diff --git a/packages/zscaler_zia/0.1.0/changelog.yml b/packages/zscaler_zia/0.1.0/changelog.yml deleted file mode 100755 index 3ecf65eb1b..0000000000 --- a/packages/zscaler_zia/0.1.0/changelog.yml +++ /dev/null @@ -1,6 +0,0 @@ -# newer versions go on top -- version: "0.1.0" - changes: - - description: Initial draft of the package - type: enhancement - link: https://github.com/elastic/integrations/pull/2459 diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/agent/stream/tcp.yml.hbs b/packages/zscaler_zia/0.1.0/data_stream/alerts/agent/stream/tcp.yml.hbs deleted file mode 100755 index 49e3770cb1..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,23 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -processors: -- drop_event: - when: - equals: - message: "" -{{#if processors}} -{{processors}} -{{/if}} diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index 8f9acf997c..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,52 +0,0 @@ ---- -description: Pipeline for Zscaler alert logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - grok: - field: event.original - patterns: - - <%{NUMBER:log.syslog.priority:long}>%{SYSLOGTIMESTAMP:_tmp.timestamp} \[%{IPORHOST:destination.address}\] %{GREEDYDATA:message} - - grok: - field: message - patterns: - - 'ZscalerNSS: Zscaler cloud configuration connection to %{IPORHOST:destination.address}:%{NUMBER:destination.port:long} lost and unavailable for the past %{NUMBER:zscaler_zia.alerts.connection_lost_minutes:double} minutes' - - 'ZscalerNSS: SIEM Feed connection "%{GREEDYDATA:zscaler_zia.alerts.log_feed_name}" to %{IPORHOST:destination.address}:%{NUMBER:destination.port:long} lost and unavailable for the past %{NUMBER:zscaler_zia.alerts.connection_lost_minutes:double} minutes' - ignore_failure: true - - convert: - field: destination.address - target_field: destination.ip - type: ip - ignore_failure: true - - append: - field: related.ip - value: "{{{destination.ip}}}" - if: ctx?.destination?.ip != null - ignore_failure: true - - date: - field: _tmp.timestamp - target_field: '@timestamp' - ignore_failure: true - formats: - - MMM d HH:mm:ss - - MMM dd HH:mm:ss - - MMM d HH:mm:ss - - ISO8601 - - remove: - field: - - _tmp - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/agent.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/base-fields.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/base-fields.yml deleted file mode 100755 index bddad62cfe..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zia -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zia.alerts diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/ecs.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/ecs.yml deleted file mode 100755 index 94ad86350f..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/ecs.yml +++ /dev/null @@ -1,33 +0,0 @@ -- description: |- - Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. - Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. - name: destination.address - type: keyword -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: Port of the destination. - name: destination.port - type: long -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - Syslog numeric priority of the event, if available. - According to RFCs 5424 and 3164, the priority is 8 * facility + severity. This number is therefore expected to contain a value between 0 and 191. - name: log.syslog.priority - type: long -- description: |- - For log events the message field contains the log message, optimized for viewing in a log viewer. - For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. - If multiple messages exist, they can be combined into one message. - name: message - type: match_only_text -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: List of keywords used to tag each event. - name: tags - type: keyword diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/fields.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/fields.yml deleted file mode 100755 index 38608a7891..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/fields/fields.yml +++ /dev/null @@ -1,14 +0,0 @@ -- name: zscaler_zia.alerts - type: group - fields: - - name: connection_lost_minutes - type: double - description: | - Amount of time after loosing connection to a server in Minutes. - - name: log_feed_name - type: keyword - description: | - Name of the NSS log feed. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/manifest.yml b/packages/zscaler_zia/0.1.0/data_stream/alerts/manifest.yml deleted file mode 100755 index 1bd14b8c53..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: Alerts -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Internet Access Alerts - description: Collect Zscaler Internet Access Alerts using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9010 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zia-alerts - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zia/0.1.0/data_stream/alerts/sample_event.json b/packages/zscaler_zia/0.1.0/data_stream/alerts/sample_event.json deleted file mode 100755 index 0749ca369a..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/alerts/sample_event.json +++ /dev/null @@ -1,61 +0,0 @@ -{ - "@timestamp": "2022-12-10T13:40:32.000Z", - "agent": { - "ephemeral_id": "8c093fcf-fb2f-4baa-b794-40edb011194d", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "zscaler_zia.alerts", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "81.2.69.193", - "ip": "81.2.69.193", - "port": 9012 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "dataset": "zscaler_zia.alerts", - "ingested": "2022-02-04T06:31:25Z" - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:32902" - }, - "syslog": { - "priority": 114 - } - }, - "message": "ZscalerNSS: SIEM Feed connection \"DNS Logs Feed\" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes", - "related": { - "ip": [ - "81.2.69.193" - ] - }, - "tags": [ - "forwarded", - "zscaler_zia-alerts" - ], - "zscaler_zia": { - "alerts": { - "connection_lost_minutes": 2440, - "log_feed_name": "DNS Logs Feed" - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/agent/stream/tcp.yml.hbs b/packages/zscaler_zia/0.1.0/data_stream/dns/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index cbad42a808..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,209 +0,0 @@ ---- -description: Pipeline for Zscaler dns logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: resp - - rename: - field: resp.event - target_field: json - - remove: - field: resp - ignore_missing: true - - date: - field: json.datetime - target_field: "@timestamp" - ignore_failure: true - formats: - - E MMM dd HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - remove: - field: json.datetime - ignore_missing: true - - set: - field: event.category - value: network - - set: - field: event.kind - value: event - - append: - field: event.type - value: info - - rename: - field: json.clt_sip - target_field: client.ip - ignore_missing: true - - geoip: - field: client.ip - target_field: client.geo - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: client.ip - target_field: client.as - properties: - - asn - - organization_name - ignore_missing: true - - append: - field: related.ip - value: "{{{client.ip}}}" - if: ctx?.client?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.dns_resp - target_field: dns.answers.name - ignore_missing: true - - rename: - field: json.dns_req - target_field: dns.question.name - ignore_missing: true - - rename: - field: json.dns_reqtype - target_field: dns.question.type - ignore_missing: true - - rename: - field: json.srv_dip - target_field: server.ip - ignore_missing: true - - geoip: - field: server.ip - target_field: server.geo - ignore_missing: true - - geoip: - database_file: GeoLite2-ASN.mmdb - field: server.ip - target_field: server.as - properties: - - asn - - organization_name - ignore_missing: true - - append: - field: related.ip - value: "{{{server.ip}}}" - if: ctx?.server?.ip != null - allow_duplicates: false - ignore_failure: true - - convert: - field: json.srv_dport - target_field: server.port - type: long - ignore_failure: true - - remove: - field: json.srv_dport - ignore_missing: true - - urldecode: - field: json.user - target_field: user.email - ignore_missing: true - - remove: - field: json.user - ignore_missing: true - - rename: - field: json.deviceowner - target_field: user.name - ignore_missing: true - - urldecode: - field: json.department - target_field: zscaler_zia.dns.department - ignore_missing: true - - remove: - field: json.department - ignore_missing: true - - urldecode: - field: json.location - target_field: zscaler_zia.dns.location - ignore_missing: true - - remove: - field: json.location - ignore_missing: true - - rename: - field: json.reqaction - target_field: zscaler_zia.dns.request.action - ignore_missing: true - - rename: - field: json.resaction - target_field: zscaler_zia.dns.response.action - ignore_missing: true - - urldecode: - field: json.reqrulelabel - target_field: zscaler_zia.dns.request.rule.label - ignore_missing: true - - remove: - field: json.reqrulelabel - ignore_missing: true - - urldecode: - field: json.resrulelabel - target_field: zscaler_zia.dns.response.rule.label - ignore_missing: true - - remove: - field: json.resrulelabel - ignore_missing: true - - convert: - field: json.durationms - target_field: zscaler_zia.dns.duration.milliseconds - type: long - ignore_failure: true - - remove: - field: json.durationms - ignore_missing: true - - rename: - field: json.category - target_field: zscaler_zia.dns.dom.category - ignore_missing: true - - rename: - field: json.devicehostname - target_field: zscaler_zia.dns.hostname - ignore_missing: true - - append: - field: related.hosts - value: "{{{zscaler_zia.dns.hostname}}}" - if: ctx?.zscaler_zia?.dns?.hostname != null - allow_duplicates: false - ignore_failure: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zia.dns - lang: painless - if: ctx.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zia.dns[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_failure: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/agent.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/base-fields.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/fields/base-fields.yml deleted file mode 100755 index cc2e29669e..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zia -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zia.dns diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/ecs.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/fields/ecs.yml deleted file mode 100755 index 85de65a321..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/ecs.yml +++ /dev/null @@ -1,98 +0,0 @@ -- description: City name. - name: client.geo.city_name - type: keyword -- description: Name of the continent. - name: client.geo.continent_name - type: keyword -- description: Country ISO code. - name: client.geo.country_iso_code - type: keyword -- description: Country name. - name: client.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: client.geo.location - type: geo_point -- description: Region ISO code. - name: client.geo.region_iso_code - type: keyword -- description: Region name. - name: client.geo.region_name - type: keyword -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: |- - The domain name to which this resource record pertains. - If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. - name: dns.answers.name - type: keyword -- description: |- - The name being queried. - If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. - name: dns.question.name - type: keyword -- description: The type of record being queried. - name: dns.question.type - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: City name. - name: server.geo.city_name - type: keyword -- description: Name of the continent. - name: server.geo.continent_name - type: keyword -- description: Country ISO code. - name: server.geo.country_iso_code - type: keyword -- description: Country name. - name: server.geo.country_name - type: keyword -- description: Longitude and latitude. - level: core - name: server.geo.location - type: geo_point -- description: Region ISO code. - name: server.geo.region_iso_code - type: keyword -- description: Region name. - name: server.geo.region_name - type: keyword -- description: IP address of the server (IPv4 or IPv6). - name: server.ip - type: ip -- description: Port of the server. - name: server.port - type: long -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: Packets sent from the source to the destination. - name: source.packets - type: long -- description: Port of the source. - name: source.port - type: long -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: User email address. - name: user.email - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/fields.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/fields/fields.yml deleted file mode 100755 index ae183b145c..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/fields/fields.yml +++ /dev/null @@ -1,48 +0,0 @@ -- name: zscaler_zia.dns - type: group - fields: - - name: department - type: keyword - description: | - Department of the user. - - name: dom.category - type: keyword - description: | - URL Category of the FQDN in the DNS request. - - name: duration.milliseconds - type: long - description: | - Duration of the DNS request in milliseconds. - - name: hostname - type: keyword - description: | - N/A - - name: location - type: keyword - description: | - Gateway location or sub-location of the source. - - name: request - type: group - fields: - - name: action - type: keyword - description: | - Name of the action that was applied to the DNS request. - - name: rule.label - type: keyword - description: | - Name of the rule that was applied to the DNS request. - - name: response - type: group - fields: - - name: action - type: keyword - description: | - Name of the action that was applied to the DNS response. - - name: rule.label - type: keyword - description: |- - Name of the rule that was applied to the DNS response. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/manifest.yml b/packages/zscaler_zia/0.1.0/data_stream/dns/manifest.yml deleted file mode 100755 index a47e838e8c..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: DNS logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Internet Access DNS Logs - description: Collect Zscaler Internet Access DNS logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9011 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zia-dns - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zia/0.1.0/data_stream/dns/sample_event.json b/packages/zscaler_zia/0.1.0/data_stream/dns/sample_event.json deleted file mode 100755 index 86b91a6988..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/dns/sample_event.json +++ /dev/null @@ -1,124 +0,0 @@ -{ - "@timestamp": "2021-12-17T07:27:54.000Z", - "agent": { - "ephemeral_id": "d288c261-b8db-45af-99c0-a673c3c6d8e1", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.193" - }, - "data_stream": { - "dataset": "zscaler_zia.dns", - "namespace": "ep", - "type": "logs" - }, - "dns": { - "answers": { - "name": "Some response string" - }, - "question": { - "name": "example.com", - "type": "Some type" - } - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.dns", - "ingested": "2022-02-04T06:32:56Z", - "kind": "event", - "type": [ - "info" - ] - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:54202" - } - }, - "related": { - "hosts": [ - "Machine9000" - ], - "ip": [ - "81.2.69.193", - "81.2.69.144" - ] - }, - "server": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144", - "port": 8080 - }, - "tags": [ - "forwarded", - "zscaler_zia-dns" - ], - "user": { - "email": "some_user@example.com", - "name": "Owner77" - }, - "zscaler_zia": { - "dns": { - "department": "Unknown", - "dom": { - "category": "Professional Services" - }, - "duration": { - "milliseconds": 123456 - }, - "hostname": "Machine9000", - "location": "TestLoc DB", - "request": { - "action": "REQ_ALLOW", - "rule": { - "label": "Access Blocked" - } - }, - "response": { - "action": "Some Response Action", - "rule": { - "label": "None" - } - } - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/agent/stream/tcp.yml.hbs b/packages/zscaler_zia/0.1.0/data_stream/firewall/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index f27a8cfea0..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,270 +0,0 @@ ---- -description: Pipeline for Zscaler firewall logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: resp - - rename: - field: resp.event - target_field: json - - remove: - field: resp - ignore_missing: true - - set: - field: event.category - value: network - - set: - field: event.kind - value: event - - set: - field: event.type - value: info - - date: - field: json.datetime - target_field: "@timestamp" - ignore_failure: true - formats: - - E MMM dd HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - remove: - field: json.datetime - ignore_failure: true - - rename: - field: json.outbytes - target_field: client.bytes - ignore_missing: true - - rename: - field: json.devicehostname - target_field: host.hostname - ignore_missing: true - - rename: - field: json.nwapp - target_field: network.application - ignore_missing: true - - rename: - field: json.nwsvc - target_field: network.protocol - ignore_missing: true - - lowercase: - field: network.protocol - ignore_missing: true - - rename: - field: json.proto - target_field: network.transport - ignore_missing: true - - lowercase: - field: network.transport - ignore_missing: true - - append: - field: rule.name - value: "{{{json.rulelabel}}}" - if: ctx?.json?.rulelabel != null - allow_duplicates: false - - append: - field: rule.name - value: "{{{json.ipsrulelabel}}}" - if: ctx?.json?.ipsrulelabel != null - allow_duplicates: false - - urldecode: - field: rule.name - ignore_failure: true - - remove: - field: json.rulelabel - ignore_missing: true - - remove: - field: json.ipsrulelabel - ignore_missing: true - - rename: - field: json.inbytes - target_field: server.bytes - ignore_missing: true - - rename: - field: json.destcountry - target_field: server.geo.country_name - ignore_missing: true - - urldecode: - field: json.user - target_field: user.email - ignore_missing: true - - remove: - field: json.user - ignore_missing: true - - rename: - field: json.deviceowner - target_field: user.name - ignore_missing: true - - urldecode: - field: json.department - target_field: zscaler_zia.firewall.department - ignore_missing: true - - remove: - field: json.department - ignore_missing: true - - urldecode: - field: json.locationname - target_field: zscaler_zia.firewall.location.name - ignore_missing: true - - remove: - field: json.locationname - ignore_missing: true - - rename: - field: json.cdport - target_field: zscaler_zia.firewall.client.destination.port - ignore_missing: true - - rename: - field: json.csport - target_field: zscaler_zia.firewall.client.source.port - ignore_missing: true - - rename: - field: json.sdport - target_field: zscaler_zia.firewall.server.destination.port - ignore_missing: true - - rename: - field: json.ssport - target_field: zscaler_zia.firewall.server.source.port - ignore_missing: true - - append: - field: related.ip - value: "{{{json.csip}}}" - if: ctx?.json?.csip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.csip - target_field: zscaler_zia.firewall.client.source.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{json.cdip}}}" - if: ctx?.json?.cdip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.cdip - target_field: zscaler_zia.firewall.client.destination.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{json.ssip}}}" - if: ctx?.json?.ssip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.ssip - target_field: zscaler_zia.firewall.server.source.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{json.sdip}}}" - if: ctx?.json?.sdip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.sdip - target_field: zscaler_zia.firewall.server.destination.