{ "name": "zoom", "title": "Zoom", "version": "1.24.0", "release": "ga", "description": "Collect logs from Zoom with Elastic Agent.", "type": "integration", "download": "/epr/zoom/zoom-1.24.0.zip", "path": "/package/zoom/1.24.0", "icons": [ { "src": "/img/zoom_blue.svg", "path": "/package/zoom/1.24.0/img/zoom_blue.svg", "title": "Zoom", "size": "516x240", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.19.0 || ^9.1.0" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "productivity_security", "observability" ], "signature_path": "/epr/zoom/zoom-1.24.0.zip.sig", "format_version": "3.3.2", "readme": "/package/zoom/1.24.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/zoom-activity-dashboard.png", "path": "/package/zoom/1.24.0/img/zoom-activity-dashboard.png", "title": "Zoom Activity Overview Dashboard Screenshot", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/zoom/1.24.0/LICENSE.txt", "/package/zoom/1.24.0/changelog.yml", "/package/zoom/1.24.0/manifest.yml", "/package/zoom/1.24.0/validation.yml", "/package/zoom/1.24.0/docs/README.md", "/package/zoom/1.24.0/img/zoom-activity-dashboard.png", "/package/zoom/1.24.0/img/zoom_blue.svg", "/package/zoom/1.24.0/kibana/tags.yml", "/package/zoom/1.24.0/data_stream/activity/manifest.yml", "/package/zoom/1.24.0/data_stream/activity/sample_event.json", "/package/zoom/1.24.0/data_stream/webhook/manifest.yml", "/package/zoom/1.24.0/data_stream/webhook/sample_event.json", "/package/zoom/1.24.0/kibana/dashboard/zoom-e9055606-5d33-4f84-b883-4498c22b6dbc.json", "/package/zoom/1.24.0/kibana/search/zoom-e9178ff9-be70-4161-8e4d-9ec7a0d171b5.json", "/package/zoom/1.24.0/data_stream/activity/fields/base-fields.yml", "/package/zoom/1.24.0/data_stream/activity/fields/beats.yml", "/package/zoom/1.24.0/data_stream/activity/fields/fields.yml", "/package/zoom/1.24.0/data_stream/webhook/fields/agent.yml", "/package/zoom/1.24.0/data_stream/webhook/fields/base-fields.yml", "/package/zoom/1.24.0/data_stream/webhook/fields/fields.yml", "/package/zoom/1.24.0/data_stream/activity/agent/stream/cel.yml.hbs", "/package/zoom/1.24.0/data_stream/activity/elasticsearch/ingest_pipeline/default.yml", "/package/zoom/1.24.0/data_stream/webhook/agent/stream/http_endpoint.yml.hbs", "/package/zoom/1.24.0/data_stream/webhook/elasticsearch/ingest_pipeline/account.yml", "/package/zoom/1.24.0/data_stream/webhook/elasticsearch/ingest_pipeline/chat_channel.yml", "/package/zoom/1.24.0/data_stream/webhook/elasticsearch/ingest_pipeline/chat_message.yml", "/package/zoom/1.24.0/data_stream/webhook/elasticsearch/ingest_pipeline/default.yml", "/package/zoom/1.24.0/data_stream/webhook/elasticsearch/ingest_pipeline/meeting.yml", "/package/zoom/1.24.0/data_stream/webhook/elasticsearch/ingest_pipeline/phone.yml", "/package/zoom/1.24.0/data_stream/webhook/elasticsearch/ingest_pipeline/recording.yml", "/package/zoom/1.24.0/data_stream/webhook/elasticsearch/ingest_pipeline/user.yml", "/package/zoom/1.24.0/data_stream/webhook/elasticsearch/ingest_pipeline/webinar.yml", "/package/zoom/1.24.0/data_stream/webhook/elasticsearch/ingest_pipeline/zoomroom.yml" ], "policy_templates": [ { "name": "zoom", "title": "Zoom logs", "description": "Collect logs from Zoom instances", "inputs": [ { "type": "http_endpoint", "title": "Collect Zoom logs via Webhook", "description": "Collecting logs from Zoom instances via Webhook" }, { "type": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the Zoom API.", "multi": false, "required": true, "show_user": false, "default": "https://api.zoom.us" }, { "name": "token_url", "type": "text", "title": "OAuth Token URL", "description": "OAuth Token URL of the Zoom OAuth app.", "multi": false, "required": true, "show_user": false, "default": "https://zoom.us" }, { "name": "account_id", "type": "text", "title": "Account ID", "description": "Account ID of the Zoom account.", "multi": false, "required": true, "show_user": true }, { "name": "client_id", "type": "text", "title": "Client ID", "description": "Client ID of the Zoom OAuth app.", "multi": false, "required": true, "show_user": true }, { "name": "client_secret", "type": "password", "title": "Client Secret", "description": "Client secret of the Zoom OAuth app.", "multi": false, "required": true, "show_user": true }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:. Ensure your username and password are in URL encoded format.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Zoom logs via REST API", "description": "Collecting logs from Zoom instances via the REST API" } ], "multiple": true } ], "data_streams": [ { "type": "logs", "dataset": "zoom.activity", "title": "Activity", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Duration between requests to the Zoom API. