| 000-source-file.yml |
Source file that fetchs data from source file |
_001_SOURCE_FILE |
Path to source vector vector component (file or directory) |
| 000-source-test-file-with-receiver-emulation.yml |
Fetch data from source file then parses it as JSON and performs receiver like transformations. |
VECTOR_ENRICHMENT_PATH |
Directory where enrichment CSVs are located; |
| 000-source-test-file-with-receiver-emulation.yml |
Fetch data from source file then parses it as JSON and performs receiver like transformations. |
EVENT_CATEGORY_MAP_CSV |
File for event.category value mapping; |
| 000-source-test-file-with-receiver-emulation.yml |
Fetch data from source file then parses it as JSON and performs receiver like transformations. |
_001_SOURCE_FILE |
Path to source data examples; |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from kafka topic |
KAFKA_MTLS_PATH |
the path for the pki certificates landed from Secret Manager or Hashicorp Vault for MTLS to Kafka/MSK |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from kafka topic |
KAFKA_BROKERS |
the comma delimited list of hostname:port for kafka brokers |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from kafka topic |
KAFKA_TOPIC |
the topic to pull data from |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from kafka topic |
KAFKA_SOURCE_TOPIC_SUFFIX |
suffix of the topic to pull data from |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from kafka topic |
KAFKA_CONSUMER_GROUP |
the consumer group associated with this topic |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from Kafka topic |
KAFKA_MTLS_PATH |
The path for the PKI certificates landed from Secret Manager or Hashicorp Vault for MTLS to Kafka/MSK. |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from Kafka topic |
KAFKA_BROKERS |
The comma-delimited list of hostname:port for Kafka brokers. |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from Kafka topic |
KAFKA_SOURCE_TOPIC |
The base topic to pull data from. |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from Kafka topic |
KAFKA_SOURCE_TOPIC_SUFFIX |
Suffix of the topic to pull data from. |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from Kafka topic |
KAFKA_CONSUMER_GROUP |
The consumer group associated with this topic. |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from Kafka topic |
KAFKA_MESSAGE_MAX_BYTES |
Maximum message size (in bytes) the broker can accept. Default: 10485760. |
| 001-source-kafka-aws-saas.yml |
Source file that fetches data from Kafka topic |
KAFKA_FETCH_WAIT_MAX_MS |
Maximum time (in milliseconds) the broker will wait to accumulate data before responding to a fetch request. Default: 10000. |
| 002-source-kafka-event-hub.yml |
Source for HyperSec XDR External Azure tenancy - Configuration for SASL authentication |
N/A |
N/A |
| 003-source-kafka-aws-saas-regex.yml |
Source file that fetches data from kafka topics using regex |
KAFKA_MTLS_PATH |
the path for the pki certificates landed from Secret Manager or Hashicorp Vault for MTLS to Kafka/MSK |
| 003-source-kafka-aws-saas-regex.yml |
Source file that fetches data from kafka topics using regex |
KAFKA_BROKERS |
the comma delimited list of hostname:port for kafka brokers |
| 003-source-kafka-aws-saas-regex.yml |
Source file that fetches data from kafka topics using regex |
KAFKA_SOURCE_TOPIC_REGEX |
regex string of topics to pull data from |
| 003-source-kafka-aws-saas-regex.yml |
Source file that fetches data from kafka topics using regex |
KAFKA_CONSUMER_GROUP |
the consumer group associated with this topic |
| 101-transform-flatten-message.yml |
Transform file that parses message field as JSON |
_101_TRANSFORM_FLATTEN_MESSAGE_INPUT |
Dynamic input set in the container as an env variable; |
| 101-transform-flatten-message.yml |
Transform file that parses message field as JSON |
_101_TRANSFORM_FLATTEN_MESSAGE_INPUT |
Dynamic input set in the container as an env variable; |
| 102-transform-remap-fields.yml |
Transform file that rename fields accordingly to match clickhouse column names |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder; |
| 102-transform-remap-fields.yml |
Transform file that rename fields accordingly to match clickhouse column names |
REMAP_FIELDS |
path of csv file containing data for fields that needs remapping; |
| 102-transform-remap-fields.yml |
Transform file that rename fields accordingly to match clickhouse column names |
_102_TRANSFORM_REMAP_FIELDS_INPUT |
Dynamic input set in the container as an env variable; |