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{json.tsip}}}" - if: ctx?.json?.tsip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.tsip - target_field: zscaler_zia.firewall.tunnel.ip - ignore_missing: true - - rename: - field: json.tunsport - target_field: zscaler_zia.firewall.tunnel.port - ignore_missing: true - - rename: - field: json.tuntype - target_field: zscaler_zia.firewall.tunnel.type - ignore_missing: true - - rename: - field: json.action - target_field: event.action - ignore_missing: true - - lowercase: - field: event.action - ignore_missing: true - - rename: - field: json.dnat - target_field: zscaler_zia.firewall.nat - ignore_missing: true - - rename: - field: json.stateful - target_field: zscaler_zia.firewall.stateful - ignore_missing: true - - rename: - field: json.aggregate - target_field: zscaler_zia.firewall.aggregate - ignore_missing: true - - rename: - field: json.ipcat - target_field: zscaler_zia.firewall.ip_category - ignore_missing: true - - rename: - field: json.avgduration - target_field: zscaler_zia.firewall.duration.avg - ignore_missing: true - - rename: - field: json.duration - target_field: zscaler_zia.firewall.duration.seconds - ignore_missing: true - - rename: - field: json.durationms - target_field: zscaler_zia.firewall.duration.milliseconds - ignore_missing: true - - rename: - field: json.numsessions - target_field: zscaler_zia.firewall.session.count - ignore_missing: true - - rename: - field: json.threatcat - target_field: zscaler_zia.firewall.threat.category - ignore_missing: true - - rename: - field: json.threatname - target_field: zscaler_zia.firewall.threat.name - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zia.firewall - lang: painless - if: ctx?.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zia.firewall[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{_ingest.on_failure_message}}}" diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/agent.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/base-fields.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/base-fields.yml deleted file mode 100755 index b5aac8833c..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zia -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zia.firewall diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/ecs.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/ecs.yml deleted file mode 100755 index d8626d9fa5..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/ecs.yml +++ /dev/null @@ -1,55 +0,0 @@ -- description: Bytes sent from the client to the server. - name: client.bytes - type: long -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - Hostname of the host. - It normally contains what the `hostname` command returns on the host machine. - name: host.hostname - type: keyword -- description: |- - When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. - For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. - The field value must be normalized to lowercase for querying. - name: network.application - type: keyword -- description: |- - In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. - The field value must be normalized to lowercase for querying. - name: network.protocol - type: keyword -- description: |- - Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) - The field value must be normalized to lowercase for querying. - name: network.transport - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: Bytes sent from the server to the client. - name: server.bytes - type: long -- description: Country name. - name: server.geo.country_name - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: User email address. - name: user.email - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/fields.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/fields.yml deleted file mode 100755 index c8b4137da0..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/fields/fields.yml +++ /dev/null @@ -1,127 +0,0 @@ -- name: zscaler_zia.firewall - type: group - fields: - - name: department - type: keyword - description: | - Department of the user. - - name: location - type: group - fields: - - name: name - type: keyword - description: | - Name of the location from which the session was initiated. - - name: client - type: group - fields: - - name: destination - type: group - fields: - - name: port - type: double - description: | - Client destination port. For aggregated sessions, this is the client destination port of the last session in the aggregate. - - name: ip - type: keyword - description: | - Client destination IP address. For aggregated sessions, this is the client destination IP address of the last session in the aggregate. - - name: source - type: group - fields: - - name: port - type: double - description: | - Client source port. For aggregated sessions, this is the client source port of the last session in the aggregate. - - name: ip - type: keyword - description: | - Client source IP address. For aggregated sessions, this is the client source IP address of the last session in the aggregate. - - name: server - type: group - fields: - - name: destination - type: group - fields: - - name: port - type: double - description: | - Server destination port. For aggregated sessions, this is the server destination port of the last session in the aggregate. - - name: ip - type: keyword - description: | - Server Destination IP address. For aggregated sessions, this is the server destination IP address of the last session in the aggregate. - - name: source - type: group - fields: - - name: port - type: double - description: | - Server source port. For aggregated sessions, this is the server source port of the last session in the aggregate. - - name: ip - type: keyword - description: | - Server source IP address. For aggregated sessions, this is the server source IP address of the last session in the aggregate. - - name: tunnel - type: group - fields: - - name: ip - type: keyword - description: | - Tunnel IP address of the client (source). For aggregated sessions, this is the client's tunnel IP address corresponding to the last session in the aggregate. - - name: port - type: double - description: | - Tunnel port on the client side. For aggregated sessions, this is the client's tunnel port corresponding to the last session in the aggregate. - - name: type - type: keyword - description: | - Traffic forwarding method used to send the traffic to the firewall. - - name: nat - type: keyword - description: | - Indicates if the destination NAT policy was applied. - - name: stateful - type: keyword - - name: aggregate - type: keyword - - name: ip_category - type: keyword - description: | - URL category that corresponds to the server IP address. - - name: duration - type: group - fields: - - name: avg - type: double - description: | - Average session duration, in milliseconds, if the sessions were aggregated. - - name: seconds - type: double - description: | - Session or request duration in seconds. - - name: milliseconds - type: double - description: | - Session or request duration in milliseconds. - - name: session - type: group - fields: - - name: count - type: double - description: | - Number of sessions that were aggregated. - - name: threat - type: group - fields: - - name: category - type: keyword - description: | - Category of the threat in the Firewall session by the IPS engine. - - name: name - type: keyword - description: | - Name of the threat detected in the Firewall session by the IPS engine. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/manifest.yml b/packages/zscaler_zia/0.1.0/data_stream/firewall/manifest.yml deleted file mode 100755 index 6da5481a66..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: Firewall Logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Internet Access Firewall Logs - description: Collect Zscaler Internet Access Firewall Logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9012 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zia-firewall - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zia/0.1.0/data_stream/firewall/sample_event.json b/packages/zscaler_zia/0.1.0/data_stream/firewall/sample_event.json deleted file mode 100755 index d5914ddf13..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/firewall/sample_event.json +++ /dev/null @@ -1,127 +0,0 @@ -{ - "@timestamp": "2021-12-17T07:27:54.000Z", - "agent": { - "ephemeral_id": "41987f90-74dc-4b4b-9936-4347028cf558", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "bytes": 1734 - }, - "data_stream": { - "dataset": "zscaler_zia.firewall", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "action": "drop", - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.firewall", - "ingested": "2022-02-04T06:34:17Z", - "kind": "event", - "original": "{ \"sourcetype\" : \"zscalernss-fw\", \"event\" :{\"datetime\":\"Fri Dec 17 07:27:54 2021\",\"user\":\"some_user@example.com\",\"department\":\"Unknown\",\"locationname\":\"TestLoc%20DB\",\"cdport\":443,\"csport\":55018,\"sdport\":443,\"ssport\":0,\"csip\":\"0.0.0.0\",\"cdip\":\"0.0.0.0\",\"ssip\":\"0.0.0.0\",\"sdip\":\"0.0.0.0\",\"tsip\":\"0.0.0.0\",\"tunsport\":0,\"tuntype\":\"ZscalerClientConnector\",\"action\":\"Drop\",\"dnat\":\"No\",\"stateful\":\"Yes\",\"aggregate\":\"No\",\"nwsvc\":\"HTTPS\",\"nwapp\":\"http\",\"proto\":\"TCP\",\"ipcat\":\"Test Name\",\"destcountry\":\"Ireland\",\"avgduration\":486,\"rulelabel\":\"Access%20Blocked\",\"inbytes\":19052,\"outbytes\":1734,\"duration\":0,\"durationms\":486,\"numsessions\":1,\"ipsrulelabel\":\"None\",\"threatcat\":\"None\",\"threatname\":\"None\",\"deviceowner\":\"admin77\",\"devicehostname\":\"Machine9000\"}}", - "type": "info" - }, - "host": { - "hostname": "Machine9000" - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:58194" - } - }, - "network": { - "application": "http", - "protocol": "https", - "transport": "tcp" - }, - "related": { - "ip": [ - "0.0.0.0" - ] - }, - "rule": { - "name": [ - "Access Blocked", - "None" - ] - }, - "server": { - "bytes": 19052, - "geo": { - "country_name": "Ireland" - } - }, - "tags": [ - "forwarded", - "zscaler_zia-firewall" - ], - "user": { - "email": "some_user@example.com", - "name": "admin77" - }, - "zscaler_zia": { - "firewall": { - "aggregate": "No", - "client": { - "destination": { - "ip": "0.0.0.0", - "port": 443 - }, - "source": { - "ip": "0.0.0.0", - "port": 55018 - } - }, - "department": "Unknown", - "duration": { - "avg": 486, - "milliseconds": 486, - "seconds": 0 - }, - "ip_category": "Test Name", - "location": { - "name": "TestLoc DB" - }, - "nat": "No", - "server": { - "destination": { - "ip": "0.0.0.0", - "port": 443 - }, - "source": { - "ip": "0.0.0.0", - "port": 0 - } - }, - "session": { - "count": 1 - }, - "stateful": "Yes", - "threat": { - "category": "None", - "name": "None" - }, - "tunnel": { - "ip": "0.0.0.0", - "port": 0, - "type": "ZscalerClientConnector" - } - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/agent/stream/tcp.yml.hbs b/packages/zscaler_zia/0.1.0/data_stream/tunnel/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index a62b7ab78e..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,292 +0,0 @@ ---- -description: Pipeline for Zscaler tunnel logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: resp - - rename: - field: resp.event - target_field: json - - remove: - field: resp - ignore_missing: true - - date: - field: json.datetime - target_field: "@timestamp" - ignore_failure: true - formats: - - E MMM dd HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - remove: - field: json.datetime - ignore_missing: true - - set: - field: event.category - value: network - - set: - field: event.kind - value: event - - append: - field: event.type - value: info - - rename: - field: json.recordid - target_field: event.id - ignore_missing: true - - rename: - field: json.event - target_field: event.action - ignore_missing: true - - rename: - field: json.eventreason - target_field: event.reason - ignore_missing: true - - rename: - field: json.destinationip - target_field: destination.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{destination.ip}}}" - if: ctx?.destination?.ip != null - allow_duplicates: false - ignore_failure: true - - convert: - field: json.destinationport - target_field: destination.port - type: long - ignore_missing: true - - remove: - field: json.destinationport - ignore_missing: true - - rename: - field: json.sourceip - target_field: source.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{source.ip}}}" - if: ctx?.source?.ip != null - allow_duplicates: false - ignore_failure: true - - convert: - field: json.sourceport - target_field: source.port - type: long - ignore_missing: true - - remove: - field: json.sourceport - ignore_missing: true - - urldecode: - field: json.user - target_field: user.name - ignore_missing: true - - remove: - field: json.user - ignore_missing: true - - append: - field: related.user - value: "{{{user.name}}}" - if: ctx?.user?.name != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.rxbytes - target_field: destination.bytes - ignore_missing: true - - rename: - field: json.rxpackets - target_field: destination.packets - ignore_missing: true - - rename: - field: json.txbytes - target_field: source.bytes - ignore_missing: true - - rename: - field: json.txpackets - target_field: source.packets - ignore_missing: true - - rename: - field: json.Recordtype - target_field: zscaler_zia.tunnel.action.type - ignore_missing: true - - urldecode: - field: json.location - target_field: zscaler_zia.tunnel.location.name - ignore_missing: true - - remove: - field: json.location - ignore_missing: true - - convert: - field: json.lifetime - target_field: zscaler_zia.tunnel.life.time - type: long - ignore_missing: true - - remove: - field: json.lifetime - ignore_missing: true - - convert: - field: json.ikeversion - target_field: zscaler_zia.tunnel.ike.version - type: integer - ignore_missing: true - - remove: - field: json.ikeversion - ignore_missing: true - - rename: - field: json.spi_in - target_field: zscaler_zia.tunnel.spi_in - ignore_missing: true - - rename: - field: json.spi_out - target_field: zscaler_zia.tunnel.spi_out - ignore_missing: true - - rename: - field: json.algo - target_field: zscaler_zia.tunnel.encryption.algorithm - ignore_missing: true - - rename: - field: json.authentication - target_field: zscaler_zia.tunnel.authentication.algorithm - ignore_missing: true - - rename: - field: json.authtype - target_field: zscaler_zia.tunnel.authentication.type - ignore_missing: true - - rename: - field: json.tunneltype - target_field: zscaler_zia.tunnel.type - ignore_missing: true - - rename: - field: json.vendorname - target_field: zscaler_zia.tunnel.vendor.name - ignore_missing: true - - convert: - field: json.sourceportstart - target_field: zscaler_zia.tunnel.source.start.port - type: long - ignore_missing: true - - remove: - field: json.sourceportstart - ignore_missing: true - - convert: - field: json.destinationportstart - target_field: zscaler_zia.tunnel.destination.start.port - type: long - ignore_missing: true - - remove: - field: json.destinationportstart - ignore_missing: true - - rename: - field: json.srcipstart - target_field: zscaler_zia.tunnel.source.start.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{zscaler_zia.tunnel.source.start.ip}}}" - if: ctx?.zscaler_zia?.tunnel?.source?.start?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.srcipend - target_field: zscaler_zia.tunnel.source.end.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{zscaler_zia.tunnel.source.end.ip}}}" - if: ctx?.zscaler_zia?.tunnel?.source?.end?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.destinationipstart - target_field: zscaler_zia.tunnel.destination.start.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{zscaler_zia.tunnel.destination.start.ip}}}" - if: ctx?.zscaler_zia?.tunnel?.destination?.start?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.destinationipend - target_field: zscaler_zia.tunnel.destination.end.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{zscaler_zia.tunnel.destination.end.ip}}}" - if: ctx?.zscaler_zia?.tunnel?.destination?.end?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.spi - target_field: zscaler_zia.tunnel.spi - ignore_missing: true - - rename: - field: json.protocol - target_field: zscaler_zia.tunnel.policy.protocol - ignore_missing: true - - rename: - field: json.tunnelprotocol - target_field: zscaler_zia.tunnel.protocol - ignore_missing: true - - rename: - field: json.policydirection - target_field: zscaler_zia.tunnel.policy.direction - ignore_missing: true - - convert: - field: json.lifebytes - target_field: zscaler_zia.tunnel.life.bytes - type: long - ignore_missing: true - - remove: - field: json.lifebytes - ignore_missing: true - - rename: - field: json.dpdrec - target_field: zscaler_zia.tunnel.dpd_packets - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zia.tunnel - lang: painless - if: ctx.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zia.tunnel[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/agent.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/base-fields.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/base-fields.yml deleted file mode 100755 index 14fc7f2ee9..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zia -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zia.tunnel diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/ecs.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/ecs.yml deleted file mode 100755 index f8e16301c4..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/ecs.yml +++ /dev/null @@ -1,54 +0,0 @@ -- description: Bytes sent from the destination to the source. - name: destination.bytes - type: long -- description: IP address of the destination (IPv4 or IPv6). - name: destination.ip - type: ip -- description: Packets sent from the destination to the source. - name: destination.packets - type: long -- description: Port of the destination. - name: destination.port - type: long -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: Unique ID to describe the event. - name: event.id - type: keyword -- description: |- - Reason why this event happened, according to the source. - This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). - name: event.reason - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: All the user names or other user identifiers seen on the event. - name: related.user - type: keyword -- description: Bytes sent from the source to the destination. - name: source.bytes - type: long -- description: IP address of the source (IPv4 or IPv6). - name: source.ip - type: ip -- description: Packets sent from the source to the destination. - name: source.packets - type: long -- description: Port of the source. - name: source.port - type: long -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: Short name or login of the user. - name: user.name - type: keyword diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/fields.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/fields.yml deleted file mode 100755 index a0a7e50774..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/fields/fields.yml +++ /dev/null @@ -1,113 +0,0 @@ -- name: zscaler_zia.tunnel - type: group - fields: - - name: action.type - type: keyword - description: | - Type of the record. Possible values [ WL_TUNNEL_IPSECPHASE1, WL_TUNNEL_IPSECPHASE2, WL_TUNNEL_EVENT, WL_TUNNEL_SAMPLES ]. - - name: authentication - type: group - fields: - - name: algorithm - type: keyword - description: | - Authentication algorithm. - - name: type - type: keyword - description: | - Authentication type. - - name: destination.end.ip - type: keyword - description: | - Phase 2 policy proposal - Destination IP end. - - name: destination.start - type: group - fields: - - name: ip - type: keyword - description: | - Phase 2 policy proposal - Destination IP start. - - name: port - type: long - description: | - Phase 2 policy proposal - Destination port end. - - name: dpd_packets - type: keyword - description: | - Number of DPD packets received in 60-second sample window. - - name: encryption.algorithm - type: keyword - description: | - Encryption algorithm. - - name: ike.version - type: long - description: | - IKE version (1 or 2). - - name: life - type: group - fields: - - name: bytes - type: long - description: | - Life bytes (number of traffic to be transacted through tunnel before renegotiation). - - name: time - type: long - description: | - Lifetime of IKE Phase 1/2 in seconds. - - name: location.name - type: keyword - description: | - Location name. - - name: policy - type: group - fields: - - name: direction - type: keyword - description: | - N/A - - name: protocol - type: keyword - description: | - Phase 2 policy proposal - Protocol. - - name: protocol - type: keyword - description: | - IPSec tunnel protocol type (Zscaler only supports ESP). - - name: source.end.ip - type: keyword - description: | - Phase 2 policy proposal - Source IP end. - - name: source.start - type: group - fields: - - name: ip - type: keyword - description: | - Phase 2 policy proposal - Source IP start. - - name: port - type: long - description: | - Phase 2 policy proposal - Source port start. - - name: spi - type: keyword - description: | - Security Parameter Index. - - name: spi_in - type: keyword - description: | - Initiator cookie. - - name: spi_out - type: keyword - description: | - Responder cookie. - - name: type - type: keyword - description: | - Tunnel type. - - name: vendor.name - type: keyword - description: |- - Vendor name of the edge device. