/
manifest.json
65 lines (65 loc) · 1.76 KB
/
manifest.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
{
"id": "security_packetbeat",
"title": "Security: Packetbeat",
"description": "Detect suspicious network activity in Packetbeat data.",
"type": "Packetbeat data",
"logoFile": "logo.json",
"defaultIndexPattern": "packetbeat-*",
"query": {
"bool": {
"filter": [
{"term": {"agent.type": "packetbeat"}}
],
"must_not": { "terms": { "_tier": [ "data_frozen", "data_cold" ] } }
}
},
"jobs": [
{
"id": "packetbeat_dns_tunneling",
"file": "packetbeat_dns_tunneling.json"
},
{
"id": "packetbeat_rare_dns_question",
"file": "packetbeat_rare_dns_question.json"
},
{
"id": "packetbeat_rare_server_domain",
"file": "packetbeat_rare_server_domain.json"
},
{
"id": "packetbeat_rare_urls",
"file": "packetbeat_rare_urls.json"
},
{
"id": "packetbeat_rare_user_agent",
"file": "packetbeat_rare_user_agent.json"
}
],
"datafeeds": [
{
"id": "datafeed-packetbeat_dns_tunneling",
"file": "datafeed_packetbeat_dns_tunneling.json",
"job_id": "packetbeat_dns_tunneling"
},
{
"id": "datafeed-packetbeat_rare_dns_question",
"file": "datafeed_packetbeat_rare_dns_question.json",
"job_id": "packetbeat_rare_dns_question"
},
{
"id": "datafeed-packetbeat_rare_server_domain",
"file": "datafeed_packetbeat_rare_server_domain.json",
"job_id": "packetbeat_rare_server_domain"
},
{
"id": "datafeed-packetbeat_rare_urls",
"file": "datafeed_packetbeat_rare_urls.json",
"job_id": "packetbeat_rare_urls"
},
{
"id": "datafeed-packetbeat_rare_user_agent",
"file": "datafeed_packetbeat_rare_user_agent.json",
"job_id": "packetbeat_rare_user_agent"
}
]
}