| 102-transform-remap-fields.yml |
Transform file that rename fields accordingly to match clickhouse column names |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder; |
| 102-transform-remap-fields.yml |
Transform file that rename fields accordingly to match clickhouse column names |
REMAP_FIELDS |
path of csv file containing data for fields that needs remapping; |
| 102-transform-remap-fields.yml |
Transform file that rename fields accordingly to match clickhouse column names |
_102_TRANSFORM_REMAP_FIELDS_INPUT |
Dynamic input set in the container as an env variable; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
_103_TRANSFORM_ENRICH_MAXMIND_INPUT |
Dynamic input set in the container as an env variable; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
MAXMIND_ENRICHMENT |
csv of fields to geoip enrich dot separated; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
GEOIP_ASN |
location of geoip_asn mmdb file; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
GEOIP_CITY |
location of geoip_city mmdb file; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
FIELD_SETTER_ITERATION_GROUP |
Value for iterator on enrichment csvs; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
_103_TRANSFORM_ENRICH_MAXMIND_INPUT |
Dynamic input set in the container as an env variable; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
MAXMIND_ENRICHMENT |
csv of fields to geoip enrich dot separated; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
GEOIP_ASN |
location of geoip_asn mmdb file; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
GEOIP_CITY |
location of geoip_city mmdb file; |
| 103-transform-enrich-maxmind.yml |
Transform file that enriches IP addresses using the maxmind mmdb source, Set private_address to False for public IPs and True for private IPs, Set country_name to "Private Address Space" for all private IPs, Remove geoip data fields with null values |
FIELD_SETTER_ITERATION_GROUP |
Value for iterator on enrichment csvs; |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
VECTOR_ENRICHMENT_PATH |
path of enrichment files |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
_104_TRANSFORM_EXTRACT_FIELDS_INPUT |
Dynamic input set in the container as an env variable; |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
EXTRACT_FIELDS_CSV |
path of csv that contains data for the fields to be extracted |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
FIELD_SETTER_ITERATION_GROUP |
value for iterator on extract_fields.csv |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
VECTOR_ENRICHMENT_PATH |
path of enrichment files |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
_104_TRANSFORM_EXTRACT_FIELDS_INPUT |
Dynamic input set in the container as an env variable; |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
EXTRACT_FIELDS_CSV |
path of csv that contains data for the fields to be extracted |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
FIELD_SETTER_ITERATION_GROUP |
value for iterator on extract_fields.csv |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
VECTOR_ENRICHMENT_PATH |
path of enrichment files |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
_104_TRANSFORM_EXTRACT_FIELDS_INPUT |
Dynamic input set in the container as an env variable; |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
EXTRACT_FIELDS_CSV |
path of csv that contains data for the fields to be extracted |
| 104-transform-extract-fields.yml |
Transform file that extracts a field to parse its content into a key,value object. |
FIELD_SETTER_ITERATION_GROUP |
value for iterator on extract_fields.csv |
| 105-transform-junk-filter.yml |
[HSXDR-154] - Transform file that removes all fields with empty values |
_105_TRANSFORM_JUNK_FILTER_INPUT |
name of the last enrichment transform |
| 106-transform-netflow-timestamp-mapping.yml |
[HSXDR-227] - Transform file for netflow datetime field correction |
_106_TRANSFORM_TIMESTAMP_MAPPING_INPUT |
name of input: remap or source |
| 106-transform-netflow-timestamp-mapping.yml |
[HSXDR-227] - Transform file for netflow datetime field correction |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder |
| 106-transform-netflow-timestamp-mapping.yml |
[HSXDR-227] - Transform file for netflow datetime field correction |
TIME_FIELDS |
path of csv that contains data of the fields with datetime format |
| 106-transform-netflow-timestamp-mapping.yml |
[HSXDR-227] - Transform file for netflow datetime field correction |