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/manifest.yml b/packages/zscaler_zia/0.1.0/data_stream/tunnel/manifest.yml deleted file mode 100755 index 477b606f29..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: Tunnel Logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Internet Access Tunnel Logs - description: Collect Zscaler Internet Access Tunnel Logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9013 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zia-tunnel - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zia/0.1.0/data_stream/tunnel/sample_event.json b/packages/zscaler_zia/0.1.0/data_stream/tunnel/sample_event.json deleted file mode 100755 index eebfed78d8..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/tunnel/sample_event.json +++ /dev/null @@ -1,115 +0,0 @@ -{ - "@timestamp": "2021-12-30T11:20:12.000Z", - "agent": { - "ephemeral_id": "63ac98b6-0ff6-4943-820e-8505eff15937", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "zscaler_zia.tunnel", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "ip": "81.2.69.143" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.tunnel", - "id": "1111111111111111111", - "ingested": "2022-02-04T06:36:16Z", - "kind": "event", - "type": [ - "info" - ] - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:44374" - } - }, - "related": { - "ip": [ - "81.2.69.143", - "81.2.69.145" - ], - "user": [ - "81.2.69.145" - ] - }, - "source": { - "ip": "81.2.69.145", - "port": 0 - }, - "tags": [ - "forwarded", - "zscaler_zia-tunnel" - ], - "user": { - "name": "81.2.69.145" - }, - "zscaler_zia": { - "tunnel": { - "action": { - "type": "IPSec Phase2" - }, - "authentication": { - "algorithm": "HMAC-SHA-1", - "type": "None" - }, - "destination": { - "end": { - "ip": "81.2.69.143" - }, - "start": { - "ip": "81.2.69.143", - "port": 0 - } - }, - "encryption": { - "algorithm": "AES" - }, - "ike": { - "version": 1 - }, - "life": { - "bytes": 0, - "time": 3600 - }, - "location": { - "name": "some-location" - }, - "policy": { - "direction": "Inbound SA Policy", - "protocol": "Any" - }, - "protocol": "ESP", - "source": { - "end": { - "ip": "81.2.69.145" - }, - "start": { - "ip": "81.2.69.145", - "port": 0 - } - }, - "spi": "123456789", - "type": "IPSEC IKEV 1" - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/agent/stream/tcp.yml.hbs b/packages/zscaler_zia/0.1.0/data_stream/web/agent/stream/tcp.yml.hbs deleted file mode 100755 index 030459f258..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/agent/stream/tcp.yml.hbs +++ /dev/null @@ -1,19 +0,0 @@ -tcp: -host: "{{listen_address}}:{{listen_port}}" -tags: -{{#if preserve_original_event}} - - preserve_original_event -{{/if}} -{{#each tags as |tag i|}} - - {{tag}} -{{/each}} -{{#contains "forwarded" tags}} -publisher_pipeline.disable_host: true -{{/contains}} -{{#if ssl}} -ssl: {{ssl}} -{{/if}} -{{#if processors}} -processors: -{{processors}} -{{/if}} diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/elasticsearch/ingest_pipeline/default.yml b/packages/zscaler_zia/0.1.0/data_stream/web/elasticsearch/ingest_pipeline/default.yml deleted file mode 100755 index bc5bf2cebf..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/elasticsearch/ingest_pipeline/default.yml +++ /dev/null @@ -1,308 +0,0 @@ ---- -description: Pipeline for Zscaler web logs -processors: - - set: - field: ecs.version - value: '8.0.0' - - rename: - field: message - target_field: event.original - ignore_missing: true - - json: - field: event.original - target_field: resp - - rename: - field: resp.event - target_field: json - - remove: - field: resp - ignore_missing: true - - date: - field: json.time - target_field: "@timestamp" - ignore_failure: true - formats: - - E MMM dd HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - E MMM d HH:mm:ss yyyy - - remove: - field: json.time - ignore_missing: true - - set: - field: event.category - value: web - - set: - field: event.kind - value: event - - append: - field: event.type - value: info - - rename: - field: json.cip - target_field: client.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{client.ip}}}" - if: ctx?.client?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.sip - target_field: client.nat.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{client.nat.ip}}}" - if: ctx?.client?.nat?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.deviceowner - target_field: client.user.name - ignore_missing: true - - convert: - field: json.reqsize - target_field: http.request.bytes - type: long - ignore_failure: true - - remove: - field: json.reqsize - ignore_missing: true - - rename: - field: json.reqmethod - target_field: http.request.method - ignore_missing: true - - rename: - field: json.contenttype - target_field: http.request.mime_type - ignore_missing: true - - rename: - field: json.ereferer - target_field: http.request.referrer - ignore_missing: true - - convert: - field: json.respsize - target_field: http.response.bytes - type: long - ignore_failure: true - - remove: - field: json.respsize - ignore_missing: true - - convert: - field: json.respcode - target_field: http.response.status_code - type: long - ignore_failure: true - - remove: - field: json.respcode - ignore_missing: true - - rename: - field: json.proto - target_field: network.protocol - ignore_missing: true - - lowercase: - field: network.protocol - ignore_missing: true - - rename: - field: json.rulelabel - target_field: rule.name - ignore_missing: true - - rename: - field: json.ruletype - target_field: rule.ruleset - ignore_missing: true - - uri_parts: - field: json.eurl - remove_if_successful: true - on_failure: - - set: - field: url.original - value: "{{{json.eurl}}}" - if: ctx?.json?.eurl != null - ignore_failure: true - - remove: - field: json.eurl - ignore_missing: true - - user_agent: - field: json.ua - ignore_failure: true - - remove: - field: json.ua - ignore_missing: true - - rename: - field: json.login - target_field: user.email - ignore_missing: true - - rename: - field: json.action - target_field: event.action - ignore_missing: true - - lowercase: - field: event.action - ignore_missing: true - - rename: - field: json.appname - target_field: zscaler_zia.web.app.name - ignore_missing: true - - rename: - field: json.appclass - target_field: zscaler_zia.web.app.class - ignore_missing: true - - convert: - field: json.stime - target_field: zscaler_zia.web.stime - type: long - ignore_failure: true - - remove: - field: json.stime - ignore_missing: true - - convert: - field: json.ctime - target_field: zscaler_zia.web.ctime - type: long - ignore_failure: true - - remove: - field: json.ctime - ignore_missing: true - - rename: - field: json.urlclass - target_field: zscaler_zia.web.url.class - ignore_missing: true - - rename: - field: json.urlsupercat - target_field: zscaler_zia.web.url.category.super - ignore_missing: true - - rename: - field: json.urlcat - target_field: zscaler_zia.web.url.category.sub - ignore_missing: true - - rename: - field: json.malwarecat - target_field: zscaler_zia.web.malware.category - ignore_missing: true - - rename: - field: json.threatname - target_field: zscaler_zia.web.threat.name - ignore_missing: true - - convert: - field: json.riskscore - target_field: event.risk_score - type: long - ignore_failure: true - - remove: - field: json.riskscore - ignore_missing: true - - rename: - field: json.dlpeng - target_field: zscaler_zia.web.dpl.engine - ignore_missing: true - - rename: - field: json.dlpdict - target_field: zscaler_zia.web.dpl.dictionaries - ignore_missing: true - - rename: - field: json.location - target_field: zscaler_zia.web.location - ignore_missing: true - - rename: - field: json.dept - target_field: zscaler_zia.web.department - ignore_missing: true - - rename: - field: json.unscannabletype - target_field: zscaler_zia.web.unscannable.type - ignore_missing: true - - rename: - field: json.devicehostname - target_field: zscaler_zia.web.device.hostname - ignore_missing: true - - append: - field: related.hosts - value: "{{{zscaler_zia.web.device.hostname}}}" - if: ctx?.zscaler_zia?.web?.device?.hostname != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.bwthrottle - target_field: zscaler_zia.web.bandwidth_throttle - ignore_missing: true - - rename: - field: json.cintip - target_field: zscaler_zia.web.client.internet.ip - ignore_missing: true - - append: - field: related.ip - value: "{{{zscaler_zia.web.client.internet.ip}}}" - if: ctx?.zscaler_zia?.web?.client?.internet?.ip != null - allow_duplicates: false - ignore_failure: true - - rename: - field: json.ehost - target_field: zscaler_zia.web.encoded_host - ignore_missing: true - - rename: - field: json.fileclass - target_field: zscaler_zia.web.file.class - ignore_missing: true - - rename: - field: json.filetype - target_field: zscaler_zia.web.file.type - ignore_missing: true - - rename: - field: json.malwareclass - target_field: zscaler_zia.web.malware.class - ignore_missing: true - - rename: - field: json.reason - target_field: event.reason - ignore_missing: true - - rename: - field: json.recordid - target_field: zscaler_zia.web.record.id - ignore_missing: true - - convert: - field: json.totalsize - target_field: zscaler_zia.web.total.size - type: long - ignore_failure: true - - remove: - field: json.totalsize - ignore_missing: true - - script: - description: Drops null/empty values recursively - lang: painless - source: | - boolean dropEmptyFields(Object object) { - if (object == null || object == "") { - return true; - } else if (object instanceof Map) { - ((Map) object).values().removeIf(value -> dropEmptyFields(value)); - return (((Map) object).size() == 0); - } else if (object instanceof List) { - ((List) object).removeIf(value -> dropEmptyFields(value)); - return (((List) object).length == 0); - } - return false; - } - dropEmptyFields(ctx); - - script: - description: Adds all the remaining fields in fields under zscaler_zia.web - lang: painless - if: ctx.json != null - source: | - for (Map.Entry m : ctx.json.entrySet()) { - ctx.zscaler_zia.web[m.getKey()] = m.getValue(); - } - - remove: - field: json - ignore_missing: true - - remove: - field: event.original - if: "ctx?.tags == null || !(ctx.tags.contains('preserve_original_event'))" - ignore_failure: true - ignore_missing: true -on_failure: -- set: - field: error.message - value: "{{{ _ingest.on_failure_message }}}" diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/fields/agent.yml b/packages/zscaler_zia/0.1.0/data_stream/web/fields/agent.yml deleted file mode 100755 index e313ec8287..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/fields/agent.yml +++ /dev/null @@ -1,204 +0,0 @@ -- name: cloud - title: Cloud - group: 2 - description: Fields related to the cloud or infrastructure the events are coming from. - footnote: 'Examples: If Metricbeat is running on an EC2 host and fetches data from its host, the cloud info contains the data about this machine. If Metricbeat runs on a remote machine outside the cloud and fetches data from a service running in the cloud, the field contains cloud data from the machine the service is running on.' - type: group - fields: - - name: account.id - level: extended - type: keyword - ignore_above: 1024 - description: 'The cloud account or organization id used to identify different entities in a multi-tenant environment. - - Examples: AWS account id, Google Cloud ORG Id, or other unique identifier.' - example: 666777888999 - - name: availability_zone - level: extended - type: keyword - ignore_above: 1024 - description: Availability zone in which this host is running. - example: us-east-1c - - name: instance.id - level: extended - type: keyword - ignore_above: 1024 - description: Instance ID of the host machine. - example: i-1234567890abcdef0 - - name: instance.name - level: extended - type: keyword - ignore_above: 1024 - description: Instance name of the host machine. - - name: machine.type - level: extended - type: keyword - ignore_above: 1024 - description: Machine type of the host machine. - example: t2.medium - - name: provider - level: extended - type: keyword - ignore_above: 1024 - description: Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. - example: aws - - name: region - level: extended - type: keyword - ignore_above: 1024 - description: Region in which this host is running. - example: us-east-1 - - name: project.id - type: keyword - description: Name of the project in Google Cloud. - - name: image.id - type: keyword - description: Image ID for the cloud instance. -- name: container - title: Container - group: 2 - description: 'Container fields are used for meta information about the specific container that is the source of information. - - These fields help correlate data based containers from any runtime.' - type: group - fields: - - name: id - level: core - type: keyword - ignore_above: 1024 - description: Unique container id. - - name: image.name - level: extended - type: keyword - ignore_above: 1024 - description: Name of the image the container was built on. - - name: labels - level: extended - type: object - object_type: keyword - description: Image labels. - - name: name - level: extended - type: keyword - ignore_above: 1024 - description: Container name. -- name: host - title: Host - group: 2 - description: 'A host is defined as a general computing instance. - - ECS host.* fields should be populated with details about the host on which the event happened, or from which the measurement was taken. Host types include hardware, virtual machines, Docker containers, and Kubernetes nodes.' - type: group - fields: - - name: architecture - level: core - type: keyword - ignore_above: 1024 - description: Operating system architecture. - example: x86_64 - - name: domain - level: extended - type: keyword - ignore_above: 1024 - description: 'Name of the domain of which the host is a member. - - For example, on Windows this could be the host''s Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host''s LDAP provider.' - example: CONTOSO - default_field: false - - name: hostname - level: core - type: keyword - ignore_above: 1024 - description: 'Hostname of the host. - - It normally contains what the `hostname` command returns on the host machine.' - - name: id - level: core - type: keyword - ignore_above: 1024 - description: 'Unique host id. - - As hostname is not always unique, use values that are meaningful in your environment. - - Example: The current usage of `beat.name`.' - - name: ip - level: core - type: ip - description: Host ip addresses. - - name: mac - level: core - type: keyword - ignore_above: 1024 - description: Host mac addresses. - - name: name - level: core - type: keyword - ignore_above: 1024 - description: 'Name of the host. - - It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use.' - - name: os.family - level: extended - type: keyword - ignore_above: 1024 - description: OS family (such as redhat, debian, freebsd, windows). - example: debian - - name: os.kernel - level: extended - type: keyword - ignore_above: 1024 - description: Operating system kernel version as a raw string. - example: 4.4.0-112-generic - - name: os.name - level: extended - type: keyword - ignore_above: 1024 - multi_fields: - - name: text - type: text - norms: false - default_field: false - description: Operating system name, without the version. - example: Mac OS X - - name: os.platform - level: extended - type: keyword - ignore_above: 1024 - description: Operating system platform (such centos, ubuntu, windows). - example: darwin - - name: os.version - level: extended - type: keyword - ignore_above: 1024 - description: Operating system version as a raw string. - example: 10.14.1 - - name: type - level: core - type: keyword - ignore_above: 1024 - description: 'Type of host. - - For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment.' - - name: containerized - type: boolean - description: > - If the host is a container. - - - name: os.build - type: keyword - example: "18D109" - description: > - OS build information. - - - name: os.codename - type: keyword - example: "stretch" - description: > - OS codename, if any. - -- name: input.type - type: keyword - description: Input type -- name: log.offset - type: long - description: Log offset diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/fields/base-fields.yml b/packages/zscaler_zia/0.1.0/data_stream/web/fields/base-fields.yml deleted file mode 100755 index 9a074d3470..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/fields/base-fields.yml +++ /dev/null @@ -1,20 +0,0 @@ -- name: data_stream.type - type: constant_keyword - description: Data stream type. -- name: data_stream.dataset - type: constant_keyword - description: Data stream dataset. -- name: data_stream.namespace - type: constant_keyword - description: Data stream namespace. -- name: '@timestamp' - type: date - description: Event timestamp. -- name: event.module - type: constant_keyword - description: Event module - value: zscaler_zia -- name: event.dataset - type: constant_keyword - description: Event dataset - value: zscaler_zia.web diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/fields/ecs.yml b/packages/zscaler_zia/0.1.0/data_stream/web/fields/ecs.yml deleted file mode 100755 index c708c61ec0..