{ "name": "zscaler_zia", "title": "Zscaler Internet Access", "version": "3.19.0", "release": "ga", "source": { "license": "Elastic-2.0" }, "description": "Collect logs from Zscaler Internet Access (ZIA) with Elastic Agent.", "type": "integration", "download": "/epr/zscaler_zia/zscaler_zia-3.19.0.zip", "path": "/package/zscaler_zia/3.19.0", "icons": [ { "src": "/img/zscaler-logo.svg", "path": "/package/zscaler_zia/3.19.0/img/zscaler-logo.svg", "title": "Zscaler logo", "size": "32x32", "type": "image/svg+xml" } ], "conditions": { "kibana": { "version": "^8.18.0 || ^9.0.0" }, "elastic": { "subscription": "basic" } }, "owner": { "type": "elastic", "github": "elastic/security-service-integrations" }, "categories": [ "security", "network", "siem" ], "signature_path": "/epr/zscaler_zia/zscaler_zia-3.19.0.zip.sig", "format_version": "3.4.0", "readme": "/package/zscaler_zia/3.19.0/docs/README.md", "license": "basic", "screenshots": [ { "src": "/img/zscaler_zia-audit.png", "path": "/package/zscaler_zia/3.19.0/img/zscaler_zia-audit.png", "title": "Audit Logs Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/zscaler_zia-dns.png", "path": "/package/zscaler_zia/3.19.0/img/zscaler_zia-dns.png", "title": "DNS Logs Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/zscaler_zia-endpoint_dlp.png", "path": "/package/zscaler_zia/3.19.0/img/zscaler_zia-endpoint_dlp.png", "title": "Endpoint DLP Logs Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/zscaler_zia-firewall.png", "path": "/package/zscaler_zia/3.19.0/img/zscaler_zia-firewall.png", "title": "Firewall Logs Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/zscaler_zia-overview.png", "path": "/package/zscaler_zia/3.19.0/img/zscaler_zia-overview.png", "title": "Overview Logs Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/zscaler_zia-saas_security.png", "path": "/package/zscaler_zia/3.19.0/img/zscaler_zia-saas_security.png", "title": "SaaS Security Logs Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/zscaler_zia-sandbox_report.png", "path": "/package/zscaler_zia/3.19.0/img/zscaler_zia-sandbox_report.png", "title": "Sandbox Reports Logs Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/zscaler_zia-tunnel.png", "path": "/package/zscaler_zia/3.19.0/img/zscaler_zia-tunnel.png", "title": "Tunnel Logs Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/zscaler_zia-web_access_control.png", "path": "/package/zscaler_zia/3.19.0/img/zscaler_zia-web_access_control.png", "title": "Web Access Control Logs Dashboard", "size": "600x600", "type": "image/png" }, { "src": "/img/zscaler_zia-web_overview.png", "path": "/package/zscaler_zia/3.19.0/img/zscaler_zia-web_overview.png", "title": "Web Overview Logs Dashboard", "size": "600x600", "type": "image/png" } ], "assets": [ "/package/zscaler_zia/3.19.0/LICENSE.txt", "/package/zscaler_zia/3.19.0/changelog.yml", "/package/zscaler_zia/3.19.0/manifest.yml", "/package/zscaler_zia/3.19.0/validation.yml", "/package/zscaler_zia/3.19.0/docs/README.md", "/package/zscaler_zia/3.19.0/img/cloud_nss_feeds.png", "/package/zscaler_zia/3.19.0/img/escape_feed.png", "/package/zscaler_zia/3.19.0/img/nss_feeds.png", "/package/zscaler_zia/3.19.0/img/nss_server.png", "/package/zscaler_zia/3.19.0/img/zscaler-logo.svg", "/package/zscaler_zia/3.19.0/img/zscaler_zia-audit.png", "/package/zscaler_zia/3.19.0/img/zscaler_zia-dns.png", "/package/zscaler_zia/3.19.0/img/zscaler_zia-endpoint_dlp.png", "/package/zscaler_zia/3.19.0/img/zscaler_zia-firewall.png", "/package/zscaler_zia/3.19.0/img/zscaler_zia-overview.png", "/package/zscaler_zia/3.19.0/img/zscaler_zia-saas_security.png", "/package/zscaler_zia/3.19.0/img/zscaler_zia-sandbox_report.png", "/package/zscaler_zia/3.19.0/img/zscaler_zia-tunnel.png", "/package/zscaler_zia/3.19.0/img/zscaler_zia-web_access_control.png", "/package/zscaler_zia/3.19.0/img/zscaler_zia-web_overview.png", "/package/zscaler_zia/3.19.0/kibana/tags.yml", "/package/zscaler_zia/3.19.0/data_stream/alerts/manifest.yml", "/package/zscaler_zia/3.19.0/data_stream/alerts/sample_event.json", "/package/zscaler_zia/3.19.0/data_stream/audit/manifest.yml", "/package/zscaler_zia/3.19.0/data_stream/audit/sample_event.json", "/package/zscaler_zia/3.19.0/data_stream/dns/manifest.yml", "/package