_106_TRANSFORM_TIMESTAMP_MAPPING_INPUT |
name of input: remap or source |
| 106-transform-netflow-timestamp-mapping.yml |
[HSXDR-227] - Transform file for netflow datetime field correction |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder |
| 106-transform-netflow-timestamp-mapping.yml |
[HSXDR-227] - Transform file for netflow datetime field correction |
TIME_FIELDS |
path of csv that contains data of the fields with datetime format |
| 107-transform-ch-control-fields.yml |
Transform file that copies all fields then store it under tags field |
_107_TRANSFORM_CH_CONTROL_FIELDS_INPUT |
name of input: remap or source |
| 107-transform-ch-control-fields.yml |
Transform file that copies all fields then store it under tags field |
_107_TRANSFORM_CH_CONTROL_FIELDS_INPUT |
name of input: remap or source |
| 108-transform-ch-json-remap.yml |
Transform file that converts JSON field into string for clickhouse loading |
_108_TRANSFORM_CH_JSON_REMAP |
name of input: remap or source |
| 108-transform-ch-json-remap.yml |
Transform file that converts JSON field into string for clickhouse loading |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder |
| 108-transform-ch-json-remap.yml |
Transform file that converts JSON field into string for clickhouse loading |
JSON_FIELDS |
path of csv file containing data for fields that needs to be transformed into json string |
| 108-transform-ch-json-remap.yml |
Transform file that converts JSON field into string for clickhouse loading |
_108_TRANSFORM_CH_JSON_REMAP |
name of input: remap or source |
| 108-transform-ch-json-remap.yml |
Transform file that converts JSON field into string for clickhouse loading |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder |
| 108-transform-ch-json-remap.yml |
Transform file that converts JSON field into string for clickhouse loading |
JSON_FIELDS |
path of csv file containing data for fields that needs to be transformed into json string |
| 108-transform-ch-json-remap.yml |
Transform file that converts JSON field into string for clickhouse loading |
FIELD_SETTER_ITERATION_GROUP |
Value for iterator on enrichment csvs; |
| 109-transform-ch-custom-transformations.yml |
Transform file that modify events to conform with Clickhouse guidelines |
_109_TRANSFORM_CH_CUSTOM_TRANSFORMATIONS_INPUT |
name of input: remap or source |
| 109-transform-ch-custom-transformations.yml |
Transform file that modify events to conform with Clickhouse guidelines |
SUPPORTED_TIMESTAMP_FORMAT |
list of timestamp formats supported for transform |
| 109-transform-ch-custom-transformations.yml |
Transform file that modify events to conform with Clickhouse guidelines |
_109_TRANSFORM_CH_CUSTOM_TRANSFORMATIONS_INPUT |
name of input: remap or source |
| 109-transform-ch-custom-transformations.yml |
Transform file that modify events to conform with Clickhouse guidelines |
SUPPORTED_TIMESTAMP_FORMAT |
list of timestamp formats supported for transform |
| 109-transform-ch-custom-transformations.yml |
Transform file that modify events to conform with Clickhouse guidelines |
_109_TRANSFORM_CH_CUSTOM_TRANSFORMATIONS_INPUT |
name of input: remap or source |
| 109-transform-ch-custom-transformations.yml |
Transform file that modify events to conform with Clickhouse guidelines |
SUPPORTED_TIMESTAMP_FORMAT |
list of timestamp formats supported for transform |
| 110-transform-netflow-flatten.yml |
Unnest an array field from an object to create an array of objects using that field; keeping all other fields. |
_110_TRANSFORM_NETFLOW_FLATTEN_INPUT |
name of input: remap or source |
| 111-transform-os-set-data-stream-fields.yml |
Transform file that sets the opensearch data stream control fields |
_111_TRANSFORM_OS_SET_DATA_STREAM_FIELDS_INPUT |
name of input: remap or source |
| 112-transform-remove-flows-prefix.yml |
Transform file that removes Flows field and move values under it outside |
_112_TRANSFORM_REMOVE_FLOWS_PREFIX_INPUT |
name of input: remap or source |
| 114-transform-ch-custom-values.yml |
Transform file that modify events to conform with Clickhouse guidelines |
_114_TRANSFORM_CH_CUSTOM_VALUES_INPUT |
name of input: remap or source |
| 114-transform-ch-custom-values.yml |
Transform file that modify events to conform with Clickhouse guidelines |
SUPPORTED_TIMESTAMP_FORMAT |
list of timestamp formats supported for transform |
| 114-transform-ch-custom-values.yml |
Transform file that modify events to conform with Clickhouse guidelines |
VECTOR_ENRICHMENT_PATH |
enrichment csv file folder location |