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/fields/ecs.yml +++ /dev/null @@ -1,136 +0,0 @@ -- description: IP address of the client (IPv4 or IPv6). - name: client.ip - type: ip -- description: |- - Translated IP of source based NAT sessions (e.g. internal client to internet). - Typically connections traversing load balancers, firewalls, or routers. - name: client.nat.ip - type: ip -- description: Short name or login of the user. - name: client.user.name - type: keyword -- description: |- - ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. - When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. - name: ecs.version - type: keyword -- description: |- - The action captured by the event. - This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. - name: event.action - type: keyword -- description: Risk score or priority of the event (e.g. security solutions). Use your system's original value here. - name: event.risk_score - type: float -- description: Total size in bytes of the request (body and headers). - name: http.request.bytes - type: long -- description: |- - HTTP request method. - The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. - name: http.request.method - type: keyword -- description: |- - Mime type of the body of the request. - This value must only be populated based on the content of the request body, not on the `Content-Type` header. Comparing the mime type of a request with the request's Content-Type header can be helpful in detecting threats or misconfigured clients. - name: http.request.mime_type - type: keyword -- description: Referrer for this HTTP request. - name: http.request.referrer - type: keyword -- description: Total size in bytes of the response (body and headers). - name: http.response.bytes - type: long -- description: HTTP response status code. - name: http.response.status_code - type: long -- description: |- - In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. - The field value must be normalized to lowercase for querying. - name: network.protocol - type: keyword -- description: All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. - name: related.hosts - type: keyword -- description: All of the IPs seen on your event. - name: related.ip - type: ip -- description: The name of the rule or signature generating the event. - name: rule.name - type: keyword -- description: Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. - name: rule.ruleset - type: keyword -- description: List of keywords used to tag each event. - name: tags - type: keyword -- description: |- - Domain of the url, such as "www.elastic.co". - In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. - If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. - name: url.domain - type: keyword -- description: |- - The field contains the file extension from the original request url, excluding the leading dot. - The file extension is only set if it exists, as not every url has a file extension. - The leading period must not be included. For example, the value must be "png", not ".png". - Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). - name: url.extension - type: keyword -- description: |- - Portion of the url after the `#`, such as "top". - The `#` is not part of the fragment. - name: url.fragment - type: keyword -- description: |- - Unmodified original url as seen in the event source. - Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. - This field is meant to represent the URL as it was observed, complete or not. - name: url.original - type: wildcard -- description: Password of the request. - name: url.password - type: keyword -- description: Path of the request, such as "/search". - name: url.path - type: wildcard -- description: Port of the request, such as 443. - name: url.port - type: long -- description: |- - The query field describes the query string of the request, such as "q=elasticsearch". - The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. - name: url.query - type: keyword -- description: |- - Scheme of the request, such as "https". - Note: The `:` is not part of the scheme. - name: url.scheme - type: keyword -- description: Username of the request. - name: url.username - type: keyword -- description: User email address. - name: user.email - type: keyword -- description: Name of the device. - name: user_agent.device.name - type: keyword -- description: Name of the user agent. - name: user_agent.name - type: keyword -- description: Unparsed user_agent string. - name: user_agent.original - type: keyword -- description: Operating system name, including the version or code name. - name: user_agent.os.full - type: keyword -- description: Operating system name, without the version. - name: user_agent.os.name - type: keyword -- description: Operating system version as a raw string. - name: user_agent.os.version - type: keyword -- description: Version of the user agent. - name: user_agent.version - type: keyword diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/fields/fields.yml b/packages/zscaler_zia/0.1.0/data_stream/web/fields/fields.yml deleted file mode 100755 index fcfdd76d8d..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/fields/fields.yml +++ /dev/null @@ -1,116 +0,0 @@ -- name: zscaler_zia.web - type: group - fields: - - name: app - type: group - fields: - - name: class - type: keyword - description: | - The web application class of the application that was accessed. Equivalent to module. - - name: name - type: keyword - description: | - Cloud application name. - - name: bandwidth_throttle - type: keyword - description: | - Indicates whether the transaction was throttled due to a configured bandwidth policy. - - name: client.internet.ip - type: keyword - description: | - The client Internet (NATted Public) IP address. This is different from the cip value if the internal IP address is visible. Otherwise, same as cip. - - name: ctime - type: long - description: | - The time from when the first byte of the request hits the ZEN to the time in which the last byte of the response is sent from the ZEN back to the browser. - - name: department - type: keyword - description: | - Department of the user. - - name: device.hostname - type: keyword - description: | - The obfuscated version of the device owner. This field must be changed manually. - - name: dpl - type: group - fields: - - name: dictionaries - type: keyword - description: | - The DLP dictionaries that were matched, if any. - - name: engine - type: keyword - description: | - The DLP engine that was matched, if any. - - name: encoded_host - type: keyword - description: | - Encoded version of the destination host name. - - name: file - type: group - fields: - - name: class - type: keyword - description: | - Type of file associated with the transaction. - - name: type - type: keyword - description: | - Type of file associated with the transaction. - - name: location - type: keyword - description: | - Gateway location or sub-location of the source. - - name: malware - type: group - fields: - - name: category - type: keyword - description: | - The category of malware that was detected in the transaction, if any. Also indicates if a file was submitted to the Sandbox engine for analysis and the result of the analysis. - - name: class - type: keyword - description: | - The class of malware that was detected in the transaction, if any. - - name: record.id - type: keyword - description: | - N/A - - name: stime - type: long - description: | - The round trip time between the ZEN request and the server. - - name: threat.name - type: keyword - description: | - The name of the threat that was detected in the transaction, if any. - - name: total.size - type: long - description: | - Total size, in bytes, of the HTTP transaction; sum of the total request size and total response size. - - name: unscannable.type - type: keyword - description: | - Unscannable file type. - - name: url - type: group - fields: - - name: category - type: group - fields: - - name: sub - type: keyword - description: | - Category of the destination URL. - - name: super - type: keyword - description: | - Super category of the destination URL. - - name: class - type: keyword - description: |- - Class of the destination URL. -- name: log.source.address - type: keyword - description: Source address from which the log event was read / sent from. diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/manifest.yml b/packages/zscaler_zia/0.1.0/data_stream/web/manifest.yml deleted file mode 100755 index c7ec897dbb..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/manifest.yml +++ /dev/null @@ -1,41 +0,0 @@ -title: Web Logs -type: logs -streams: - - input: tcp - template_path: tcp.yml.hbs - title: Zscaler Internet Access Web Logs - description: Collect Zscaler Internet Access Web Logs using tcp input - vars: - - name: listen_port - type: integer - title: Listen Port - description: The TCP port number to listen on. - multi: false - required: true - show_user: true - default: 9014 - - name: tags - type: text - title: Tags - multi: true - required: true - show_user: false - default: - - forwarded - - zscaler_zia-web - - name: preserve_original_event - required: true - show_user: true - title: Preserve original event - description: Preserves a raw copy of the original event, added to the field `event.original` - type: bool - multi: false - default: false - - name: processors - type: yaml - title: Processors - multi: false - required: false - show_user: false - description: >- - Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed. See [Processors](https://www.elastic.co/guide/en/beats/filebeat/current/filtering-and-enhancing-data.html) for details. diff --git a/packages/zscaler_zia/0.1.0/data_stream/web/sample_event.json b/packages/zscaler_zia/0.1.0/data_stream/web/sample_event.json deleted file mode 100755 index 7d38b9cbfe..0000000000 --- a/packages/zscaler_zia/0.1.0/data_stream/web/sample_event.json +++ /dev/null @@ -1,140 +0,0 @@ -{ - "@timestamp": "2021-12-17T07:04:57.000Z", - "agent": { - "ephemeral_id": "ced1fd2e-2f17-4f67-b8b1-d38a1920abbb", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "ip": "81.2.69.193", - "nat": { - "ip": "81.2.69.145" - }, - "user": { - "name": "administrator1" - } - }, - "data_stream": { - "dataset": "zscaler_zia.web", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "action": "blocked", - "agent_id_status": "verified", - "category": "web", - "dataset": "zscaler_zia.web", - "ingested": "2022-02-04T08:48:57Z", - "kind": "event", - "risk_score": 0, - "type": [ - "info" - ] - }, - "http": { - "request": { - "bytes": 600, - "method": "CONNECT", - "mime_type": "Other", - "referrer": "None" - }, - "response": { - "bytes": 65, - "status_code": 200 - } - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:48722" - } - }, - "network": { - "protocol": "http_proxy" - }, - "related": { - "hosts": [ - "TestMachine35" - ], - "ip": [ - "81.2.69.193", - "81.2.69.145" - ] - }, - "rule": { - "name": "Zscaler Proxy Traffic", - "ruleset": "FwFilter" - }, - "tags": [ - "forwarded", - "zscaler_zia-web" - ], - "url": { - "extension": "com", - "original": "www.example.com", - "path": "www.example.com" - }, - "user": { - "email": "test@example.com" - }, - "user_agent": { - "device": { - "name": "Other" - }, - "name": "Other", - "original": "Windows Microsoft Windows 10 Pro ZTunnel/1.0", - "os": { - "full": "Windows 10", - "name": "Windows", - "version": "10" - } - }, - "zscaler_zia": { - "web": { - "app": { - "class": "General Browsing", - "name": "General Browsing" - }, - "ctime": 0, - "department": "Unknown", - "device": { - "hostname": "TestMachine35" - }, - "dpl": { - "dictionaries": "None", - "engine": "None" - }, - "location": "Test DB", - "malware": { - "category": "None" - }, - "stime": 0, - "threat": { - "name": "None" - }, - "unscannable": { - "type": "None" - }, - "url": { - "category": { - "sub": "Web Search", - "super": "Information Technology" - }, - "class": "Business Use" - } - } - } -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/docs/README.md b/packages/zscaler_zia/0.1.0/docs/README.md deleted file mode 100755 index 7061e34980..0000000000 --- a/packages/zscaler_zia/0.1.0/docs/README.md +++ /dev/null @@ -1,1121 +0,0 @@ -# Zscaler ZIA - -This integration is for Zscaler Internet Access logs. It can be used -to receive logs sent by NSS log server on respective TCP ports. - -The log message is expected to be in JSON format. The data is mapped to -ECS fields where applicable and the remaining fields are written under -`zscaler_zia..*`. - -## Setup steps - -1. Enable the integration with the TCP input. -2. Configure the Zscaler NSS Server and NSS Feeds to send logs to the Elastic Agent -that is running this integration. See [_Add NSS Server_](https://help.zscaler.com/zia/adding-nss-servers) and [_Add NSS Feeds_](https://help.zscaler.com/zia/adding-nss-feeds). Use the IP address/hostname of the Elastic Agent as the 'NSS Feed SIEM IP Address/FQDN', and use the listening port of the Elastic Agent as the 'SIEM TCP Port' on the _Add NSS Feed_ configuration screen. -3. *Please make sure to use the given response formats.* - -## Compatibility - -This package has been tested against `Zscaler Internet Access version 6.1` - -## Documentation and configuration - -### Alerts - -Default port: _9010_ - -Vendor documentation: https://help.zscaler.com/zia/about-alerts - -Zscaler response format: -``` -<%d{syslogid}>%s{Monthname} %2d{Dayofmonth} %02d{Hour}:%02d{Minutes}:%02d{Seconds} [%s{Deviceip}] ZscalerNSS: %s{Eventinfo}\n -``` - -Sample Response: -``` -<114>Dec 10 14:04:28 [175.16.199.1] ZscalerNSS: Zscaler cloud configuration connection to 175.16.199.1:443 lost and unavailable for the past 2325.00 minutes -``` - -### DNS Log - -Default port: _9011_ - -Vendor documentation: https://help.zscaler.com/zia/nss-feed-output-format-dns-logs - -Zscaler response format: -``` -\{ "sourcetype" : "zscalernss-dns", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","location":"%s{elocation}","reqaction":"%s{reqaction}","resaction":"%s{resaction}","reqrulelabel":"%s{reqrulelabel}","resrulelabel":"%s{resrulelabel}","dns_reqtype":"%s{reqtype}","dns_req":"%s{req}","dns_resp":"%s{res}","srv_dport":"%d{sport}","durationms":"%d{durationms}","clt_sip":"%s{cip}","srv_dip":"%s{sip}","category":"%s{domcat}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} -``` - -Sample Response: -```json -{ "sourcetype" : "zscalernss-dns", "event" :{"datetime":"Fri Dec 17 07:27:54 2021","user":"some_user@example.com","department":"Unknown","location":"TestLoc%20DB","reqaction":"REQ_ALLOW","resaction":"Some Response Action","reqrulelabel":"Access%20Blocked","resrulelabel":"None","dns_reqtype":"Some type","dns_req":"example.com","dns_resp":"Some response string","srv_dport":"8080","durationms":"123456","clt_sip":"81.2.69.193","srv_dip":"81.2.69.144","category":"Professional Services","deviceowner":"Owner77","devicehostname":"Machine9000"}} -``` - -### Firewall Log - -Default port: _9012_ - -Vendor documentation: https://help.zscaler.com/zia/nss-feed-output-format-firewall-logs - -Zscaler response format: -``` -\{ "sourcetype" : "zscalernss-fw", "event" :\{"datetime":"%s{time}","user":"%s{elogin}","department":"%s{edepartment}","locationname":"%s{elocation}","cdport":"%d{cdport}","csport":"%d{csport}","sdport":"%d{sdport}","ssport":"%d{ssport}","csip":"%s{csip}","cdip":"%s{cdip}","ssip":"%s{ssip}","sdip":"%s{sdip}","tsip":"%s{tsip}","tunsport":"%d{tsport}","tuntype":"%s{ttype}","action":"%s{action}","dnat":"%s{dnat}","stateful":"%s{stateful}","aggregate":"%s{aggregate}","nwsvc":"%s{nwsvc}","nwapp":"%s{nwapp}","proto":"%s{ipproto}","ipcat":"%s{ipcat}","destcountry":"%s{destcountry}","avgduration":"%d{avgduration}","rulelabel":"%s{erulelabel}","inbytes":"%ld{inbytes}","outbytes":"%ld{outbytes}","duration":"%d{duration}","durationms":"%d{durationms}","numsessions":"%d{numsessions}","ipsrulelabel":"%s{ipsrulelabel}","threatcat":"%s{threatcat}","threatname":"%s{ethreatname}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} -``` - -Sample Response: -```json -{ "sourcetype" : "zscalernss-fw", "event" :{"datetime":"Fri Dec 17 07:27:54 2021","user":"some_user@example.com","department":"Unknown","locationname":"TestLoc%20DB","cdport":443,"csport":55018,"sdport":443,"ssport":0,"csip":"0.0.0.0","cdip":"0.0.0.0","ssip":"0.0.0.0","sdip":"0.0.0.0","tsip":"0.0.0.0","tunsport":0,"tuntype":"ZscalerClientConnector","action":"Drop","dnat":"No","stateful":"Yes","aggregate":"No","nwsvc":"HTTPS","nwapp":"http","proto":"TCP","ipcat":"Test Name","destcountry":"Ireland","avgduration":486,"rulelabel":"Access%20Blocked","inbytes":19052,"outbytes":1734,"duration":0,"durationms":486,"numsessions":1,"ipsrulelabel":"None","threatcat":"None","threatname":"None","deviceowner":"admin77","devicehostname":"Machine9000"}} -``` - -### Tunnel Log - -Default port: _9013_ - -Vendor documentation: https://help.zscaler.com/zia/nss-feed-output-format-tunnel-logs - -Zscaler response format: -- Tunnel Event: - ``` - \{ "sourcetype" : "zscalernss-tunnel", "event" : \{"datetime":"%s{datetime}","Recordtype":"%s{tunnelactionname}","tunneltype":"%s{tunneltype}","user":"%s{vpncredentialname}","location":"%s{elocationname}","sourceip":"%s{sourceip}","destinationip":"%s{destvip}","sourceport":"%d{srcport}","event":"%s{event}","eventreason":"%s{eventreason}","recordid":"%d{recordid}"\}\} - ``` -- Sample Event: - ``` - \{ "sourcetype" : "zscalernss-tunnel", "event" : \{"datetime":"%s{datetime}","Recordtype":"%s{tunnelactionname}","tunneltype":"%s{tunneltype}","user":"%s{vpncredentialname}","location":"%s{elocationname}","sourceip":"%s{sourceip}","destinationip":"%s{destvip}","sourceport":"%d{srcport}","txbytes":"%lu{txbytes}","rxbytes":"%lu{rxbytes}","dpdrec":"%d{dpdrec}","recordid":"%d{recordid}"\}\} - ``` -- IKE Phase 1 - ``` - \{ "sourcetype" : "zscalernss-tunnel", "event" : \{"datetime":"%s{datetime}","Recordtype":"%s{tunnelactionname}","tunneltype":"IPSEC IKEV %d{ikeversion}","user":"%s{vpncredentialname}","location":"%s{elocationname}","sourceip":"%s{sourceip}","destinationip":"%s{destvip}","sourceport":"%d{srcport}","destinationport":"%d{dstport}","lifetime":"%d{lifetime}","ikeversion":"%d{ikeversion}","spi_in":"%lu{spi_in}","spi_out":"%lu{spi_out}","algo":"%s{algo}","authentication":"%s{authentication}","authtype":"%s{authtype}","recordid":"%d{recordid}"\}\} - ``` -- IKE Phase 2 - ``` - \{ "sourcetype" : "zscalernss-tunnel", "event" : \{"datetime":"%s{datetime}","Recordtype":"%s{tunnelactionname}","tunneltype":"IPSEC IKEV %d{ikeversion}","user":"%s{vpncredentialname}","location":"%s{elocationname}","sourceip":"%s{sourceip}","destinationip":"%s{destvip}","sourceport":"%d{srcport}","sourceportstart":"%d{srcportstart}","destinationportstart":"%d{destportstart}","srcipstart":"%s{srcipstart}","srcipend":"%s{srcipend}","destinationipstart":"%s{destipstart}","destinationipend":"%s{destipend}","lifetime":"%d{lifetime}","ikeversion":"%d{ikeversion}","lifebytes":"%d{lifebytes}","spi":"%d{spi}","algo":"%s{algo}","authentication":"%s{authentication}","authtype":"%s{authtype}","protocol":"%s{protocol}","tunnelprotocol":"%s{tunnelprotocol}","policydirection":"%s{policydirection}","recordid":"%d{recordid}"\}\} - ``` - -Sample Response: -```json -{ "sourcetype" : "zscalernss-tunnel", "event" : {"datetime":"Thu Dec 30 11:40:27 2021","Recordtype":"IPSec Phase1","tunneltype":"IPSEC IKEV 2","user":"81.2.69.145","location":"some-location","sourceip":"81.2.69.145","destinationip":"81.2.69.143","sourceport":"500","destinationport":"500","lifetime":"0","ikeversion":"2","spi_in":"00000000000000000000","spi_out":"11111111111111111111","algo":"AES-CBS","authentication":"HMAC-SHA1-96","authtype":"PSK","recordid":"1111111111111111111"}} -``` - -### Web Log - -Default port: _9014_ - -Vendor documentation: https://help.zscaler.com/zia/nss-feed-output-format-web-logs - -Zscaler response format: -``` -\{ "sourcetype" : "zscalernss-web", "event" :\{"time":"%s{time}","login":"%s{login}","proto":"%s{proto}","eurl":"%s{eurl}","action":"%s{action}","appname":"%s{appname}","appclass":"%s{appclass}","reqsize":"%d{reqsize}","respsize":"%d{respsize}","stime":"%d{stime}","ctime":"%d{ctime}","urlclass":"%s{urlclass}","urlsupercat":"%s{urlsupercat}","urlcat":"%s{urlcat}","malwarecat":"%s{malwarecat}","threatname":"%s{threatname}","riskscore":"%d{riskscore}","dlpeng":"%s{dlpeng}","dlpdict":"%s{dlpdict}","location":"%s{location}","dept":"%s{dept}","cip":"%s{cip}","sip":"%s{sip}","reqmethod":"%s{reqmethod}","respcode":"%s{respcode}","ua":"%s{ua}","ereferer":"%s{ereferer}","ruletype":"%s{ruletype}","rulelabel":"%s{rulelabel}","contenttype":"%s{contenttype}","unscannabletype":"%s{unscannabletype}","deviceowner":"%s{deviceowner}","devicehostname":"%s{devicehostname}"\}\} -``` - -Sample Response: -```json -{ "sourcetype" : "zscalernss-web", "event" :{"time":"Fri Dec 17 07:04:57 2021","login":"test@example.com","proto":"HTTP_PROXY","eurl":"browser.events.data.msn.com:443","action":"Blocked","appname":"General Browsing","appclass":"General Browsing","reqsize":"600","respsize":"65","stime":"0","ctime":"0","urlclass":"Business Use","urlsupercat":"Information Technology","urlcat":"Web Search","malwarecat":"None","threatname":"None","riskscore":"0","dlpeng":"None","dlpdict":"None","location":"Test DB","dept":"Unknown","cip":"81.2.69.193","sip":"81.2.69.145","reqmethod":"CONNECT","respcode":"200","ua":"Windows Microsoft Windows 10 Pro ZTunnel/1.0","ereferer":"None","ruletype":"FwFilter","rulelabel":"Zscaler Proxy Traffic","contenttype":"Other","unscannabletype":"None","deviceowner":"administrator1","devicehostname":"TestMachine35"}} -``` - -## Fields and Sample event - -### Alerts - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.address | Some event destination addresses are defined ambiguously. The event will sometimes list an IP, a domain or a unix socket. You should always store the raw address in the `.address` field. Then it should be duplicated to `.ip` or `.domain`, depending on which one it is. | keyword | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.port | Port of the destination. | long | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| log.syslog.priority | Syslog numeric priority of the event, if available. According to RFCs 5424 and 3164, the priority is 8 \* facility + severity. This number