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "initial_interval", "type": "text", "title": "Initial Interval", "description": "How far back to pull the Activity logs from Zoom API. Must not exceed six months of available report history. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "720h" }, { "name": "page_size", "type": "integer", "title": "Page Size", "description": "Page size for the response of the Zoom API.", "multi": false, "required": true, "show_user": false, "default": 100 }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "30s" }, { "name": "resource_rate_limit_limit", "type": "text", "title": "Rate Limit", "description": "The maximum number of API requests allowed per second. Leave empty to disable client-side rate limiting. Zoom's `/report/activities` endpoint is a Heavy API whose per-second and daily quotas vary by account plan.", "multi": false, "required": false, "show_user": false }, { "name": "resource_rate_limit_burst", "type": "integer", "title": "Rate Limit Burst", "description": "The maximum number of API requests that can be made in a burst following an idle period. Leave empty to disable client-side rate limiting.", "multi": false, "required": false, "show_user": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zoom-activity" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Activity", "description": "Collect activity logs report of users under a Zoom account via the REST API.", "enabled": false, "ingestion_method": "API" } ], "package": "zoom", "path": "activity" }, { "type": "logs", "dataset": "zoom.webhook", "title": "Zoom webhook logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "http_endpoint", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "Bind address for the listener. Use 0.0.0.0 to listen on all interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "listen_port", "type": "integer", "title": "Listen Port", "multi": false, "required": true, "show_user": true, "default": 8181 }, { "name": "url", "type": "text", "title": "Webhook path", "description": "URL path where the webhook will accept requests.", "multi": false, "required": true, "show_user": true, "default": "/zoom-webhook" }, { "name": "crc_enabled", "type": "bool", "title": "Enable CRC validation", "description": "CRC validation is used by Zoom to verify the authenticity of a webhook endpoint. See [Validate your webhook endpoint](https://developers.zoom.us/docs/api/rest/webhook-reference/#validate-your-webhook-endpoint) for more information.", "multi": false, "required": false, "show_user": true, "default": false }, { "name": "crc_secret", "type": "password", "title": "Zoom Secret Token", "description": "Secret token provided by Zoom when the webhook was configured. It is used for the CRC validation of the webhook endpoint.", "multi": false, "required": false, "show_user": true }, { "name": "secret_header", "type": "text", "title": "Zoom Custom Header", "description": "Custom header used to validate the authenticity of incoming Zoom POST requests. It should be created by the user when configuring the webhook on Zoom. See [Verify webhook events](https://developers.zoom.us/docs/api/rest/webhook-reference/#custom-header) for more information.", "multi": false, "required": false, "show_user": true, "default": "Authorization" }, { "name": "secret_value", "type": "password", "title": "Zoom Custom Header value", "description": "Custom header value used to validate the authenticity of incoming Zoom POST requests. It should be created by the user when configuring the webhook on Zoom. See [Verify webhook events](https://developers.zoom.us/docs/api/rest/webhook-reference/#custom-header) for more information.", "multi": false, "required": false, "show_user": true }, { "name": "ssl", "type": "yaml", "title": "TLS", "description": "Options for enabling TLS for the listening webhook endpoint. Zoom requires webhooks listen on HTTPS. You must either provide a valid TLS certificate or use a reverse proxy in front of the integration. See the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html) for a list of all options.", "multi": false, "required": false, "show_user": false, "default": "enabled: false\ncertificate: \"/etc/pki/client/cert.pem\"\nkey: \"/etc/pki/client/cert.key\"\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "zoom-webhook", "forwarded" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`", "multi": false, "required": true, "show_user": true, "default": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Zoom webhook logs", "description": "Collect Zoom logs via Webhook", "enabled": true, "ingestion_method": "Webhook" } ], "package": "zoom", "path": "webhook" } ] }