| 114-transform-ch-custom-values.yml |
Transform file that modify events to conform with Clickhouse guidelines |
TIME_FIELDS |
path of csv that contains field names with datetime format |
| 114-transform-ch-custom-values.yml |
Transform file that modify events to conform with Clickhouse guidelines |
INVALID_CHAR_FIELDS |
path of csv that contains field names with values having invalid characters |
| 114-transform-ch-custom-values.yml |
Transform file that modify events to conform with Clickhouse guidelines |
ARRAY_FIELDS |
path of csv that contains field names with array format |
| 114-transform-ch-custom-values.yml |
Transform file that modify events to conform with Clickhouse guidelines |
FIELD_SETTER_ITERATION_GROUP |
alue for iterator on enrichment csvs |
| 115-transform-timestamp-load-field.yml |
Transform file that adds timestamp_load field |
_115_TRANSFORM_TIMESTAMP_LOAD_INPUT |
name of input: remap or source |
| 116-transform-fields-to-camel-case.yml |
|
N/A |
N/A |
| 116-transform-fields-to-camel-case.yml |
|
N/A |
N/A |
| 116-transform-fields-to-camel-case.yml |
|
N/A |
N/A |
| 116-transform-fields-to-snake-case.yml |
|
N/A |
N/A |
| 116-transform-fields-to-snake-case.yml |
|
N/A |
N/A |
| 116-transform-fields-to-snake-case.yml |
|
N/A |
N/A |
| 117-transform-ch-change-field-datatype.yml |
Transform file that modifies fields into respective datatypes |
_117_TRANSFORM_CH_CHANGE_FIELD_DATATYPE_INPUT |
name of input: remap or source |
| 117-transform-ch-change-field-datatype.yml |
Transform file that modifies fields into respective datatypes |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 117-transform-ch-change-field-datatype.yml |
Transform file that modifies fields into respective datatypes |
UPDATE_DATATYPE |
csv containing the list of fields with their corresponding datatypes |
| 117-transform-ch-change-field-datatype.yml |
Transform file that modifies fields into respective datatypes |
_117_TRANSFORM_CH_CHANGE_FIELD_DATATYPE_INPUT |
name of input: remap or source |
| 117-transform-ch-change-field-datatype.yml |
Transform file that modifies fields into respective datatypes |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 117-transform-ch-change-field-datatype.yml |
Transform file that modifies fields into respective datatypes |
UPDATE_DATATYPE |
csv containing the list of fields with their corresponding datatypes |
| 118-transform-ch-subschema-mapping.yml |
Transform file that modifies tags.event.category field if the condition is met |
_118_TRANSFORM_CH_SUBSCHEMA_MAPPING_INPUT |
name of input: remap or source |
| 118-transform-ch-subschema-mapping.yml |
Transform file that modifies tags.event.category field if the condition is met |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 118-transform-ch-subschema-mapping.yml |
Transform file that modifies tags.event.category field if the condition is met |
EVENT_SUBSCHEMA_CSV |
csv containing the condition and the corresponding value to set into event.category |
| 118-transform-ch-subschema-mapping.yml |
Transform file that modifies tags.event.category field if the condition is met |
_118_TRANSFORM_CH_SUBSCHEMA_MAPPING_INPUT |
name of input: remap or source |
| 118-transform-ch-subschema-mapping.yml |
Transform file that modifies tags.event.category field if the condition is met |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 118-transform-ch-subschema-mapping.yml |
Transform file that modifies tags.event.category field if the condition is met |
EVENT_SUBSCHEMA_CSV |
csv containing the condition and the corresponding value to set into event.category |
| 119-transform-split-ip-field.yml |
Transform file that extracts IP fields into respective *v4/*v6 field |
_119_TRANSFORM_SPLIT_IP_FIELD_INPUT |
name of input: remap or source |
| 119-transform-split-ip-field.yml |
Transform file that extracts IP fields into respective *v4/*v6 field |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 119-transform-split-ip-field.yml |
Transform file that extracts IP fields into respective *v4/*v6 field |
FIELD_SETTER_ITERATION_GROUP |
string iterator for csv |
| 119-transform-split-ip-field.yml |
Transform file that extracts IP fields into respective *v4/*v6 field |
IP_FIELDS |
csv containing the list of fields in IP format |
| 119-transform-split-ip-field.yml |
Transform file that extracts IP fields into respective *v4/*v6 field |
_119_TRANSFORM_SPLIT_IP_FIELD_INPUT |
name of input: remap or source |
| 119-transform-split-ip-field.yml |