is therefore expected to contain a value between 0 and 191. | long | -| message | For log events the message field contains the log message, optimized for viewing in a log viewer. For structured logs without an original message field, other fields can be concatenated to form a human-readable summary of the event. If multiple messages exist, they can be combined into one message. | match_only_text | -| related.ip | All of the IPs seen on your event. | ip | -| tags | List of keywords used to tag each event. | keyword | -| zscaler_zia.alerts.connection_lost_minutes | Amount of time after loosing connection to a server in Minutes. | double | -| zscaler_zia.alerts.log_feed_name | Name of the NSS log feed. | keyword | - - -An example event for `alerts` looks as following: - -```json -{ - "@timestamp": "2022-12-10T13:40:32.000Z", - "agent": { - "ephemeral_id": "8c093fcf-fb2f-4baa-b794-40edb011194d", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "zscaler_zia.alerts", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "address": "81.2.69.193", - "ip": "81.2.69.193", - "port": 9012 - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "dataset": "zscaler_zia.alerts", - "ingested": "2022-02-04T06:31:25Z" - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:32902" - }, - "syslog": { - "priority": 114 - } - }, - "message": "ZscalerNSS: SIEM Feed connection \"DNS Logs Feed\" to 81.2.69.193:9012 lost and unavailable for the past 2440.00 minutes", - "related": { - "ip": [ - "81.2.69.193" - ] - }, - "tags": [ - "forwarded", - "zscaler_zia-alerts" - ], - "zscaler_zia": { - "alerts": { - "connection_lost_minutes": 2440, - "log_feed_name": "DNS Logs Feed" - } - } -} -``` - -## DNS Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.geo.city_name | City name. | keyword | -| client.geo.continent_name | Name of the continent. | keyword | -| client.geo.country_iso_code | Country ISO code. | keyword | -| client.geo.country_name | Country name. | keyword | -| client.geo.location | Longitude and latitude. | geo_point | -| client.geo.region_iso_code | Region ISO code. | keyword | -| client.geo.region_name | Region name. | keyword | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| dns.answers.name | The domain name to which this resource record pertains. If a chain of CNAME is being resolved, each answer's `name` should be the one that corresponds with the answer's `data`. It should not simply be the original `question.name` repeated. | keyword | -| dns.question.name | The name being queried. If the name field contains non-printable characters (below 32 or above 126), those characters should be represented as escaped base 10 integers (\DDD). Back slashes and quotes should be escaped. Tabs, carriage returns, and line feeds should be converted to \t, \r, and \n respectively. | keyword | -| dns.question.type | The type of record being queried. | keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| server.geo.city_name | City name. | keyword | -| server.geo.continent_name | Name of the continent. | keyword | -| server.geo.country_iso_code | Country ISO code. | keyword | -| server.geo.country_name | Country name. | keyword | -| server.geo.location | Longitude and latitude. | geo_point | -| server.geo.region_iso_code | Region ISO code. | keyword | -| server.geo.region_name | Region name. | keyword | -| server.ip | IP address of the server (IPv4 or IPv6). | ip | -| server.port | Port of the server. | long | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.packets | Packets sent from the source to the destination. | long | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | -| user.email | User email address. | keyword | -| user.name | Short name or login of the user. | keyword | -| zscaler_zia.dns.department | Department of the user. | keyword | -| zscaler_zia.dns.dom.category | URL Category of the FQDN in the DNS request. | keyword | -| zscaler_zia.dns.duration.milliseconds | Duration of the DNS request in milliseconds. | long | -| zscaler_zia.dns.hostname | N/A | keyword | -| zscaler_zia.dns.location | Gateway location or sub-location of the source. | keyword | -| zscaler_zia.dns.request.action | Name of the action that was applied to the DNS request. | keyword | -| zscaler_zia.dns.request.rule.label | Name of the rule that was applied to the DNS request. | keyword | -| zscaler_zia.dns.response.action | Name of the action that was applied to the DNS response. | keyword | -| zscaler_zia.dns.response.rule.label | Name of the rule that was applied to the DNS response. | keyword | - - -An example event for `dns` looks as following: - -```json -{ - "@timestamp": "2021-12-17T07:27:54.000Z", - "agent": { - "ephemeral_id": "d288c261-b8db-45af-99c0-a673c3c6d8e1", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.193" - }, - "data_stream": { - "dataset": "zscaler_zia.dns", - "namespace": "ep", - "type": "logs" - }, - "dns": { - "answers": { - "name": "Some response string" - }, - "question": { - "name": "example.com", - "type": "Some type" - } - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.dns", - "ingested": "2022-02-04T06:32:56Z", - "kind": "event", - "type": [ - "info" - ] - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:54202" - } - }, - "related": { - "hosts": [ - "Machine9000" - ], - "ip": [ - "81.2.69.193", - "81.2.69.144" - ] - }, - "server": { - "geo": { - "city_name": "London", - "continent_name": "Europe", - "country_iso_code": "GB", - "country_name": "United Kingdom", - "location": { - "lat": 51.5142, - "lon": -0.0931 - }, - "region_iso_code": "GB-ENG", - "region_name": "England" - }, - "ip": "81.2.69.144", - "port": 8080 - }, - "tags": [ - "forwarded", - "zscaler_zia-dns" - ], - "user": { - "email": "some_user@example.com", - "name": "Owner77" - }, - "zscaler_zia": { - "dns": { - "department": "Unknown", - "dom": { - "category": "Professional Services" - }, - "duration": { - "milliseconds": 123456 - }, - "hostname": "Machine9000", - "location": "TestLoc DB", - "request": { - "action": "REQ_ALLOW", - "rule": { - "label": "Access Blocked" - } - }, - "response": { - "action": "Some Response Action", - "rule": { - "label": "None" - } - } - } - } -} -``` - -## Firewall Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.bytes | Bytes sent from the client to the server. | long | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| network.application | When a specific application or service is identified from network connection details (source/dest IPs, ports, certificates, or wire format), this field captures the application's or service's name. For example, the original event identifies the network connection being from a specific web service in a `https` network connection, like `facebook` or `twitter`. The field value must be normalized to lowercase for querying. | keyword | -| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | -| network.transport | Same as network.iana_number, but instead using the Keyword name of the transport layer (udp, tcp, ipv6-icmp, etc.) The field value must be normalized to lowercase for querying. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| rule.name | The name of the rule or signature generating the event. | keyword | -| server.bytes | Bytes sent from the server to the client. | long | -| server.geo.country_name | Country name. | keyword | -| tags | List of keywords used to tag each event. | keyword | -| user.email | User email address. | keyword | -| user.name | Short name or login of the user. | keyword | -| zscaler_zia.firewall.aggregate | | keyword | -| zscaler_zia.firewall.client.destination.ip | Client destination IP address. For aggregated sessions, this is the client destination IP address of the last session in the aggregate. | keyword | -| zscaler_zia.firewall.client.destination.port | Client destination port. For aggregated sessions, this is the client destination port of the last session in the aggregate. | double | -| zscaler_zia.firewall.client.source.ip | Client source IP address. For aggregated sessions, this is the client source IP address of the last session in the aggregate. | keyword | -| zscaler_zia.firewall.client.source.port | Client source port. For aggregated sessions, this is the client source port of the last session in the aggregate. | double | -| zscaler_zia.firewall.department | Department of the user. | keyword | -| zscaler_zia.firewall.duration.avg | Average session duration, in milliseconds, if the sessions were aggregated. | double | -| zscaler_zia.firewall.duration.milliseconds | Session or request duration in milliseconds. | double | -| zscaler_zia.firewall.duration.seconds | Session or request duration in seconds. | double | -| zscaler_zia.firewall.ip_category | URL category that corresponds to the server IP address. | keyword | -| zscaler_zia.firewall.location.name | Name of the location from which the session was initiated. | keyword | -| zscaler_zia.firewall.nat | Indicates if the destination NAT policy was applied. | keyword | -| zscaler_zia.firewall.server.destination.ip | Server Destination IP address. For aggregated sessions, this is the server destination IP address of the last session in the aggregate. | keyword | -| zscaler_zia.firewall.server.destination.port | Server destination port. For aggregated sessions, this is the server destination port of the last session in the aggregate. | double | -| zscaler_zia.firewall.server.source.ip | Server source IP address. For aggregated sessions, this is the server source IP address of the last session in the aggregate. | keyword | -| zscaler_zia.firewall.server.source.port | Server source port. For aggregated sessions, this is the server source port of the last session in the aggregate. | double | -| zscaler_zia.firewall.session.count | Number of sessions that were aggregated. | double | -| zscaler_zia.firewall.stateful | | keyword | -| zscaler_zia.firewall.threat.category | Category of the threat in the Firewall session by the IPS engine. | keyword | -| zscaler_zia.firewall.threat.name | Name of the threat detected in the Firewall session by the IPS engine. | keyword | -| zscaler_zia.firewall.tunnel.ip | Tunnel IP address of the client (source). For aggregated sessions, this is the client's tunnel IP address corresponding to the last session in the aggregate. | keyword | -| zscaler_zia.firewall.tunnel.port | Tunnel port on the client side. For aggregated sessions, this is the client's tunnel port corresponding to the last session in the aggregate. | double | -| zscaler_zia.firewall.tunnel.type | Traffic forwarding method used to send the traffic to the firewall. | keyword | - - -An example event for `firewall` looks as following: - -```json -{ - "@timestamp": "2021-12-17T07:27:54.000Z", - "agent": { - "ephemeral_id": "41987f90-74dc-4b4b-9936-4347028cf558", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "bytes": 1734 - }, - "data_stream": { - "dataset": "zscaler_zia.firewall", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "action": "drop", - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.firewall", - "ingested": "2022-02-04T06:34:17Z", - "kind": "event", - "original": "{ \"sourcetype\" : \"zscalernss-fw\", \"event\" :{\"datetime\":\"Fri Dec 17 07:27:54 2021\",\"user\":\"some_user@example.com\",\"department\":\"Unknown\",\"locationname\":\"TestLoc%20DB\",\"cdport\":443,\"csport\":55018,\"sdport\":443,\"ssport\":0,\"csip\":\"0.0.0.0\",\"cdip\":\"0.0.0.0\",\"ssip\":\"0.0.0.0\",\"sdip\":\"0.0.0.0\",\"tsip\":\"0.0.0.0\",\"tunsport\":0,\"tuntype\":\"ZscalerClientConnector\",\"action\":\"Drop\",\"dnat\":\"No\",\"stateful\":\"Yes\",\"aggregate\":\"No\",\"nwsvc\":\"HTTPS\",\"nwapp\":\"http\",\"proto\":\"TCP\",\"ipcat\":\"Test Name\",\"destcountry\":\"Ireland\",\"avgduration\":486,\"rulelabel\":\"Access%20Blocked\",\"inbytes\":19052,\"outbytes\":1734,\"duration\":0,\"durationms\":486,\"numsessions\":1,\"ipsrulelabel\":\"None\",\"threatcat\":\"None\",\"threatname\":\"None\",\"deviceowner\":\"admin77\",\"devicehostname\":\"Machine9000\"}}", - "type": "info" - }, - "host": { - "hostname": "Machine9000" - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:58194" - } - }, - "network": { - "application": "http", - "protocol": "https", - "transport": "tcp" - }, - "related": { - "ip": [ - "0.0.0.0" - ] - }, - "rule": { - "name": [ - "Access Blocked", - "None" - ] - }, - "server": { - "bytes": 19052, - "geo": { - "country_name": "Ireland" - } - }, - "tags": [ - "forwarded", - "zscaler_zia-firewall" - ], - "user": { - "email": "some_user@example.com", - "name": "admin77" - }, - "zscaler_zia": { - "firewall": { - "aggregate": "No", - "client": { - "destination": { - "ip": "0.0.0.0", - "port": 443 - }, - "source": { - "ip": "0.0.0.0", - "port": 55018 - } - }, - "department": "Unknown", - "duration": { - "avg": 486, - "milliseconds": 486, - "seconds": 0 - }, - "ip_category": "Test Name", - "location": { - "name": "TestLoc DB" - }, - "nat": "No", - "server": { - "destination": { - "ip": "0.0.0.0", - "port": 443 - }, - "source": { - "ip": "0.0.0.0", - "port": 0 - } - }, - "session": { - "count": 1 - }, - "stateful": "Yes", - "threat": { - "category": "None", - "name": "None" - }, - "tunnel": { - "ip": "0.0.0.0", - "port": 0, - "type": "ZscalerClientConnector" - } - } - } -} -``` - -## Tunnel Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| destination.bytes | Bytes sent from the destination to the source. | long | -| destination.ip | IP address of the destination (IPv4 or IPv6). | ip | -| destination.packets | Packets sent from the destination to the source. | long | -| destination.port | Port of the destination. | long | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.id | Unique ID to describe the event. | keyword | -| event.module | Event module | constant_keyword | -| event.reason | Reason why this event happened, according to the source. This describes the why of a particular action or outcome captured in the event. Where `event.action` captures the action from the event, `event.reason` describes why that action was taken. For example, a web proxy with an `event.action` which denied the request may also populate `event.reason` with the reason why (e.g. `blocked site`). | keyword | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| related.user | All the user names or other user identifiers seen on the event. | keyword | -| source.bytes | Bytes sent from the source to the destination. | long | -| source.ip | IP address of the source (IPv4 or IPv6). | ip | -| source.packets | Packets sent from the source to the destination. | long | -| source.port | Port of the source. | long | -| tags | List of keywords used to tag each event. | keyword | -| user.name | Short name or login of the user. | keyword | -| zscaler_zia.tunnel.action.type | Type of the record. Possible values [ WL_TUNNEL_IPSECPHASE1, WL_TUNNEL_IPSECPHASE2, WL_TUNNEL_EVENT, WL_TUNNEL_SAMPLES ]. | keyword | -| zscaler_zia.tunnel.authentication.algorithm | Authentication algorithm. | keyword | -| zscaler_zia.tunnel.authentication.type | Authentication type. | keyword | -| zscaler_zia.tunnel.destination.end.ip | Phase 2 policy proposal - Destination IP end. | keyword | -| zscaler_zia.tunnel.destination.start.ip | Phase 2 policy proposal - Destination IP start. | keyword | -| zscaler_zia.tunnel.destination.start.port | Phase 2 policy proposal - Destination port end. | long | -| zscaler_zia.tunnel.dpd_packets | Number of DPD packets received in 60-second sample window. | keyword | -| zscaler_zia.tunnel.encryption.algorithm | Encryption algorithm. | keyword | -| zscaler_zia.tunnel.ike.version | IKE version (1 or 2). | long | -| zscaler_zia.tunnel.life.bytes | Life bytes (number of traffic to be transacted through tunnel before renegotiation). | long | -| zscaler_zia.tunnel.life.time | Lifetime of IKE Phase 1/2 in seconds. | long | -| zscaler_zia.tunnel.location.name | Location name. | keyword | -| zscaler_zia.tunnel.policy.direction | N/A | keyword | -| zscaler_zia.tunnel.policy.protocol | Phase 2 policy proposal - Protocol. | keyword | -| zscaler_zia.tunnel.protocol | IPSec tunnel protocol type (Zscaler only supports ESP). | keyword | -| zscaler_zia.tunnel.source.end.ip | Phase 2 policy proposal - Source IP end. | keyword | -| zscaler_zia.tunnel.source.start.ip | Phase 2 policy proposal - Source IP start. | keyword | -| zscaler_zia.tunnel.source.start.port | Phase 2 policy proposal - Source port start. | long | -| zscaler_zia.tunnel.spi | Security Parameter Index. | keyword | -| zscaler_zia.tunnel.spi_in | Initiator cookie. | keyword | -| zscaler_zia.tunnel.spi_out | Responder cookie. | keyword | -| zscaler_zia.tunnel.type | Tunnel type. | keyword | -| zscaler_zia.tunnel.vendor.name | Vendor name of the edge device. | keyword | - - -An example event for `tunnel` looks as following: - -```json -{ - "@timestamp": "2021-12-30T11:20:12.000Z", - "agent": { - "ephemeral_id": "63ac98b6-0ff6-4943-820e-8505eff15937", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "data_stream": { - "dataset": "zscaler_zia.tunnel", - "namespace": "ep", - "type": "logs" - }, - "destination": { - "ip": "81.2.69.143" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "agent_id_status": "verified", - "category": "network", - "dataset": "zscaler_zia.tunnel", - "id": "1111111111111111111", - "ingested": "2022-02-04T06:36:16Z", - "kind": "event", - "type": [ - "info" - ] - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:44374" - } - }, - "related": { - "ip": [ - "81.2.69.143", - "81.2.69.145" - ], - "user": [ - "81.2.69.145" - ] - }, - "source": { - "ip": "81.2.69.145", - "port": 0 - }, - "tags": [ - "forwarded", - "zscaler_zia-tunnel" - ], - "user": { - "name": "81.2.69.145" - }, - "zscaler_zia": { - "tunnel": { - "action": { - "type": "IPSec Phase2" - }, - "authentication": { - "algorithm": "HMAC-SHA-1", - "type": "None" - }, - "destination": { - "end": { - "ip": "81.2.69.143" - }, - "start": { - "ip": "81.2.69.143", - "port": 0 - } - }, - "encryption": { - "algorithm": "AES" - }, - "ike": { - "version": 1 - }, - "life": { - "bytes": 0, - "time": 3600 - }, - "location": { - "name": "some-location" - }, - "policy": { - "direction": "Inbound SA Policy", - "protocol": "Any" - }, - "protocol": "ESP", - "source": { - "end": { - "ip": "81.2.69.145" - }, - "start": { - "ip": "81.2.69.145", - "port": 0 - } - }, - "spi": "123456789", - "type": "IPSEC IKEV 1" - } - } -} -``` - -## Web Logs - -**Exported fields** - -| Field | Description | Type | -|---|---|---| -| @timestamp | Event timestamp. | date | -| client.ip | IP address of the client (IPv4 or IPv6). | ip | -| client.nat.ip | Translated IP of source based NAT sessions (e.g. internal client to internet). Typically connections traversing load balancers, firewalls, or routers. | ip | -| client.user.name | Short name or login of the user. | keyword | -| cloud.account.id | The cloud account or organization id used to identify different entities in a multi-tenant environment. Examples: AWS account id, Google Cloud ORG Id, or other unique identifier. | keyword | -| cloud.availability_zone | Availability zone in which this host is running. | keyword | -| cloud.image.id | Image ID for the cloud instance. | keyword | -| cloud.instance.id | Instance ID of the host machine. | keyword | -| cloud.instance.name | Instance name of the host machine. | keyword | -| cloud.machine.type | Machine type of the host machine. | keyword | -| cloud.project.id | Name of the project in Google Cloud. | keyword | -| cloud.provider | Name of the cloud provider. Example values are aws, azure, gcp, or digitalocean. | keyword | -| cloud.region | Region in which this host is running. | keyword | -| container.id | Unique container id. | keyword | -| container.image.name | Name of the image the container was built on. | keyword | -| container.labels | Image labels. | object | -| container.name | Container name. | keyword | -| data_stream.dataset | Data stream dataset. | constant_keyword | -| data_stream.namespace | Data stream namespace. | constant_keyword | -| data_stream.type | Data stream type. | constant_keyword | -| ecs.version | ECS version this event conforms to. `ecs.version` is a required field and must exist in all events. When querying across multiple indices -- which may conform to slightly different ECS versions -- this field lets integrations