronetworks/1.20.1/img/zeronetworks-audit-dashboard.png", "title": "Screenshot", "size": "1617x1222", "type": "image/png" } ], "assets": [ "/package/zeronetworks/1.20.1/LICENSE.txt", "/package/zeronetworks/1.20.1/changelog.yml", "/package/zeronetworks/1.20.1/manifest.yml", "/package/zeronetworks/1.20.1/validation.yml", "/package/zeronetworks/1.20.1/docs/README.md", "/package/zeronetworks/1.20.1/img/logo.svg", "/package/zeronetworks/1.20.1/img/screenshot.png", "/package/zeronetworks/1.20.1/img/zeronetworks-audit-dashboard.png", "/package/zeronetworks/1.20.1/kibana/tags.yml", "/package/zeronetworks/1.20.1/data_stream/audit/manifest.yml", "/package/zeronetworks/1.20.1/data_stream/audit/sample_event.json", "/package/zeronetworks/1.20.1/kibana/dashboard/zeronetworks-eae973d0-b70d-11ee-9469-51dfba0e91e6.json", "/package/zeronetworks/1.20.1/data_stream/audit/fields/agent.yml", "/package/zeronetworks/1.20.1/data_stream/audit/fields/base-fields.yml", "/package/zeronetworks/1.20.1/data_stream/audit/fields/beats.yml", "/package/zeronetworks/1.20.1/data_stream/audit/fields/fields.yml", "/package/zeronetworks/1.20.1/data_stream/audit/agent/stream/httpjson.yml.hbs", "/package/zeronetworks/1.20.1/data_stream/audit/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "zeronetworks", "title": "Zero Networks Logs", "description": "Collect logs from Zero Networks", "inputs": [ { "type": "httpjson", "vars": [ { "name": "api_url", "type": "text", "title": "API URL.", "description": "The root url for the API endpoints", "multi": false, "required": true, "show_user": false, "default": "https://portal.zeronetworks.com/api/v1" }, { "name": "ssl", "type": "yaml", "title": "SSL", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:", "multi": false, "required": false, "show_user": false }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": false, "show_user": true, "default": "60s" }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html#_request_tracer_filename) for details.", "multi": false, "required": false, "show_user": false } ], "title": "Collect Zero Networks logs via API", "description": "Collecting logs from Zero Networks via API" } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true, "release": "ga" } } } ], "data_streams": [ { "type": "logs", "dataset": "zeronetworks.audit", "title": "Zero Networks Audit Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "httpjson", "vars": [ { "name": "api_token", "type": "password", "title": "API Token", "description": "The API Token used to authenticate with the Zero Networks API", "multi": false, "required": true, "show_user": true }, { "name": "interval", "type": "text", "title": "Interval", "description": "Interval at which the logs will be pulled. The value must be between 5m and 1h. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "5m" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "Initial interval at which the logs will be pulled. Defaults to 7 days (168 hours). Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": false, "default": "168h" }, { "name": "limit", "type": "integer", "title": "Limit", "description": "Number of events to fetch on each request. Max is 400.", "multi": false, "required": true, "show_user": false, "default": 400 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": true, "default": [ "forwarded", "zeronetworks-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. \nThis executes in the agent before the logs are parsed. \nSee [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "httpjson.yml.hbs", "title": "Zero Networks Audit logs", "description": "Collect Zero Networks Audit logs via the API", "enabled": true, "ingestion_method": "API" } ], "package": "zeronetworks", "path": "audit" } ] }