/zscaler_zia/3.19.0/data_stream/dns/sample_event.json", "/package/zscaler_zia/3.19.0/data_stream/endpoint_dlp/manifest.yml", "/package/zscaler_zia/3.19.0/data_stream/endpoint_dlp/sample_event.json", "/package/zscaler_zia/3.19.0/data_stream/firewall/manifest.yml", "/package/zscaler_zia/3.19.0/data_stream/firewall/sample_event.json", "/package/zscaler_zia/3.19.0/data_stream/saas_security/manifest.yml", "/package/zscaler_zia/3.19.0/data_stream/saas_security/sample_event.json", "/package/zscaler_zia/3.19.0/data_stream/sandbox_report/manifest.yml", "/package/zscaler_zia/3.19.0/data_stream/sandbox_report/sample_event.json", "/package/zscaler_zia/3.19.0/data_stream/tunnel/manifest.yml", "/package/zscaler_zia/3.19.0/data_stream/tunnel/sample_event.json", "/package/zscaler_zia/3.19.0/data_stream/web/manifest.yml", "/package/zscaler_zia/3.19.0/data_stream/web/sample_event.json", "/package/zscaler_zia/3.19.0/kibana/dashboard/zscaler_zia-03b699de-70f6-4ef0-9fa9-49c035b62635.json", "/package/zscaler_zia/3.19.0/kibana/dashboard/zscaler_zia-44e6d836-f55d-495d-93e0-79da0637042e.json", "/package/zscaler_zia/3.19.0/kibana/dashboard/zscaler_zia-579d9380-382a-11ed-aa11-3bf35d6f0a84.json", "/package/zscaler_zia/3.19.0/kibana/dashboard/zscaler_zia-5de5ab5a-fd15-40bf-8f4c-5206f0ed7416.json", "/package/zscaler_zia/3.19.0/kibana/dashboard/zscaler_zia-78eeb3f0-381d-11ed-aa11-3bf35d6f0a84.json", "/package/zscaler_zia/3.19.0/kibana/dashboard/zscaler_zia-7b9f74b0-3820-11ed-aa11-3bf35d6f0a84.json", "/package/zscaler_zia/3.19.0/kibana/dashboard/zscaler_zia-a9875c50-7745-4feb-9c9c-8c2c54618e06.json", "/package/zscaler_zia/3.19.0/kibana/dashboard/zscaler_zia-b335cb40-3811-11ed-aa11-3bf35d6f0a84.json", "/package/zscaler_zia/3.19.0/kibana/dashboard/zscaler_zia-c12fb7c5-0f5c-4341-98fb-12dd197f00a6.json", "/package/zscaler_zia/3.19.0/kibana/dashboard/zscaler_zia-eec7265e-2cd3-422a-924a-c3db6f5d0a42.json", "/package/zscaler_zia/3.19.0/kibana/search/zscaler_zia-0a8c8745-4147-4027-9017-f8170336d48b.json", "/package/zscaler_zia/3.19.0/kibana/search/zscaler_zia-46bd26cc-0e3e-4d8c-aa1a-38ce9e006e2f.json", "/package/zscaler_zia/3.19.0/kibana/search/zscaler_zia-5290e0b2-4324-47f3-beb6-0af3a078b856.json", "/package/zscaler_zia/3.19.0/kibana/search/zscaler_zia-69b19dc6-a9dc-4009-b93e-485e77b96886.json", "/package/zscaler_zia/3.19.0/kibana/search/zscaler_zia-8fa90910-8a79-48c7-b9e5-a0c137a2f174.json", "/package/zscaler_zia/3.19.0/kibana/search/zscaler_zia-c6228fe8-e312-4c72-88f0-ef46959ac84c.json", "/package/zscaler_zia/3.19.0/kibana/search/zscaler_zia-ce6524a6-67c1-466d-bd99-2ec9223b7f0c.json", "/package/zscaler_zia/3.19.0/data_stream/alerts/fields/base-fields.yml", "/package/zscaler_zia/3.19.0/data_stream/alerts/fields/beats.yml", "/package/zscaler_zia/3.19.0/data_stream/alerts/fields/fields.yml", "/package/zscaler_zia/3.19.0/data_stream/audit/fields/base-fields.yml", "/package/zscaler_zia/3.19.0/data_stream/audit/fields/beats.yml", "/package/zscaler_zia/3.19.0/data_stream/audit/fields/fields.yml", "/package/zscaler_zia/3.19.0/data_stream/dns/fields/base-fields.yml", "/package/zscaler_zia/3.19.0/data_stream/dns/fields/beats.yml", "/package/zscaler_zia/3.19.0/data_stream/dns/fields/fields.yml", "/package/zscaler_zia/3.19.0/data_stream/endpoint_dlp/fields/base-fields.yml", "/package/zscaler_zia/3.19.0/data_stream/endpoint_dlp/fields/beats.yml", "/package/zscaler_zia/3.19.0/data_stream/endpoint_dlp/fields/fields.yml", "/package/zscaler_zia/3.19.0/data_stream/firewall/fields/base-fields.yml", "/package/zscaler_zia/3.19.0/data_stream/firewall/fields/beats.yml", "/package/zscaler_zia/3.19.0/data_stream/firewall/fields/fields.yml", "/package/zscaler_zia/3.19.0/data_stream/saas_security/fields/base-fields.yml", "/package/zscaler_zia/3.19.0/data_stream/saas_security/fields/beats.yml", "/package/zscaler_zia/3.19.0/data_stream/saas_security/fields/fields.yml", "/package/zscaler_zia/3.19.0/data_stream/sandbox_report/fields/base-fields.yml", "/package/zscaler_zia/3.19.0/data_stream/sandbox_report/fields/beats.yml", "/package/zscaler_zia/3.19.0/data_stream/sandbox_report/fields/fields.yml", "/package/zscaler_zia/3.19.0/data_stream/tunnel/fields/base-fields.yml", "/package/zscaler_zia/3.19.0/data_stream/tunnel/fields/beats.yml", "/package/zscaler_zia/3.19.0/data_stream/tunnel/fields/fields.yml", "/package/zscaler_zia/3.19.0/data_stream/web/fields/base-fields.yml", "/package/zscaler_zia/3.19.0/data_stream/web/fields/beats.yml", "/package/zscaler_zia/3.19.0/data_stream/web/fields/fields.yml", "/package/zscaler_zia/3.19.0/data_stream/alerts/agent/stream/tcp.