adjust to the schema version of the events. | keyword | -| event.action | The action captured by the event. This describes the information in the event. It is more specific than `event.category`. Examples are `group-add`, `process-started`, `file-created`. The value is normally defined by the implementer. | keyword | -| event.dataset | Event dataset | constant_keyword | -| event.module | Event module | constant_keyword | -| event.risk_score | Risk score or priority of the event (e.g. security solutions). Use your system's original value here. | float | -| host.architecture | Operating system architecture. | keyword | -| host.containerized | If the host is a container. | boolean | -| host.domain | Name of the domain of which the host is a member. For example, on Windows this could be the host's Active Directory domain or NetBIOS domain name. For Linux this could be the domain of the host's LDAP provider. | keyword | -| host.hostname | Hostname of the host. It normally contains what the `hostname` command returns on the host machine. | keyword | -| host.id | Unique host id. As hostname is not always unique, use values that are meaningful in your environment. Example: The current usage of `beat.name`. | keyword | -| host.ip | Host ip addresses. | ip | -| host.mac | Host mac addresses. | keyword | -| host.name | Name of the host. It can contain what `hostname` returns on Unix systems, the fully qualified domain name, or a name specified by the user. The sender decides which value to use. | keyword | -| host.os.build | OS build information. | keyword | -| host.os.codename | OS codename, if any. | keyword | -| host.os.family | OS family (such as redhat, debian, freebsd, windows). | keyword | -| host.os.kernel | Operating system kernel version as a raw string. | keyword | -| host.os.name | Operating system name, without the version. | keyword | -| host.os.platform | Operating system platform (such centos, ubuntu, windows). | keyword | -| host.os.version | Operating system version as a raw string. | keyword | -| host.type | Type of host. For Cloud providers this can be the machine type like `t2.medium`. If vm, this could be the container, for example, or other information meaningful in your environment. | keyword | -| http.request.bytes | Total size in bytes of the request (body and headers). | long | -| http.request.method | HTTP request method. The value should retain its casing from the original event. For example, `GET`, `get`, and `GeT` are all considered valid values for this field. | keyword | -| http.request.mime_type | Mime type of the body of the request. This value must only be populated based on the content of the request body, not on the `Content-Type` header. Comparing the mime type of a request with the request's Content-Type header can be helpful in detecting threats or misconfigured clients. | keyword | -| http.request.referrer | Referrer for this HTTP request. | keyword | -| http.response.bytes | Total size in bytes of the response (body and headers). | long | -| http.response.status_code | HTTP response status code. | long | -| input.type | Input type | keyword | -| log.offset | Log offset | long | -| log.source.address | Source address from which the log event was read / sent from. | keyword | -| network.protocol | In the OSI Model this would be the Application Layer protocol. For example, `http`, `dns`, or `ssh`. The field value must be normalized to lowercase for querying. | keyword | -| related.hosts | All hostnames or other host identifiers seen on your event. Example identifiers include FQDNs, domain names, workstation names, or aliases. | keyword | -| related.ip | All of the IPs seen on your event. | ip | -| rule.name | The name of the rule or signature generating the event. | keyword | -| rule.ruleset | Name of the ruleset, policy, group, or parent category in which the rule used to generate this event is a member. | keyword | -| tags | List of keywords used to tag each event. | keyword | -| url.domain | Domain of the url, such as "www.elastic.co". In some cases a URL may refer to an IP and/or port directly, without a domain name. In this case, the IP address would go to the `domain` field. If the URL contains a literal IPv6 address enclosed by `[` and `]` (IETF RFC 2732), the `[` and `]` characters should also be captured in the `domain` field. | keyword | -| url.extension | The field contains the file extension from the original request url, excluding the leading dot. The file extension is only set if it exists, as not every url has a file extension. The leading period must not be included. For example, the value must be "png", not ".png". Note that when the file name has multiple extensions (example.tar.gz), only the last one should be captured ("gz", not "tar.gz"). | keyword | -| url.fragment | Portion of the url after the `#`, such as "top". The `#` is not part of the fragment. | keyword | -| url.original | Unmodified original url as seen in the event source. Note that in network monitoring, the observed URL may be a full URL, whereas in access logs, the URL is often just represented as a path. This field is meant to represent the URL as it was observed, complete or not. | wildcard | -| url.password | Password of the request. | keyword | -| url.path | Path of the request, such as "/search". | wildcard | -| url.port | Port of the request, such as 443. | long | -| url.query | The query field describes the query string of the request, such as "q=elasticsearch". The `?` is excluded from the query string. If a URL contains no `?`, there is no query field. If there is a `?` but no query, the query field exists with an empty string. The `exists` query can be used to differentiate between the two cases. | keyword | -| url.scheme | Scheme of the request, such as "https". Note: The `:` is not part of the scheme. | keyword | -| url.username | Username of the request. | keyword | -| user.email | User email address. | keyword | -| user_agent.device.name | Name of the device. | keyword | -| user_agent.name | Name of the user agent. | keyword | -| user_agent.original | Unparsed user_agent string. | keyword | -| user_agent.os.full | Operating system name, including the version or code name. | keyword | -| user_agent.os.name | Operating system name, without the version. | keyword | -| user_agent.os.version | Operating system version as a raw string. | keyword | -| user_agent.version | Version of the user agent. | keyword | -| zscaler_zia.web.app.class | The web application class of the application that was accessed. Equivalent to module. | keyword | -| zscaler_zia.web.app.name | Cloud application name. | keyword | -| zscaler_zia.web.bandwidth_throttle | Indicates whether the transaction was throttled due to a configured bandwidth policy. | keyword | -| zscaler_zia.web.client.internet.ip | The client Internet (NATted Public) IP address. This is different from the cip value if the internal IP address is visible. Otherwise, same as cip. | keyword | -| zscaler_zia.web.ctime | The time from when the first byte of the request hits the ZEN to the time in which the last byte of the response is sent from the ZEN back to the browser. | long | -| zscaler_zia.web.department | Department of the user. | keyword | -| zscaler_zia.web.device.hostname | The obfuscated version of the device owner. This field must be changed manually. | keyword | -| zscaler_zia.web.dpl.dictionaries | The DLP dictionaries that were matched, if any. | keyword | -| zscaler_zia.web.dpl.engine | The DLP engine that was matched, if any. | keyword | -| zscaler_zia.web.encoded_host | Encoded version of the destination host name. | keyword | -| zscaler_zia.web.file.class | Type of file associated with the transaction. | keyword | -| zscaler_zia.web.file.type | Type of file associated with the transaction. | keyword | -| zscaler_zia.web.location | Gateway location or sub-location of the source. | keyword | -| zscaler_zia.web.malware.category | The category of malware that was detected in the transaction, if any. Also indicates if a file was submitted to the Sandbox engine for analysis and the result of the analysis. | keyword | -| zscaler_zia.web.malware.class | The class of malware that was detected in the transaction, if any. | keyword | -| zscaler_zia.web.record.id | N/A | keyword | -| zscaler_zia.web.stime | The round trip time between the ZEN request and the server. | long | -| zscaler_zia.web.threat.name | The name of the threat that was detected in the transaction, if any. | keyword | -| zscaler_zia.web.total.size | Total size, in bytes, of the HTTP transaction; sum of the total request size and total response size. | long | -| zscaler_zia.web.unscannable.type | Unscannable file type. | keyword | -| zscaler_zia.web.url.category.sub | Category of the destination URL. | keyword | -| zscaler_zia.web.url.category.super | Super category of the destination URL. | keyword | -| zscaler_zia.web.url.class | Class of the destination URL. | keyword | - - -An example event for `web` looks as following: - -```json -{ - "@timestamp": "2021-12-17T07:04:57.000Z", - "agent": { - "ephemeral_id": "ced1fd2e-2f17-4f67-b8b1-d38a1920abbb", - "hostname": "docker-fleet-agent", - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "name": "docker-fleet-agent", - "type": "filebeat", - "version": "7.16.2" - }, - "client": { - "ip": "81.2.69.193", - "nat": { - "ip": "81.2.69.145" - }, - "user": { - "name": "administrator1" - } - }, - "data_stream": { - "dataset": "zscaler_zia.web", - "namespace": "ep", - "type": "logs" - }, - "ecs": { - "version": "8.0.0" - }, - "elastic_agent": { - "id": "d03794ae-c5b7-46b2-8a63-42f00010ac23", - "snapshot": false, - "version": "7.16.2" - }, - "event": { - "action": "blocked", - "agent_id_status": "verified", - "category": "web", - "dataset": "zscaler_zia.web", - "ingested": "2022-02-04T08:48:57Z", - "kind": "event", - "risk_score": 0, - "type": [ - "info" - ] - }, - "http": { - "request": { - "bytes": 600, - "method": "CONNECT", - "mime_type": "Other", - "referrer": "None" - }, - "response": { - "bytes": 65, - "status_code": 200 - } - }, - "input": { - "type": "tcp" - }, - "log": { - "source": { - "address": "172.21.0.7:48722" - } - }, - "network": { - "protocol": "http_proxy" - }, - "related": { - "hosts": [ - "TestMachine35" - ], - "ip": [ - "81.2.69.193", - "81.2.69.145" - ] - }, - "rule": { - "name": "Zscaler Proxy Traffic", - "ruleset": "FwFilter" - }, - "tags": [ - "forwarded", - "zscaler_zia-web" - ], - "url": { - "extension": "com", - "original": "www.example.com", - "path": "www.example.com" - }, - "user": { - "email": "test@example.com" - }, - "user_agent": { - "device": { - "name": "Other" - }, - "name": "Other", - "original": "Windows Microsoft Windows 10 Pro ZTunnel/1.0", - "os": { - "full": "Windows 10", - "name": "Windows", - "version": "10" - } - }, - "zscaler_zia": { - "web": { - "app": { - "class": "General Browsing", - "name": "General Browsing" - }, - "ctime": 0, - "department": "Unknown", - "device": { - "hostname": "TestMachine35" - }, - "dpl": { - "dictionaries": "None", - "engine": "None" - }, - "location": "Test DB", - "malware": { - "category": "None" - }, - "stime": 0, - "threat": { - "name": "None" - }, - "unscannable": { - "type": "None" - }, - "url": { - "category": { - "sub": "Web Search", - "super": "Information Technology" - }, - "class": "Business Use" - } - } - } -} -``` diff --git a/packages/zscaler_zia/0.1.0/img/zscaler-logo.svg b/packages/zscaler_zia/0.1.0/img/zscaler-logo.svg deleted file mode 100755 index b8a21a2fa6..0000000000 --- a/packages/zscaler_zia/0.1.0/img/zscaler-logo.svg +++ /dev/null @@ -1 +0,0 @@ -Zscaler-Logo-TM-Blue-RGB-May2019 \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/img/zscaler-zia-screenshot.png b/packages/zscaler_zia/0.1.0/img/zscaler-zia-screenshot.png deleted file mode 100755 index 6e10c51d84..0000000000 Binary files a/packages/zscaler_zia/0.1.0/img/zscaler-zia-screenshot.png and /dev/null differ diff --git a/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-66597790-4ded-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-66597790-4ded-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 50464fc105..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-66597790-4ded-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,72 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"06eebe5f-c6d6-4bc3-910c-dfb31b4eed15\",\"w\":24,\"x\":0,\"y\":0},\"panelIndex\":\"06eebe5f-c6d6-4bc3-910c-dfb31b4eed15\",\"panelRefName\":\"panel_0\",\"type\":\"visualization\",\"version\":\"7.16.2\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"bd3fd0c0-bb65-48d3-abe6-00fa3513cfeb\",\"w\":24,\"x\":24,\"y\":0},\"panelIndex\":\"bd3fd0c0-bb65-48d3-abe6-00fa3513cfeb\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"7.16.2\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"3263f825-0d4b-4579-865a-29901566da89\",\"w\":24,\"x\":0,\"y\":15},\"panelIndex\":\"3263f825-0d4b-4579-865a-29901566da89\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.16.2\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"fd1d5738-f049-4d39-8a9c-c99f00026abc\",\"w\":24,\"x\":24,\"y\":15},\"panelIndex\":\"fd1d5738-f049-4d39-8a9c-c99f00026abc\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.16.2\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":18,\"i\":\"14e74949-6df9-4178-bd6c-fb3f2af4e44f\",\"w\":24,\"x\":0,\"y\":30},\"panelIndex\":\"14e74949-6df9-4178-bd6c-fb3f2af4e44f\",\"panelRefName\":\"panel_4\",\"type\":\"visualization\",\"version\":\"7.16.2\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":18,\"i\":\"f54d9f84-ff3e-4246-9d53-af54076bacf4\",\"w\":24,\"x\":24,\"y\":30},\"panelIndex\":\"f54d9f84-ff3e-4246-9d53-af54076bacf4\",\"panelRefName\":\"panel_5\",\"type\":\"visualization\",\"version\":\"7.16.2\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":21,\"i\":\"a2629365-4540-4700-abd5-299070e39233\",\"w\":16,\"x\":32,\"y\":48},\"panelIndex\":\"a2629365-4540-4700-abd5-299070e39233\",\"panelRefName\":\"panel_6\",\"type\":\"visualization\",\"version\":\"7.16.2\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":21,\"i\":\"90e1564e-ec66-4a1f-9416-53a3fef9b577\",\"w\":16,\"x\":0,\"y\":48},\"panelIndex\":\"90e1564e-ec66-4a1f-9416-53a3fef9b577\",\"panelRefName\":\"panel_7\",\"type\":\"visualization\",\"version\":\"7.16.2\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":21,\"i\":\"ff526e93-a3f7-4155-b493-bb0427f87001\",\"w\":16,\"x\":16,\"y\":48},\"panelIndex\":\"ff526e93-a3f7-4155-b493-bb0427f87001\",\"panelRefName\":\"panel_8\",\"type\":\"visualization\",\"version\":\"7.16.2\"},{\"embeddableConfig\":{\"enhancements\":{},\"hidePanelTitles\":false,\"table\":null,\"vis\":{\"params\":{\"colWidth\":[{\"colIndex\":7,\"width\":123.44444444444446},{\"colIndex\":4,\"width\":230.56944444444446},{\"colIndex\":1,\"width\":150.56944444444443},{\"colIndex\":0,\"width\":164.40277777777774},{\"colIndex\":6,\"width\":109.0027777777778},{\"colIndex\":5,\"width\":110.75277777777777},{\"colIndex\":8,\"width\":90.08611111111111},{\"colIndex\":3,\"width\":176.5861111111111},{\"colIndex\":2,\"width\":222.58611111111122}]}}},\"gridData\":{\"h\":15,\"i\":\"89b6c2a3-3ae8-4bfc-9af0-0711f588ce30\",\"w\":48,\"x\":0,\"y\":69},\"panelIndex\":\"89b6c2a3-3ae8-4bfc-9af0-0711f588ce30\",\"panelRefName\":\"panel_9\",\"title\":\"[Zscaler] [ZIA] Distribution of Firewall Events by Threat Category, IP Category, Traffic Forwarding Method, Application, Destination NAT policy applied, Action, Department, Location, Used Protocol\",\"type\":\"visualization\",\"version\":\"7.16.2\"}]", - "timeRestore": false, - "title": "[Zscaler] [ZIA] Firewall Logs", - "version": 1 - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-66597790-4ded-11ec-ad09-d9f49962d407", - "migrationVersion": { - "dashboard": "7.16.0" - }, - "references": [ - { - "id": "zscaler_zia-dff0d0b0-4dea-11ec-ad09-d9f49962d407", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "zscaler_zia-a536b890-4e80-11ec-ad09-d9f49962d407", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "zscaler_zia-db1241f0-4e80-11ec-ad09-d9f49962d407", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "zscaler_zia-63155460-4e82-11ec-ad09-d9f49962d407", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "zscaler_zia-72169a60-4deb-11ec-ad09-d9f49962d407", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "zscaler_zia-4e583660-4deb-11ec-ad09-d9f49962d407", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "zscaler_zia-da1734d0-4deb-11ec-ad09-d9f49962d407", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "zscaler_zia-9e6d2890-4deb-11ec-ad09-d9f49962d407", - "name": "panel_7", - "type": "visualization" - }, - { - "id": "zscaler_zia-f5a2e730-4deb-11ec-ad09-d9f49962d407", - "name": "panel_8", - "type": "visualization" - }, - { - "id": "zscaler_zia-3faec910-4ded-11ec-ad09-d9f49962d407", - "name": "panel_9", - "type": "visualization" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-85380a00-4de3-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-85380a00-4de3-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 652e1327f1..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-85380a00-4de3-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,72 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"677982f9-75a5-4420-a0e4-65778e28370f\",\"w\":16,\"x\":0,\"y\":0},\"panelIndex\":\"677982f9-75a5-4420-a0e4-65778e28370f\",\"panelRefName\":\"panel_0\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"329767e7-da25-44aa-ab86-b18b9f6e3a24\",\"w\":16,\"x\":16,\"y\":0},\"panelIndex\":\"329767e7-da25-44aa-ab86-b18b9f6e3a24\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"dbf7121d-902c-4979-a56a-aeecb89dc781\",\"w\":16,\"x\":32,\"y\":0},\"panelIndex\":\"dbf7121d-902c-4979-a56a-aeecb89dc781\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"4421e7b7-c2b0-4463-8646-03616ddfe9cb\",\"w\":24,\"x\":0,\"y\":15},\"panelIndex\":\"4421e7b7-c2b0-4463-8646-03616ddfe9cb\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"ade94ac6-4269-4d88-9e63-5295cee65475\",\"w\":24,\"x\":24,\"y\":15},\"panelIndex\":\"ade94ac6-4269-4d88-9e63-5295cee65475\",\"panelRefName\":\"panel_4\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"95e9a752-3269-4679-b1a8-3826fc6fd463\",\"w\":24,\"x\":0,\"y\":30},\"panelIndex\":\"95e9a752-3269-4679-b1a8-3826fc6fd463\",\"panelRefName\":\"panel_5\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"1c2c054a-b244-4f93-84b2-68e4228a2956\",\"w\":24,\"x\":24,\"y\":30},\"panelIndex\":\"1c2c054a-b244-4f93-84b2-68e4228a2956\",\"panelRefName\":\"panel_6\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"35acb8fb-304a-4651-88fa-6f080c7b258b\",\"w\":24,\"x\":24,\"y\":45},\"panelIndex\":\"35acb8fb-304a-4651-88fa-6f080c7b258b\",\"panelRefName\":\"panel_7\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":22,\"i\":\"1f29cb86-55d1-4caa-b012-3d8e674fb401\",\"w\":48,\"x\":0,\"y\":60},\"panelIndex\":\"1f29cb86-55d1-4caa-b012-3d8e674fb401\",\"panelRefName\":\"panel_8\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"f2101d90-704b-46e5-b73a-567fb731bcda\",\"w\":24,\"x\":0,\"y\":45},\"panelIndex\":\"f2101d90-704b-46e5-b73a-567fb731bcda\",\"panelRefName\":\"panel_9\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"}]", - "timeRestore": false, - "title": "[Zscaler] [ZIA] Web Logs", - "version": 1 - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-85380a00-4de3-11ec-ad09-d9f49962d407", - "migrationVersion": { - "dashboard": "7.16.0" - }, - "references": [ - { - "id": "zscaler_zia-7a0a40d0-4de3-11ec-ad09-d9f49962d407", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "zscaler_zia-a9ac0260-4de3-11ec-ad09-d9f49962d407", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "zscaler_zia-c8b23580-4de3-11ec-ad09-d9f49962d407", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "zscaler_zia-68d16b80-4de4-11ec-ad09-d9f49962d407", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "zscaler_zia-0334d8c0-4de4-11ec-ad09-d9f49962d407", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "zscaler_zia-2958ae90-4de5-11ec-ad09-d9f49962d407", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "zscaler_zia-e54e9f20-4de4-11ec-ad09-d9f49962d407", - "name": "panel_6", - "type": "visualization" - }, - { - "id": "zscaler_zia-5ebff250-4de5-11ec-ad09-d9f49962d407", - "name": "panel_7", - "type": "visualization" - }, - { - "id": "zscaler_zia-35612ae0-4de6-11ec-ad09-d9f49962d407", - "name": "panel_8", - "type": "visualization" - }, - { - "id": "zscaler_zia-652829d0-4eb9-11ec-9527-b704eaaa5c53", - "name": "panel_9", - "type": "visualization" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-9447f5b0-4eaf-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-9447f5b0-4eaf-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index 8dbf59dd7a..