Transform file that extracts IP fields into respective *v4/*v6 field |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 119-transform-split-ip-field.yml |
Transform file that extracts IP fields into respective *v4/*v6 field |
FIELD_SETTER_ITERATION_GROUP |
string iterator for csv |
| 119-transform-split-ip-field.yml |
Transform file that extracts IP fields into respective *v4/*v6 field |
IP_FIELDS |
csv containing the list of fields in IP format |
| 120-transform-generic-whitelist-filter.yml |
[HSXDR-253] Transform file for generic Filtering of events (whitelist/blacklist) |
_120_TRANSFORM_GENERIC_WHITELIST_FILTER_INPUT |
name of input: remap or source |
| 120-transform-generic-whitelist-filter.yml |
[HSXDR-253] Transform file for generic Filtering of events (whitelist/blacklist) |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 120-transform-generic-whitelist-filter.yml |
[HSXDR-253] Transform file for generic Filtering of events (whitelist/blacklist) |
FIELD_SETTER_ITERATION_GROUP |
string iterator for csv |
| 120-transform-generic-whitelist-filter.yml |
[HSXDR-253] Transform file for generic Filtering of events (whitelist/blacklist) |
FILTER_WHITELIST_CSV |
csv containing the list of fields with their corresponding values |
| 120-transform-generic-whitelist-filter.yml |
[HSXDR-253] Transform file for generic Filtering of events (whitelist/blacklist) |
FILTER_WHITELIST |
boolean value |
| 120-transform-generic-whitelist-filter.yml |
[HSXDR-253] Transform file for generic Filtering of events (whitelist/blacklist) |
_120_TRANSFORM_GENERIC_WHITELIST_FILTER_INPUT |
name of input: remap or source |
| 120-transform-generic-whitelist-filter.yml |
[HSXDR-253] Transform file for generic Filtering of events (whitelist/blacklist) |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 120-transform-generic-whitelist-filter.yml |
[HSXDR-253] Transform file for generic Filtering of events (whitelist/blacklist) |
FILTER_ITERATION_GROUP |
string iterator for csv |
| 120-transform-generic-whitelist-filter.yml |
[HSXDR-253] Transform file for generic Filtering of events (whitelist/blacklist) |
FILTER_WHITELIST_CSV |
csv containing the list of fields with their corresponding values |
| 120-transform-generic-whitelist-filter.yml |
[HSXDR-253] Transform file for generic Filtering of events (whitelist/blacklist) |
FILTER_WHITELIST |
boolean value |
| 121-transform-filebeat-dns.yml |
[HSXDR-252] Transform file that extracts filebeat Windows DNS fields |
_121_TRANSFORM_FILEBEAT_DNS_INPUT |
name of input: remap or source |
| 122-transform-domain.yml |
[HSXDR-261] Transform file that extracts domain (PSL compliant) from a field |
_122_TRANSFORM_DOMAIN_INPUT |
name of input: remap or source |
| 122-transform-domain.yml |
[HSXDR-261] Transform file that extracts domain (PSL compliant) from a field |
DOMAIN_FIELDS_CSV |
csv file containing fields needed to enrich |
| 122-transform-domain.yml |
[HSXDR-261] Transform file that extracts domain (PSL compliant) from a field |
FIELD_SETTER_ITERATION_GROUP |
iterator for csv files |
| 122-transform-domain.yml |
[HSXDR-261] Transform file that extracts domain (PSL compliant) from a field |
_122_TRANSFORM_DOMAIN_INPUT |
name of input: remap or source |
| 122-transform-domain.yml |
[HSXDR-261] Transform file that extracts domain (PSL compliant) from a field |
DOMAIN_FIELDS_CSV |
csv file containing fields needed to enrich |
| 122-transform-domain.yml |
[HSXDR-261] Transform file that extracts domain (PSL compliant) from a field |
FIELD_SETTER_ITERATION_GROUP |
iterator for csv files |
| 123-transform-extract-cef.yml |
[HSXDR-298] Transform file for logs_syslog that parses CEF data into key,value object then loads parsed event into logs_cef |
_123_TRANSFORM_EXTRACT_CEF_INPUT |
name of input: remap or source |
| 124-transform-hypercol-metric.yml |
[HSXDR-394] Transform file for unnesting logs_hypercol_metric events |
_124_TRANSFORM_HYPERCOL_METRIC_INPUT |
name of input: remap or source |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
_125_TRANSFORM_ROUTE_FILEBEAT_EVENTS_INPUT_2 |
name of input: remap or source |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
GEOIP_ASN |
location of geoip_asn mmdb file |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
GEOIP_CITY |
location of geoip_city mmdb file |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
TIMEZONES_DB |
the path to the TIMEZONES database file |
| 125-transform-route-filebeat-events.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
_125_TRANSFORM_ROUTE_FILEBEAT_EVENTS_INPUT |