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zia/3.19.0/data_stream/audit/agent/stream/http_endpoint.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/audit/agent/stream/tcp.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/audit/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zia/3.19.0/data_stream/dns/agent/stream/http_endpoint.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/dns/agent/stream/tcp.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zia/3.19.0/data_stream/endpoint_dlp/agent/stream/http_endpoint.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/endpoint_dlp/agent/stream/tcp.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/endpoint_dlp/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zia/3.19.0/data_stream/firewall/agent/stream/http_endpoint.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/firewall/agent/stream/tcp.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zia/3.19.0/data_stream/saas_security/agent/stream/http_endpoint.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/saas_security/agent/stream/tcp.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/saas_security/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zia/3.19.0/data_stream/sandbox_report/agent/stream/cel.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/sandbox_report/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zia/3.19.0/data_stream/tunnel/agent/stream/http_endpoint.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/tunnel/agent/stream/tcp.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml", "/package/zscaler_zia/3.19.0/data_stream/web/agent/stream/http_endpoint.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/web/agent/stream/tcp.yml.hbs", "/package/zscaler_zia/3.19.0/data_stream/web/elasticsearch/ingest_pipeline/default.yml" ], "policy_templates": [ { "name": "zscaler_zia", "title": "Zscaler Internet Access logs", "description": "Collect Zscaler Internet Access logs.", "inputs": [ { "type": "tcp", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "strict_fields", "type": "bool", "title": "Require Strict Field/Version Check", "description": "Whether to check for template version mismatch.", "multi": false, "required": false, "show_user": false } ], "title": "Collect Zscaler Internet Access logs via TCP input", "description": "Collecting Zscaler Internet Access logs via TCP input." }, { "type": "http_endpoint", "vars": [ { "name": "listen_address", "type": "text", "title": "Listen Address", "description": "The bind address to listen for http endpoint connections. Set to `0.0.0.0` to bind to all available interfaces.", "multi": false, "required": true, "show_user": true, "default": "localhost" }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" }, { "name": "secret_header", "type": "text", "title": "Secret Header", "description": "The header to check for a specific value specified by `secret.value`.", "multi": false, "required": false, "show_user": false }, { "name": "secret_value", "type": "password", "title": "Secret Value", "description": "The secret stored in the header name specified by `secret.header`.", "multi": false, "required": false, "show_user": false }, { "name": "strict_fields", "type": "bool", "title": "Require Strict Field/Version Check", "description": "Whether to check for template version mismatch.", "multi": false, "required": false, "show_user": false, "default": true } ], "title": "Collect Zscaler Internet Access logs via HTTP Endpoint", "description": "Collecting Zscaler Internet Access logs via HTTP Endpoint." }, { "type": "cel", "vars": [ { "name": "url", "type": "text", "title": "URL", "description": "Base URL of the Zscaler Internet Access logs API.", "multi": false, "required": true, "show_user": true }, { "name": "client_id", "type": "text", "title": "Client ID", "description": "Client ID of Zscaler Internet