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-9447f5b0-4eaf-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,57 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"fa228027-f96f-4c6c-8ff2-ba35c24ab5f3\",\"w\":24,\"x\":0,\"y\":0},\"panelIndex\":\"fa228027-f96f-4c6c-8ff2-ba35c24ab5f3\",\"panelRefName\":\"panel_0\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"486db5cd-c4a8-4a4f-b794-3811989c9f2a\",\"w\":24,\"x\":24,\"y\":0},\"panelIndex\":\"486db5cd-c4a8-4a4f-b794-3811989c9f2a\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"dedfb661-d4dc-4748-a286-8af6d668bd05\",\"w\":24,\"x\":0,\"y\":15},\"panelIndex\":\"dedfb661-d4dc-4748-a286-8af6d668bd05\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"6ab75387-2a14-4d5f-adef-2ab49ed51674\",\"w\":24,\"x\":24,\"y\":15},\"panelIndex\":\"6ab75387-2a14-4d5f-adef-2ab49ed51674\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"b757507b-409b-4695-b558-daff6d0382db\",\"w\":24,\"x\":0,\"y\":30},\"panelIndex\":\"b757507b-409b-4695-b558-daff6d0382db\",\"panelRefName\":\"panel_4\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"75e785d6-2c8f-4608-b204-4688a66ad14e\",\"w\":24,\"x\":24,\"y\":30},\"panelIndex\":\"75e785d6-2c8f-4608-b204-4688a66ad14e\",\"panelRefName\":\"panel_5\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":19,\"i\":\"b92519fe-1070-4e1f-a38d-8796c26af893\",\"w\":48,\"x\":0,\"y\":45},\"panelIndex\":\"b92519fe-1070-4e1f-a38d-8796c26af893\",\"panelRefName\":\"panel_6\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"}]", - "timeRestore": false, - "title": "[Zscaler] [ZIA] Tunnel Logs", - "version": 1 - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-9447f5b0-4eaf-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "dashboard": "7.16.0" - }, - "references": [ - { - "id": "zscaler_zia-2c8eb9f0-4eae-11ec-9527-b704eaaa5c53", - "name": "panel_0", - "type": "visualization" - }, - { - "id": "zscaler_zia-8058c4e0-4eae-11ec-9527-b704eaaa5c53", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "zscaler_zia-4d4b4fa0-4eae-11ec-9527-b704eaaa5c53", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "zscaler_zia-bcddbd40-4ead-11ec-9527-b704eaaa5c53", - "name": "panel_3", - "type": "visualization" - }, - { - "id": "zscaler_zia-e4f2aa20-4ead-11ec-9527-b704eaaa5c53", - "name": "panel_4", - "type": "visualization" - }, - { - "id": "zscaler_zia-05cc16a0-4eae-11ec-9527-b704eaaa5c53", - "name": "panel_5", - "type": "visualization" - }, - { - "id": "zscaler_zia-5b68c940-4eaf-11ec-9527-b704eaaa5c53", - "name": "panel_6", - "type": "visualization" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-d4977590-4de8-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-d4977590-4de8-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 19dbbfda5b..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/dashboard/zscaler_zia-d4977590-4de8-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,42 +0,0 @@ -{ - "attributes": { - "description": "", - "hits": 0, - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"query\":{\"language\":\"kuery\",\"query\":\"\"}}" - }, - "optionsJSON": "{\"hidePanelTitles\":false,\"syncColors\":false,\"useMargins\":true}", - "panelsJSON": "[{\"embeddableConfig\":{\"enhancements\":{},\"hiddenLayers\":[],\"isLayerTOCOpen\":true,\"mapBuffer\":{\"maxLat\":66.51326,\"maxLon\":180,\"minLat\":-66.51326,\"minLon\":-180},\"mapCenter\":{\"lat\":19.94277,\"lon\":0,\"zoom\":1.06},\"openTOCDetails\":[]},\"gridData\":{\"h\":17,\"i\":\"8b4eb1df-17aa-4d80-8b26-1920b5150cad\",\"w\":48,\"x\":0,\"y\":0},\"panelIndex\":\"8b4eb1df-17aa-4d80-8b26-1920b5150cad\",\"panelRefName\":\"panel_0\",\"type\":\"map\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":17,\"i\":\"db8f6083-5ad4-4a49-84a3-f89318befd32\",\"w\":24,\"x\":0,\"y\":17},\"panelIndex\":\"db8f6083-5ad4-4a49-84a3-f89318befd32\",\"panelRefName\":\"panel_1\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":17,\"i\":\"13fd9028-3dd5-4262-b7bb-3cba5d6c98cd\",\"w\":24,\"x\":24,\"y\":17},\"panelIndex\":\"13fd9028-3dd5-4262-b7bb-3cba5d6c98cd\",\"panelRefName\":\"panel_2\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"},{\"embeddableConfig\":{\"enhancements\":{}},\"gridData\":{\"h\":15,\"i\":\"47b652f2-0e00-4b5d-9e94-b5ade2b0c6e6\",\"w\":48,\"x\":0,\"y\":34},\"panelIndex\":\"47b652f2-0e00-4b5d-9e94-b5ade2b0c6e6\",\"panelRefName\":\"panel_3\",\"type\":\"visualization\",\"version\":\"7.16.0-SNAPSHOT\"}]", - "timeRestore": false, - "title": "[Zscaler] [ZIA] DNS Logs", - "version": 1 - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-d4977590-4de8-11ec-ad09-d9f49962d407", - "migrationVersion": { - "dashboard": "7.16.0" - }, - "references": [ - { - "id": "zscaler_zia-48a188a0-4de8-11ec-ad09-d9f49962d407", - "name": "panel_0", - "type": "map" - }, - { - "id": "zscaler_zia-6d29cc50-4de8-11ec-ad09-d9f49962d407", - "name": "panel_1", - "type": "visualization" - }, - { - "id": "zscaler_zia-91813c00-4de8-11ec-ad09-d9f49962d407", - "name": "panel_2", - "type": "visualization" - }, - { - "id": "zscaler_zia-bd00f230-4de8-11ec-ad09-d9f49962d407", - "name": "panel_3", - "type": "visualization" - } - ], - "type": "dashboard" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/map/zscaler_zia-48a188a0-4de8-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/map/zscaler_zia-48a188a0-4de8-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 6ea14f4ec5..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/map/zscaler_zia-48a188a0-4de8-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,22 +0,0 @@ -{ - "attributes": { - "description": "", - "layerListJSON": "[{\"alpha\":1,\"id\":\"9d6d7cae-7cff-491c-abc8-40d6d4f575b0\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"sourceDescriptor\":{\"isAutoSelect\":true,\"type\":\"EMS_TMS\"},\"style\":{\"type\":\"TILE\"},\"type\":\"VECTOR_TILE\",\"visible\":true},{\"alpha\":0.75,\"id\":\"03c492fe-96d8-48ab-a5b4-3eec4ae2a230\",\"includeInFitToBounds\":true,\"label\":null,\"maxZoom\":24,\"minZoom\":0,\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.dns\\\"\"},\"sourceDescriptor\":{\"applyForceRefresh\":true,\"applyGlobalQuery\":true,\"applyGlobalTime\":true,\"geoField\":\"client.geo.location\",\"id\":\"636e2366-af59-41da-a0af-83b10b7a1b47\",\"indexPatternRefName\":\"layer_1_source_index_pattern\",\"metrics\":[{\"type\":\"count\"}],\"requestType\":\"heatmap\",\"resolution\":\"COARSE\",\"type\":\"ES_GEO_GRID\"},\"style\":{\"colorRampName\":\"theclassic\",\"type\":\"HEATMAP\"},\"type\":\"HEATMAP\",\"visible\":true}]", - "mapStateJSON": "{\"center\":{\"lat\":19.94277,\"lon\":0},\"filters\":[],\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.dns\\\"\"},\"refreshConfig\":{\"interval\":0,\"isPaused\":true},\"settings\":{\"autoFitToDataBounds\":false,\"backgroundColor\":\"#ffffff\",\"browserLocation\":{\"zoom\":2},\"disableInteractive\":false,\"disableTooltipControl\":false,\"fixedLocation\":{\"lat\":0,\"lon\":0,\"zoom\":2},\"hideLayerControl\":false,\"hideToolbarOverlay\":false,\"hideViewControl\":false,\"initialLocation\":\"LAST_SAVED_LOCATION\",\"maxZoom\":24,\"minZoom\":0,\"showScaleControl\":false,\"showSpatialFilters\":true,\"showTimesliderToggleButton\":true,\"spatialFiltersAlpa\":0.3,\"spatialFiltersFillColor\":\"#DA8B45\",\"spatialFiltersLineColor\":\"#DA8B45\"},\"timeFilters\":{\"from\":\"now-5y\",\"to\":\"now\"},\"zoom\":1.06}", - "title": "[Zscaler] [ZIA] DNS Events by Region", - "uiStateJSON": "{\"isLayerTOCOpen\":true,\"openTOCDetails\":[]}" - }, - "coreMigrationVersion": "7.16.2", - "id": "zscaler_zia-48a188a0-4de8-11ec-ad09-d9f49962d407", - "migrationVersion": { - "map": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "layer_1_source_index_pattern", - "type": "index-pattern" - } - ], - "type": "map" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-0334d8c0-4de4-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-0334d8c0-4de4-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 0797594345..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-0334d8c0-4de4-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"rule.ruleset\",\"negate\":true,\"params\":{\"query\":\"None\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"rule.ruleset\":\"None\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.web\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Rule type", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Rule Type\",\"field\":\"rule.ruleset\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Zscaler] [ZIA] Top 10 Rule type\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-0334d8c0-4de4-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-05cc16a0-4eae-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-05cc16a0-4eae-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index 2c1df44f82..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-05cc16a0-4eae-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.tunnel\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Destination IPs", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Destination IP\",\"field\":\"destination.ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Top 10 Destination IPs\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-05cc16a0-4eae-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-2958ae90-4de5-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-2958ae90-4de5-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 1aa1da187d..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-2958ae90-4de5-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.web\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Users", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"user.email\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Zscaler] [ZIA] Top 10 Users\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-2958ae90-4de5-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-2c8eb9f0-4eae-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-2c8eb9f0-4eae-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index fb304fb0c9..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-2c8eb9f0-4eae-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.tunnel\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Distribution of Tunnel Events by Tunnel Type", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Tunnel Type\",\"field\":\"zscaler_zia.tunnel.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler] [ZIA] Distribution of Tunnel Events by Tunnel Type\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-2c8eb9f0-4eae-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-35612ae0-4de6-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-35612ae0-4de6-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 838f845a8d..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-35612ae0-4de6-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.web\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Distribution of Web Events by Action, Malware Category, App Class, Response Code, Department, Username, URL", - "uiStateJSON": "{\"vis\":{\"params\":{\"colWidth\":[{\"colIndex\":5,\"width\":137.71428571428572},{\"colIndex\":6,\"width\":194.0408163265306}]}}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"7\",\"params\":{\"customLabel\":\"Username\",\"field\":\"client.user.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Action\",\"field\":\"event.action\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Malware Category\",\"field\":\"zscaler_zia.web.malware.category\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Application Class\",\"field\":\"zscaler_zia.web.app.class\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"Response Code\",\"field\":\"http.response.status_code\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"6\",\"params\":{\"customLabel\":\"Department\",\"field\":\"zscaler_zia.web.department\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"8\",\"params\":{\"customLabel\":\"URL\",\"field\":\"url.original\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":true,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Distribution of Web Events by Action, Malware Category, App Class, Response Code, Department, Username, URL\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-35612ae0-4de6-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-3faec910-4ded-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-3faec910-4ded-11ec-ad09-d9f49962d407.json deleted file mode 100755 index ed2afec7c7..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-3faec910-4ded-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.firewall\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Distribution of Firewall Events by Threat Category, IP Category, Traffic Forwarding Method, network application that accessed web, Destination NAT policy applied, Action, Department, Location, Used Protocol", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Threat Category\",\"field\":\"zscaler_zia.firewall.threat.category\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"IP Category\",\"field\":\"zscaler_zia.firewall.ip_category\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Traffic Forwarding Method\",\"field\":\"zscaler_zia.firewall.tunnel.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"Application Name\",\"field\":\"network.application\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"6\",\"params\":{\"customLabel\":\"Destination NAT policy applied\",\"field\":\"zscaler_zia.firewall.nat\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"7\",\"params\":{\"customLabel\":\"Action\",\"field\":\"event.action\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"10\",\"params\":{\"customLabel\":\"Location\",\"field\":\"zscaler_zia.firewall.location.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"8\",\"params\":{\"customLabel\":\"Department\",\"field\":\"zscaler_zia.firewall.department\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"9\",\"params\":{\"customLabel\":\"Protocol Used\",\"field\":\"network.transport\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Distribution of Firewall Events by Threat Category, IP Category, Traffic Forwarding Method, network application that accessed web, Destination NAT policy applied, Action, Department, Location, Used Protocol\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-3faec910-4ded-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-4d4b4fa0-4eae-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-4d4b4fa0-4eae-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index f1318a9192..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-4d4b4fa0-4eae-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.tunnel\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Distribution of Tunnel Events by Location", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Location\",\"field\":\"zscaler_zia.tunnel.location.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler] [ZIA] Distribution of Tunnel Events by Location\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-4d4b4fa0-4eae-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-4e583660-4deb-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-4e583660-4deb-11ec-ad09-d9f49962d407.json deleted file mode 100755 index a7e8531244..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-4e583660-4deb-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.firewall\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Tunnel IPs", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Tunnel IPs\",\"field\":\"zscaler_zia.firewall.tunnel.ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Top 10 Tunnel IPs\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-4e583660-4deb-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-5b68c940-4eaf-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-5b68c940-4eaf-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index 394fc4f287..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-5b68c940-4eaf-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.tunnel\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Distribution of Tunnel Events by Encryption Algorithm, Authentication Algorithm, Authentication Type, Tunnel Action name, Protocol, Source IP, Destination IP", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Encryption Algorithm\",\"field\":\"zscaler_zia.tunnel.encryption.algorithm\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Authentication Algorithm\",\"field\":\"zscaler_zia.tunnel.authentication.algorithm\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"4\",\"params\":{\"customLabel\":\"Authentication Type\",\"field\":\"zscaler_zia.tunnel.authentication.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"5\",\"params\":{\"customLabel\":\"Tunnel Action Name\",\"field\":\"zscaler_zia.tunnel.action.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"6\",\"params\":{\"customLabel\":\"Protocol\",\"field\":\"zscaler_zia.tunnel.policy.protocol\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"7\",\"params\":{\"customLabel\":\"Source IP\",\"field\":\"source.ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"},{\"enabled\":true,\"id\":\"8\",\"params\":{\"customLabel\":\"Destination IP\",\"field\":\"destination.ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Distribution of Tunnel Events by Encryption algorithm, Authentication algorithm, Authentication Type, Action name, Protocol, Source IP, Destination IP\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-5b68c940-4eaf-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-5ebff250-4de5-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-5ebff250-4de5-11ec-ad09-d9f49962d407.json deleted file mode 100755 index af8777ca1e..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-5ebff250-4de5-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.web\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Protocol of Web Events Over time", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"drop_partials\":false,\"extended_bounds\":{},\"field\":\"@timestamp\",\"interval\":\"auto\",\"min_doc_count\":1,\"scaleMetricValues\":false,\"timeRange\":{\"from\":\"now-15y\",\"to\":\"now\"},\"useNormalizedEsInterval\":true,\"used_interval\":\"30d\"},\"schema\":\"segment\",\"type\":\"date_histogram\"},{\"enabled\":true,\"id\":\"3\",\"params\":{\"customLabel\":\"Protocol\",\"field\":\"network.protocol\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"group\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"fittingFunction\":\"linear\",\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"radiusRatio\":9,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"line\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"line\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Zscaler] [ZIA] Protocol of Web Events Over time\",\"type\":\"line\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-5ebff250-4de5-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-63155460-4e82-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-63155460-4e82-11ec-ad09-d9f49962d407.json deleted file mode 100755 index a0e7f8d01a..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-63155460-4e82-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.firewall\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 rule", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Rules\",\"exclude\":\"None\",\"field\":\"rule.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":9},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"position\":\"bottom\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{\"show\":false},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"stacked\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"left\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Zscaler] [ZIA] Top 10 rule\",\"type\":\"histogram\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-63155460-4e82-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-652829d0-4eb9-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-652829d0-4eb9-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index 41943205eb..