/
manifest.json
65 lines (65 loc) · 1.73 KB
/
manifest.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
{
"id": "siem_cloudtrail",
"title": "Security: Cloudtrail",
"description": "Detect suspicious activity recorded in your cloudtrail logs.",
"type": "Filebeat data",
"logoFile": "logo.json",
"defaultIndexPattern": "filebeat-*",
"query": {
"bool": {
"filter": [
{"term": {"event.dataset": "aws.cloudtrail"}}
],
"must_not": { "terms": { "_tier": [ "data_frozen", "data_cold" ] } }
}
},
"jobs": [
{
"id": "rare_method_for_a_city",
"file": "rare_method_for_a_city.json"
},
{
"id": "rare_method_for_a_country",
"file": "rare_method_for_a_country.json"
},
{
"id": "rare_method_for_a_username",
"file": "rare_method_for_a_username.json"
},
{
"id": "high_distinct_count_error_message",
"file": "high_distinct_count_error_message.json"
},
{
"id": "rare_error_code",
"file": "rare_error_code.json"
}
],
"datafeeds": [
{
"id": "datafeed-rare_method_for_a_city",
"file": "datafeed_rare_method_for_a_city.json",
"job_id": "rare_method_for_a_city"
},
{
"id": "datafeed-rare_method_for_a_country",
"file": "datafeed_rare_method_for_a_country.json",
"job_id": "rare_method_for_a_country"
},
{
"id": "datafeed-rare_method_for_a_username",
"file": "datafeed_rare_method_for_a_username.json",
"job_id": "rare_method_for_a_username"
},
{
"id": "datafeed-high_distinct_count_error_message",
"file": "datafeed_high_distinct_count_error_message.json",
"job_id": "high_distinct_count_error_message"
},
{
"id": "datafeed-rare_error_code",
"file": "datafeed_rare_error_code.json",
"job_id": "rare_error_code"
}
]
}