Access.", "multi": false, "required": true, "show_user": true }, { "name": "client_secret", "type": "password", "title": "Client Secret", "description": "Client secret of Zscaler Internet Access.", "multi": false, "required": true, "show_user": true }, { "name": "scope", "type": "text", "title": "Scope", "description": "Scope of Zscaler Internet Access.", "multi": false, "required": true, "show_user": true }, { "name": "token_url", "type": "text", "title": "Token URL", "description": "Token URL of Zscaler Internet Access.", "multi": false, "required": true, "show_user": false }, { "name": "proxy_url", "type": "text", "title": "Proxy URL", "description": "URL to proxy connections in the form of http[s]://:@:.", "multi": false, "required": false, "show_user": false }, { "name": "ssl", "type": "yaml", "title": "SSL Configuration", "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", "multi": false, "required": false, "show_user": false, "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" } ], "title": "Collect Zscaler Internet Access logs via API", "description": "Collecting Zscaler Internet Access logs via API." } ], "multiple": true, "deployment_modes": { "default": { "enabled": true }, "agentless": { "enabled": true } } } ], "data_streams": [ { "type": "logs", "dataset": "zscaler_zia.alerts", "title": "Alerts", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9010 }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#max_connections: 1\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-alerts" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`HTTP Endpoint` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Internet Access Alerts", "description": "Collect Zscaler Internet Access Alerts using TCP Input.", "enabled": false, "ingestion_method": "Network Protocol" } ], "package": "zscaler_zia", "path": "alerts" }, { "type": "logs", "dataset": "zscaler_zia.audit", "title": "Audit Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9029 }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#max_connections: 1\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Internet Access Audit Logs", "description": "Collect Zscaler Internet Access Audit logs using TCP Input.", "enabled": false, "ingestion_method": "Network Protocol" }, { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9562 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-audit" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`HTTP Endpoint` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html#_tracer_enabled_3) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Zscaler Internet Access Audit Logs", "description": "Collect Zscaler Internet Access Audit logs via HTTP Endpoint Input.", "enabled": false, "ingestion_method": "Webhook" } ], "package": "zscaler_zia", "path": "audit" }, { "type": "logs", "dataset": "zscaler_zia.dns", "title": "DNS logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9011 }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#max_connections: 1\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-dns" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Internet Access DNS Logs", "description": "Collect Zscaler Internet Access DNS logs using TCP Input.", "enabled": false, "ingestion_method": "Network Protocol" }, { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9556 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-dns" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`HTTP Endpoint` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html#_tracer_enabled_3) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Zscaler Internet Access DNS Logs", "description": "Collect Zscaler Internet Access DNS logs via HTTP Endpoint Input.", "enabled": false, "ingestion_method": "Webhook" } ], "package": "zscaler_zia", "path": "dns" }, { "type": "logs", "dataset": "zscaler_zia.endpoint_dlp", "title": "Endpoint DLP Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9023 }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#max_connections: 1\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-endpoint_dlp" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Internet Access Endpoint DLP Logs", "description": "Collect Zscaler Internet Access Endpoint DLP logs