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-652829d0-4eb9-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.web\\\" and not http.response.status_code: \\\"200\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 failed URLs", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"URL\",\"field\":\"url.original\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Top 10 failed URLs\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-652829d0-4eb9-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-68d16b80-4de4-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-68d16b80-4de4-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 17ecff711a..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-68d16b80-4de4-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"rule.name\",\"negate\":true,\"params\":{\"query\":\"None\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"rule.name\":\"None\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.web\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Rule Name", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Rule Name\",\"field\":\"rule.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Zscaler] [ZIA] Top 10 Rule Name\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-68d16b80-4de4-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-6d29cc50-4de8-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-6d29cc50-4de8-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 67a3b6c917..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-6d29cc50-4de8-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.dns\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Distribution of DNS Events by Department", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Department\",\"field\":\"zscaler_zia.dns.department\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler] [ZIA] Distribution of DNS Events by Department\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-6d29cc50-4de8-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-72169a60-4deb-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-72169a60-4deb-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 00c8458d1a..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-72169a60-4deb-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.firewall\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Server Source IP", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Server Source IP\",\"field\":\"zscaler_zia.firewall.server.source.ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Top 10 Server Source IP\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-72169a60-4deb-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-7a0a40d0-4de3-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-7a0a40d0-4de3-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 61ec3e5c13..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-7a0a40d0-4de3-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"zscaler_zia.web.threat.name\",\"negate\":true,\"params\":{\"query\":\"None\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"zscaler_zia.web.threat.name\":\"None\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.web\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Total Threats", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Total Threats\",\"field\":\"zscaler_zia.web.threat.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":60,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"[Zscaler] [ZIA] Total Threats\",\"type\":\"metric\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-7a0a40d0-4de3-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-8058c4e0-4eae-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-8058c4e0-4eae-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index 13be4500fe..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-8058c4e0-4eae-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.tunnel\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Distribution of Tunnel Events by Vendor Name of Edge Device", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Vendor Name of Edge Device\",\"field\":\"zscaler_zia.tunnel.vendor.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":5},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler] [ZIA] Distribution of Tunnel Events by Vendor Name of Edge Device\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-8058c4e0-4eae-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-91813c00-4de8-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-91813c00-4de8-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 7e751c6f8a..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-91813c00-4de8-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.dns\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Distribution of DNS Events by Request Action", - "uiStateJSON": "{\"vis\":{\"legendOpen\":true}}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Request Action\",\"field\":\"zscaler_zia.dns.request.action\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTooltip\":true,\"distinctColors\":false,\"isDonut\":false,\"labels\":{\"last_level\":false,\"percentDecimals\":2,\"position\":\"default\",\"show\":true,\"truncate\":100,\"values\":true,\"valuesFormat\":\"percent\"},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"nestedLegend\":false,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"truncateLegend\":true,\"type\":\"pie\"},\"title\":\"[Zscaler] [ZIA] Distribution of DNS Events by Request Action\",\"type\":\"pie\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-91813c00-4de8-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-9e6d2890-4deb-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-9e6d2890-4deb-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 4f91943c75..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-9e6d2890-4deb-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.firewall\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Server Destination IP", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Server Destination IP\",\"field\":\"zscaler_zia.firewall.server.destination.ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Top 10 Server Destination IP\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-9e6d2890-4deb-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-a536b890-4e80-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-a536b890-4e80-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 52fc4d2f3f..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-a536b890-4e80-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"zscaler_zia.firewall.threat.name\",\"negate\":true,\"params\":{\"query\":\"None\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"zscaler_zia.firewall.threat.name\":\"None\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.firewall\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Threats detected by Firewall", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Threat Name\",\"field\":\"zscaler_zia.firewall.threat.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Zscaler] [ZIA] Top 10 Threats detected by Firewall\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-a536b890-4e80-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-a9ac0260-4de3-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-a9ac0260-4de3-11ec-ad09-d9f49962d407.json deleted file mode 100755 index cfae00dc9b..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-a9ac0260-4de3-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"zscaler_zia.web.threat.name\",\"negate\":true,\"params\":{\"query\":\"None\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"zscaler_zia.web.threat.name\":\"None\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.web\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Threats by name", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Threat Name\",\"field\":\"zscaler_zia.web.threat.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Top 10 Threats by name\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-a9ac0260-4de3-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-bcddbd40-4ead-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-bcddbd40-4ead-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index 4b396fe262..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-bcddbd40-4ead-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.tunnel\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Tunnel Action Name", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Tunnel Action Name\",\"field\":\"zscaler_zia.tunnel.action.type\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Top 10 Tunnel Action Name\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-bcddbd40-4ead-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-bd00f230-4de8-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-bd00f230-4de8-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 4440e03daa..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-bd00f230-4de8-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.dns\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 DNS Rules", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Rules\",\"field\":\"zscaler_zia.dns.request.rule.label\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Zscaler] [ZIA] Top 10 DNS Rules\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-bd00f230-4de8-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-c8b23580-4de3-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-c8b23580-4de3-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 4e533feac7..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-c8b23580-4de3-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.web\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 App Name accessing Web", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"App Name\",\"field\":\"zscaler_zia.web.app.name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Top 10 App Name accessing Web\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-c8b23580-4de3-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-da1734d0-4deb-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-da1734d0-4deb-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 2d488981cf..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-da1734d0-4deb-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.firewall\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Client Source IP", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Client Source IP\",\"field\":\"zscaler_zia.firewall.client.source.ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Top 10 Client Source IP\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-da1734d0-4deb-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-db1241f0-4e80-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-db1241f0-4e80-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 9720ff2c44..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-db1241f0-4e80-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.firewall\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Destination Country", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Destination Country\",\"field\":\"server.geo.country_name\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Zscaler] [ZIA] Top 10 Destination Country\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-db1241f0-4e80-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-dff0d0b0-4dea-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-dff0d0b0-4dea-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 275a6a6d55..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-dff0d0b0-4dea-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,30 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[{\"$state\":{\"store\":\"appState\"},\"meta\":{\"alias\":null,\"disabled\":false,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index\",\"key\":\"zscaler_zia.firewall.threat.name\",\"negate\":true,\"params\":{\"query\":\"None\"},\"type\":\"phrase\"},\"query\":{\"match_phrase\":{\"zscaler_zia.firewall.threat.name\":\"None\"}}}],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.firewall\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Total Threats detected by Firewall", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{\"customLabel\":\"Total Threats\",\"field\":\"zscaler_zia.firewall.threat.name\"},\"schema\":\"metric\",\"type\":\"cardinality\"}],\"params\":{\"addLegend\":false,\"addTooltip\":true,\"metric\":{\"colorSchema\":\"Green to Red\",\"colorsRange\":[{\"from\":0,\"to\":10000}],\"invertColors\":false,\"labels\":{\"show\":true},\"metricColorMode\":\"None\",\"percentageMode\":false,\"style\":{\"bgColor\":false,\"bgFill\":\"#000\",\"fontSize\":60,\"labelColor\":false,\"subText\":\"\"},\"useRanges\":false},\"type\":\"metric\"},\"title\":\"[Zscaler] [ZIA] Total Threats detected by Firewall\",\"type\":\"metric\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-dff0d0b0-4dea-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - }, - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.filter[0].meta.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-e4f2aa20-4ead-11ec-9527-b704eaaa5c53.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-e4f2aa20-4ead-11ec-9527-b704eaaa5c53.json deleted file mode 100755 index 547c66295b..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-e4f2aa20-4ead-11ec-9527-b704eaaa5c53.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.tunnel\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Source IPs", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Source IP\",\"field\":\"source.ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Top 10 Source IPs\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-e4f2aa20-4ead-11ec-9527-b704eaaa5c53", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-e54e9f20-4de4-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-e54e9f20-4de4-11ec-ad09-d9f49962d407.json deleted file mode 100755 index cf24b5bd13..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-e54e9f20-4de4-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.web\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 URL Categories", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"field\":\"zscaler_zia.web.url.category.sub\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"segment\",\"type\":\"terms\"}],\"params\":{\"addLegend\":true,\"addTimeMarker\":false,\"addTooltip\":true,\"categoryAxes\":[{\"id\":\"CategoryAxis-1\",\"labels\":{\"filter\":false,\"rotate\":0,\"show\":true,\"truncate\":200},\"position\":\"left\",\"scale\":{\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{},\"type\":\"category\"}],\"detailedTooltip\":true,\"grid\":{\"categoryLines\":false},\"labels\":{},\"legendPosition\":\"right\",\"maxLegendLines\":1,\"palette\":{\"name\":\"temperature\",\"type\":\"palette\"},\"radiusRatio\":0,\"seriesParams\":[{\"circlesRadius\":3,\"data\":{\"id\":\"1\",\"label\":\"Count\"},\"drawLinesBetweenPoints\":true,\"interpolate\":\"linear\",\"lineWidth\":2,\"mode\":\"normal\",\"show\":true,\"showCircles\":true,\"type\":\"histogram\",\"valueAxis\":\"ValueAxis-1\"}],\"thresholdLine\":{\"color\":\"#E7664C\",\"show\":false,\"style\":\"full\",\"value\":10,\"width\":1},\"times\":[],\"truncateLegend\":true,\"type\":\"histogram\",\"valueAxes\":[{\"id\":\"ValueAxis-1\",\"labels\":{\"filter\":true,\"rotate\":0,\"show\":true,\"truncate\":100},\"name\":\"LeftAxis-1\",\"position\":\"bottom\",\"scale\":{\"mode\":\"normal\",\"type\":\"linear\"},\"show\":true,\"style\":{},\"title\":{\"text\":\"\"},\"type\":\"value\"}]},\"title\":\"[Zscaler] [ZIA] Top 10 URL Categories\",\"type\":\"horizontal_bar\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-e54e9f20-4de4-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-f5a2e730-4deb-11ec-ad09-d9f49962d407.json b/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-f5a2e730-4deb-11ec-ad09-d9f49962d407.json deleted file mode 100755 index 882d561ac9..0000000000 --- a/packages/zscaler_zia/0.1.0/kibana/visualization/zscaler_zia-f5a2e730-4deb-11ec-ad09-d9f49962d407.json +++ /dev/null @@ -1,25 +0,0 @@ -{ - "attributes": { - "description": "", - "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"event.dataset: \\\"zscaler_zia.firewall\\\"\"}}" - }, - "title": "[Zscaler] [ZIA] Top 10 Client Destination IP", - "uiStateJSON": "{}", - "version": 1, - "visState": "{\"aggs\":[{\"enabled\":true,\"id\":\"1\",\"params\":{},\"schema\":\"metric\",\"type\":\"count\"},{\"enabled\":true,\"id\":\"2\",\"params\":{\"customLabel\":\"Client Destination IP\",\"field\":\"zscaler_zia.firewall.client.destination.ip\",\"missingBucket\":false,\"missingBucketLabel\":\"Missing\",\"order\":\"desc\",\"orderBy\":\"1\",\"otherBucket\":false,\"otherBucketLabel\":\"Other\",\"size\":10},\"schema\":\"bucket\",\"type\":\"terms\"}],\"params\":{\"autoFitRowToContent\":false,\"perPage\":10,\"percentageCol\":\"\",\"showMetricsAtAllLevels\":false,\"showPartialRows\":false,\"showToolbar\":false,\"showTotal\":false,\"totalFunc\":\"sum\"},\"title\":\"[Zscaler] [ZIA] Top 10 Client Destination IP\",\"type\":\"table\"}" - }, - "coreMigrationVersion": "7.16.0", - "id": "zscaler_zia-f5a2e730-4deb-11ec-ad09-d9f49962d407", - "migrationVersion": { - "visualization": "7.14.0" - }, - "references": [ - { - "id": "logs-*", - "name": "kibanaSavedObjectMeta.searchSourceJSON.index", - "type": "index-pattern" - } - ], - "type": "visualization" -} \ No newline at end of file diff --git a/packages/zscaler_zia/0.1.0/manifest.yml b/packages/zscaler_zia/0.1.0/manifest.yml deleted file mode 100755 index adbe54947e..0000000000 --- a/packages/zscaler_zia/0.1.0/manifest.yml +++ /dev/null @@ -1,70 +0,0 @@ -format_version: 1.0.0 -name: zscaler_zia -title: "Zscaler Internet Access" -version: 0.1.0 -license: basic -description: Collect logs from Zscaler Internet Access (ZIA) with Elastic Agent. -type: integration -categories: - - security -release: beta -conditions: - kibana.version: ^7.16.2 || ^8.0.0 -screenshots: - - src: /img/zscaler-zia-screenshot.png - title: Zscaler ZIA web log dashboard screenshot - size: 600x600 - type: image/png -icons: - - src: /img/zscaler-logo.svg - title: Zscaler logo - size: 32x32 - type: image/svg+xml -policy_templates: - - name: zscaler_zia - title: Zscaler Internet Access logs - description: Collect Zscaler Internet Access logs - inputs: - - type: tcp - vars: - - name: listen_address - type: text - title: Listen Address - description: The bind address to listen for TCP connections. Set to `0.0.0.0` to bind to all available interfaces. - multi: false - required: true - show_user: true - default: localhost - - name: ssl - type: yaml - title: SSL Configuration - description: i.e. certificate_authorities, supported_protocols, verification_mode etc. - multi: false - required: false - show_user: false - default: | - #certificate_authorities: - # - | - # -----BEGIN CERTIFICATE----- - # MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF - # ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2 - # MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB - # BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n - # fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl - # 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t - # /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP - # PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41 - # CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O - # BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux - # 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D - # 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw - # 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA - # H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu - # 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0 - # yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk - # sxSmbIUfc2SGJGCJD4I= - # -----END CERTIFICATE----- - title: Collect Zscaler Internet Access logs via TCP input - description: Collecting Zscaler Internet Access logs via TCP input -owner: - github: elastic/security-external-integrations