name of input: remap or source |
| 125-transform-route-filebeat-events.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files |
| 125-transform-route-filebeat-events.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
GEOIP_ASN |
location of geoip_asn mmdb file |
| 125-transform-route-filebeat-events.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
GEOIP_CITY |
location of geoip_city mmdb file |
| 125-transform-route-filebeat-events.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
TIMEZONES_DB |
the path to the TIMEZONES database file |
| 125-transform-route-filebeat-events.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
_125_TRANSFORM_ROUTE_FILEBEAT_EVENTS_INPUT |
name of input: remap or source |
| 125-transform-route-filebeat-events.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files |
| 125-transform-route-filebeat-events.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
GEOIP_ASN |
location of geoip_asn mmdb file |
| 125-transform-route-filebeat-events.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
GEOIP_CITY |
location of geoip_city mmdb file |
| 125-transform-route-filebeat-events.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
TIMEZONES_DB |
the path to the TIMEZONES database file |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
_125_TRANSFORM_ROUTE_FILEBEAT_EVENTS_INPUT_2 |
name of input: remap or source |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
GEOIP_ASN |
location of geoip_asn mmdb file |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
GEOIP_CITY |
location of geoip_city mmdb file |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
TIMEZONES_DB |
the path to the TIMEZONES database file |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
_125_TRANSFORM_ROUTE_FILEBEAT_EVENTS_INPUT_2 |
name of input: remap or source |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
GEOIP_ASN |
location of geoip_asn mmdb file |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
GEOIP_CITY |
location of geoip_city mmdb file |
| 125-transform-route-filebeat-events-2.yml |
[HSXDR-375] Transform file that re-routes events to designated auto-generated vector templates |
TIMEZONES_DB |
the path to the TIMEZONES database file |
| 126-transform-filebeat-azure-activity-logs.yml |
Processes Activity Logs from Azure |
_AZURE_ACTIVITY_LOGS_INPUT |
name of input: remap or source |
| 127-transform-filebeat-azure-audit-logs.yml |
Processes Audit Logs from Azure |
_AZURE_AUDIT_LOGS_INPUT |
name of input: remap or source |
| 128-transform-filebeat-azure-signin-logs.yml |
Processes SignIn Logs from Azure |
_AZURE_SIGNIN_LOGS_INPUT |
name of input: remap or source |
| 129-transform-event-hash-field.yml |
[HSXDR-379] Transform file that adds event_hash field |
_129_TRANSFORM_EVENT_HASH_FIELD_INPUT |
name of input: remap or source |
| 129-transform-event-hash-field.yml |
[HSXDR-379] Transform file that adds event_hash field |
_129_TRANSFORM_EVENT_HASH_FIELD_INPUT |
name of input: remap or source |
| 130-transform-filebeat-azure-platform-logs.yml |
Processes Platform Logs from Azure |
_AZURE_PLATFORM_LOGS_INPUT |
name of input: remap or source |
| 131-transform-nxlog-windows-dns.yml |
[HSXDR-386] Transform file that unnests nxlog_windows_dns events |
_131_TRANSFORM_NXLOG_WINDOWS_DNS_INPUT |
name of input: remap or source |
| 132-transform-kafka-azure-events.yml |
[HSXDR-399] Tranform file for TOPCat Parallel Feed Pod - vector components |
_132_TRANSFORM_KAFKA_AZURE_EVENTS_INPUT |
name of input: remap or source |
| 133-transform-omss-topcat-parallel-feed.yml |
[HSXDR-402] Transform file for MSK TPROD to MSK TPREPROD (vector template) |
_133_TRANSFORM_OMSS_TOPCAT_PARALLEL_FEED_INPUT |
name of input: remap or source |
| 134-transform-filebeat-cisco-asa-logs.yml |
Processes Logs from Cisco ASA |
_CISCO_ASA_INPUT |
name of input: remap or source |
| 134-transform-filebeat-cisco-asa-logs.yml |
Processes Logs from Cisco ASA |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files (already defined on filebeat-route transform file) |
| 134-transform-filebeat-cisco-asa-logs.yml |
Processes Logs from Cisco ASA |
GEOIP_ASN |
location of the geoip_asn mmdb file (already defined on filebeat-route transform file) |
| 134-transform-filebeat-cisco-asa-logs.yml |
Processes Logs from Cisco ASA |
GEOIP_CITY |
location of the geoip_city mmdb file (already defined on filebeat-route transform file) |
| 135-transform-filebeat-cisco-nexus-logs.yml |
Processes Logs from Cisco Nexus |