using TCP Input.", "enabled": false, "ingestion_method": "Network Protocol" }, { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9561 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-endpoint_dlp" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`HTTP Endpoint` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html#_tracer_enabled_3) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Zscaler Internet Access Endpoint DLP Logs", "description": "Collect Zscaler Internet Access Endpoint DLP logs via HTTP Endpoint Input.", "enabled": false, "ingestion_method": "Webhook" } ], "package": "zscaler_zia", "path": "endpoint_dlp" }, { "type": "logs", "dataset": "zscaler_zia.firewall", "title": "Firewall Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9012 }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#max_connections: 1\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-firewall" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Internet Access Firewall Logs", "description": "Collect Zscaler Internet Access Firewall Logs using TCP Input.", "enabled": false, "ingestion_method": "Network Protocol" }, { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9557 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-firewall" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`HTTP Endpoint` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html#_tracer_enabled_3) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Zscaler Internet Access Firewall Logs", "description": "Collect Zscaler Internet Access Firewall logs via HTTP Endpoint Input.", "enabled": false, "ingestion_method": "Webhook" } ], "package": "zscaler_zia", "path": "firewall" }, { "type": "logs", "dataset": "zscaler_zia.saas_security", "title": "SaaS Security Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9024 }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#max_connections: 1\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-saas_security" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Internet Access SaaS Security Logs", "description": "Collect Zscaler Internet Access SaaS Security Logs using TCP input.", "enabled": false, "ingestion_method": "Network Protocol" }, { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9563 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-saas_security" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`HTTP Endpoint` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html#_tracer_enabled_3) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Zscaler Internet Access SaaS Security Logs", "description": "Collect Zscaler Internet Access SaaS Security logs via HTTP Endpoint Input.", "enabled": false, "ingestion_method": "Webhook" } ], "package": "zscaler_zia", "path": "saas_security" }, { "type": "logs", "dataset": "zscaler_zia.sandbox_report", "title": "Sandbox Report Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "cel", "vars": [ { "name": "interval", "type": "text", "title": "Interval", "description": "Interval between two REST API calls. Supported units for this parameter are h/m/s.", "multi": false, "required": true, "show_user": true, "default": "24h" }, { "name": "http_client_timeout", "type": "text", "title": "HTTP Client Timeout", "description": "Duration before declaring that the HTTP client connection has timed out. Valid time units are ns, us, ms, s, m, h.", "multi": false, "required": true, "show_user": false, "default": "10m" }, { "name": "details", "type": "select", "title": "Details", "description": "Type of report, full or summary.", "multi": false, "required": true, "show_user": true }, { "name": "md5_hash", "type": "text", "title": "MD5 List", "description": "MD5 hash of the file that was analyzed by Sandbox.", "multi": true, "required": true, "show_user": true }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", "multi": false, "required": false, "show_user": false, "default": false }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-sandbox_report" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`HTTP Endpoint` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html) for details.