updating manifest files for filebeat threatintel module (elastic#24074)

* updating manifest files for filebeat threatintel module * split on new object type in config
P1llus · Feb 17, 2021 · f9fe84d · f9fe84d
1 parent e332d9d
commit f9fe84d
Show file tree

Hide file tree

Showing 6 changed files with 116 additions and 103 deletions.
diff --git a/x-pack/filebeat/module/threatintel/anomali/config/config.yml b/x-pack/filebeat/module/threatintel/anomali/config/config.yml
@@ -4,9 +4,12 @@ type: httpjson
 config_version: "2"
 interval: {{ .interval }}
 
+{{ if .username }}
 auth.basic.user: {{ .username }}
+{{ end }}
+{{ if .password }}
 auth.basic.password: {{ .password }}
-
+{{ end }}
 request.method: GET
 {{ if .ssl }}
   - request.ssl: {{ .ssl | tojson }}
@@ -32,7 +35,7 @@ request.transforms:
     default: '[[ formatDate (now (parseDuration "-{{ .first_interval }}")) "2006-01-02T15:04:05.999Z" ]]'
 
 response.split:
-  target: body.results
+  target: body.objects
 
 cursor:
   timestamp:

diff --git a/x-pack/filebeat/module/threatintel/anomali/manifest.yml b/x-pack/filebeat/module/threatintel/anomali/manifest.yml
@@ -5,6 +5,8 @@ var:
     default: httpjson
   - name: interval
     default: 60m
+  - name: first_interval
+    default: 24h
   - name: ssl
   - name: types
     default: indicators
@@ -13,7 +15,7 @@ var:
   - name: url
     default: "https://otx.alienvault.com/api/v1/indicators/export"
   - name: tags
-    default: [threatintel-otx, forwarded]
+    default: [threatintel-anomali, forwarded]
 
 ingest_pipeline:
   - ingest/pipeline.yml