-
Notifications
You must be signed in to change notification settings - Fork 8k
/
manifest.json
66 lines (66 loc) · 1.77 KB
/
manifest.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
{
"id": "security_packetbeat",
"title": "Security: Packetbeat",
"description": "Detect suspicious activity in Packetbeat data.",
"type": "Packetbeat data",
"logoFile": "logo.json",
"defaultIndexPattern": "packetbeat-*,logs-*",
"query": {
"bool": {
"filter": [{ "term": { "agent.type": "packetbeat" } }],
"must_not": { "terms": { "_tier": ["data_frozen", "data_cold"] } }
}
},
"jobs": [
{
"id": "packetbeat_dns_tunneling",
"file": "packetbeat_dns_tunneling.json"
},
{
"id": "packetbeat_rare_dns_question",
"file": "packetbeat_rare_dns_question.json"
},
{
"id": "packetbeat_rare_server_domain",
"file": "packetbeat_rare_server_domain.json"
},
{
"id": "packetbeat_rare_urls",
"file": "packetbeat_rare_urls.json"
},
{
"id": "packetbeat_rare_user_agent",
"file": "packetbeat_rare_user_agent.json"
}
],
"datafeeds": [
{
"id": "datafeed-packetbeat_dns_tunneling",
"file": "datafeed_packetbeat_dns_tunneling.json",
"job_id": "packetbeat_dns_tunneling"
},
{
"id": "datafeed-packetbeat_rare_dns_question",
"file": "datafeed_packetbeat_rare_dns_question.json",
"job_id": "packetbeat_rare_dns_question"
},
{
"id": "datafeed-packetbeat_rare_server_domain",
"file": "datafeed_packetbeat_rare_server_domain.json",
"job_id": "packetbeat_rare_server_domain"
},
{
"id": "datafeed-packetbeat_rare_urls",
"file": "datafeed_packetbeat_rare_urls.json",
"job_id": "packetbeat_rare_urls"
},
{
"id": "datafeed-packetbeat_rare_user_agent",
"file": "datafeed_packetbeat_rare_user_agent.json",
"job_id": "packetbeat_rare_user_agent"
}
],
"tags": [
"security"
]
}