_CISCO_ASA_INPUT |
name of input: remap or source |
| 135-transform-filebeat-cisco-nexus-logs.yml |
Processes Logs from Cisco Nexus |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files (already defined on filebeat-route transform file) |
| 135-transform-filebeat-cisco-nexus-logs.yml |
Processes Logs from Cisco Nexus |
TIMEZONES_DB |
the path to the TIMEZONES database file (already defined on filebeat-route transform file) |
| 136-transform-filebeat-o365-audit-logs.yml |
Processes Logs from Office 365 |
_OFFICE_365_LOGS_INPUT |
name of input: remap or source |
| 136-transform-filebeat-o365-audit-logs.yml |
Processes Logs from Office 365 |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files (already defined on filebeat-route transform file) |
| 136-transform-filebeat-o365-audit-logs.yml |
Processes Logs from Office 365 |
GEOIP_ASN |
location of the geoip_asn mmdb file (already defined on filebeat-route transform file) |
| 136-transform-filebeat-o365-audit-logs.yml |
Processes Logs from Office 365 |
GEOIP_CITY |
location of the geoip_city mmdb file (already defined on filebeat-route transform file) |
| 137-transform-filebeat-panw-panos-logs.yml |
Processes Logs from Palo Alto Next Generation Firewall |
_PANW_PANOS_LOGS_INPUT |
name of input: remap or source |
| 137-transform-filebeat-panw-panos-logs.yml |
Processes Logs from Palo Alto Next Generation Firewall |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files (already defined on filebeat-route transform file) |
| 137-transform-filebeat-panw-panos-logs.yml |
Processes Logs from Palo Alto Next Generation Firewall |
GEOIP_ASN |
location of the geoip_asn mmdb file (already defined on filebeat-route transform file) |
| 137-transform-filebeat-panw-panos-logs.yml |
Processes Logs from Palo Alto Next Generation Firewall |
GEOIP_CITY |
location of the geoip_city mmdb file (already defined on filebeat-route transform file) |
| 138-transform-filter.yml |
HSXDR-408: Transform file for generic Filtering of events |
N/A |
N/A |
| 138-transform-filter.yml |
HSXDR-408: Transform file for generic Filtering of events |
N/A |
N/A |
| 139-transform-filebeat-cisco-meraki-events.yml |
Processes Logs from Cisco Meraki |
_CISCO_MERAKI_EVENTS_INPUT |
name of input: remap or source |
| 140-transform-filebeat-cisco-meraki-logs.yml |
Processes Logs from Cisco Meraki |
_CISCO_MERAKI_LOGS_INPUT |
name of input: remap or source |
| 141-transform-filebeat-cisco-ios-logs.yml |
Processes Logs from Cisco IOS |
_CISCO_IOS_LOGS_INPUT |
name of input: remap or source |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
_142_TRANSFORM_COERCE_TYPES_INPUT |
name of input: remap or source |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
FIELD_SETTER_ITERATION_GROUP |
string iterator for csv |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
COERCE_CSV |
csv containing the list of fields with their corresponding values |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
SUPPORTED_TIMESTAMP_FORMAT |
list of supported timestamp formats |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
TS_TZ_MATCH |
path of csv that contains data of the timezone to be used if mapped |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
_142_TRANSFORM_COERCE_TYPES_INPUT |
name of input: remap or source |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
FIELD_SETTER_ITERATION_GROUP |
string iterator for csv |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
COERCE_CSV |
csv containing the list of fields with their corresponding values |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
SUPPORTED_TIMESTAMP_FORMAT |
list of supported timestamp formats |
| 142-transform-coerce-types.yml |
[HSXDR-414] Transform file that coerces field into their corresponding data types |
TS_TZ_MATCH |
path of csv that contains data of the timezone to be used if mapped |
| 143-transform-filebeat-cisco-umbrella-audit-logs.yml |
Processes auditlogsfrom Cisco Umbrella |
_CISCO_UMBRELLA_AUDITLOGS_INPUT |
name of input: remap or source |
| 144-transform-filebeat-cisco-umbrella-cloud-firewall-logs.yml |
Processes cloudfirewalllogsfrom Cisco Umbrella |
_CISCO_UMBRELLA_CLOUDFIREWALLLOGS_INPUT |
name of input: remap or source |
| 145-transform-filebeat-cisco-umbrella-dlp-logs.yml |
Processes dlplogsfrom Cisco Umbrella |
_CISCO_UMBRELLA_DLPLOGS_INPUT |
name of input: remap or source |
| 146-transform-filebeat-cisco-umbrella-dns-logs.yml |
Processes dnslogsfrom Cisco Umbrella |
_CISCO_UMBRELLA_DNSLOGS_INPUT |
name of input: remap or source |