\n", "multi": false, "required": false, "show_user": false } ], "template_path": "cel.yml.hbs", "title": "Zscaler Internet Access Sandbox Report Logs", "description": "Collecting Zscaler Internet Access Sandbox Report logs via API.", "enabled": false, "ingestion_method": "API" } ], "package": "zscaler_zia", "path": "sandbox_report" }, { "type": "logs", "dataset": "zscaler_zia.tunnel", "title": "Tunnel Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9013 }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#max_connections: 1\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-tunnel" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Internet Access Tunnel Logs", "description": "Collect Zscaler Internet Access Tunnel Logs using TCP Input.", "enabled": false, "ingestion_method": "Network Protocol" }, { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9558 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-tunnel" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`HTTP Endpoint` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html#_tracer_enabled_3) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Zscaler Internet Access Tunnel Logs", "description": "Collect Zscaler Internet Access Tunnel logs via HTTP Endpoint Input.", "enabled": false, "ingestion_method": "Webhook" } ], "package": "zscaler_zia", "path": "tunnel" }, { "type": "logs", "dataset": "zscaler_zia.web", "title": "Web Logs", "release": "ga", "ingest_pipeline": "default", "streams": [ { "input": "tcp", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The TCP port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9014 }, { "name": "tcp_options", "type": "yaml", "title": "Custom TCP Options", "description": "Specify custom configuration options for the TCP input.", "multi": false, "required": false, "show_user": false, "default": "#max_message_size: 50KiB\n#max_connections: 1\n" }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-web" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false } ], "template_path": "tcp.yml.hbs", "title": "Zscaler Internet Access Web Logs", "description": "Collect Zscaler Internet Access Web Logs using TCP input.", "enabled": false, "ingestion_method": "Network Protocol" }, { "input": "http_endpoint", "vars": [ { "name": "listen_port", "type": "integer", "title": "Listen Port", "description": "The port number to listen on.", "multi": false, "required": true, "show_user": true, "default": 9559 }, { "name": "tags", "type": "text", "title": "Tags", "multi": true, "required": true, "show_user": false, "default": [ "forwarded", "zscaler_zia-web" ] }, { "name": "preserve_original_event", "type": "bool", "title": "Preserve original event", "description": "Preserves a raw copy of the original event, added to the field `event.original`.", "multi": false, "required": true, "show_user": true, "default": false }, { "name": "preserve_duplicate_custom_fields", "type": "bool", "title": "Preserve duplicate custom fields", "description": "Preserve Custom fields that were copied to Elastic Common Schema (ECS) fields.", "multi": false, "required": false, "show_user": false }, { "name": "processors", "type": "yaml", "title": "Processors", "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details.", "multi": false, "required": false, "show_user": false }, { "name": "custom", "type": "yaml", "title": "Custom configurations", "description": "Additional settings to be added to the configuration. Be careful using this as it might break the input as those settings are not validated and can override the settings specified above. See [`HTTP Endpoint` input settings docs](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html) for details.\n", "multi": false, "required": false, "show_user": false }, { "name": "enable_request_tracer", "type": "bool", "title": "Enable request tracing", "description": "The request tracer logs HTTP requests to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html#_tracer_enabled_3) for details.", "multi": false, "required": false, "show_user": false, "default": false } ], "template_path": "http_endpoint.yml.hbs", "title": "Zscaler Internet Access Web Logs", "description": "Collect Zscaler Internet Access Web logs via HTTP Endpoint Input.", "enabled": false, "ingestion_method": "Webhook" } ], "package": "zscaler_zia", "path": "web" } ] }