| 147-transform-filebeat-cisco-umbrella-intrusion-logs.yml |
Processes intrusionlogsfrom Cisco Umbrella |
_CISCO_UMBRELLA_INTRUSIONLOGS_INPUT |
name of input: remap or source |
| 148-transform-filebeat-cisco-umbrella-ip-logs.yml |
Processes iplogsfrom Cisco Umbrella |
_CISCO_UMBRELLA_IPLOGS_INPUT |
name of input: remap or source |
| 149-transform-filebeat-cisco-umbrella-proxy-logs.yml |
Processes proxylogsfrom Cisco Umbrella |
_CISCO_UMBRELLA_PROXYLOGS_INPUT |
name of input: remap or source |
| 150-transform-filebeat-cisco-ftd-logs.yml |
Processes Logs from Cisco FTD |
_CISCO_FTD_INPUT |
name of input: remap or source |
| 150-transform-filebeat-cisco-ftd-logs.yml |
Processes Logs from Cisco FTD |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files (already defined on filebeat-route transform file) |
| 150-transform-filebeat-cisco-ftd-logs.yml |
Processes Logs from Cisco FTD |
GEOIP_ASN |
location of the geoip_asn mmdb file (already defined on filebeat-route transform file) |
| 150-transform-filebeat-cisco-ftd-logs.yml |
Processes Logs from Cisco FTD |
GEOIP_CITY |
location of the geoip_city mmdb file (already defined on filebeat-route transform file) |
| 151-transform-filebeat-cisco-amp-logs.yml |
Processes Logs from Cisco AMP |
_CISCO_AMP_INPUT |
name of input: remap or source |
| 151-transform-filebeat-cisco-amp-logs.yml |
Processes Logs from Cisco AMP |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files (already defined on filebeat-route transform file) |
| 151-transform-filebeat-cisco-amp-logs.yml |
Processes Logs from Cisco AMP |
GEOIP_ASN |
location of the geoip_asn mmdb file (already defined on filebeat-route transform file) |
| 151-transform-filebeat-cisco-amp-logs.yml |
Processes Logs from Cisco AMP |
GEOIP_CITY |
location of the geoip_city mmdb file (already defined on filebeat-route transform file) |
| 152-transform-timestamp-progress-checkpoint.yml |
Transform file that adds a custom timestamp onto the records that can help with debugging lab between steps. |
_152_TRANSFORM_TIMESTAMP_PROGRESS_CHECKPOINT_INPUT |
name of input: remap or source |
| 152-transform-timestamp-progress-checkpoint.yml |
Transform file that adds a custom timestamp onto the records that can help with debugging lab between steps. |
_152_TRANSFORM_TIMESTAMP_PROGRESS_CHECKPOINT_FIELD_NAME |
Dynamic input set in the container as an env variable |
| 152-transform-timestamp-progress-checkpoint.yml |
Transform file that adds a custom timestamp onto the records that can help with debugging lab between steps. |
_152_TRANSFORM_TIMESTAMP_PROGRESS_CHECKPOINT_INPUT |
name of input: remap or source |
| 152-transform-timestamp-progress-checkpoint.yml |
Transform file that adds a custom timestamp onto the records that can help with debugging lab between steps. |
_152_TRANSFORM_TIMESTAMP_PROGRESS_CHECKPOINT_FIELD_NAME |
Dynamic input set in the container as an env variable |
| 153-transform-filebeat-crowdstrike-falcon-logs.yml |
Processes Logs from Crowdstrike Falcon |
_CROWDSTRIKE_FALCON_INPUT |
name of input: remap or source |
| 153-transform-filebeat-crowdstrike-falcon-logs.yml |
Processes Logs from Crowdstrike Falcon |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files (already defined on filebeat-route transform file) |
| 153-transform-filebeat-crowdstrike-falcon-logs.yml |
Processes Logs from Crowdstrike Falcon |
GEOIP_ASN |
location of the geoip_asn mmdb file (already defined on filebeat-route transform file) |
| 153-transform-filebeat-crowdstrike-falcon-logs.yml |
Processes Logs from Crowdstrike Falcon |
GEOIP_CITY |
location of the geoip_city mmdb file (already defined on filebeat-route transform file) |
| 154-transform-filebeat-fortinet-fortigate-logs.yml |
Processes Logs from Fortinet firewall logs |
_FORTINET_FORTIGATE_INPUT |
name of input: remap or source |
| 154-transform-filebeat-fortinet-fortigate-logs.yml |
Processes Logs from Fortinet firewall logs |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files (already defined on filebeat-route transform file) |
| 154-transform-filebeat-fortinet-fortigate-logs.yml |
Processes Logs from Fortinet firewall logs |
GEOIP_ASN |
location of the geoip_asn mmdb file (already defined on filebeat-route transform file) |
| 154-transform-filebeat-fortinet-fortigate-logs.yml |
Processes Logs from Fortinet firewall logs |
GEOIP_CITY |
location of the geoip_city mmdb file (already defined on filebeat-route transform file) |
| 155-transform-filebeat-okta-system-logs.yml |
Processes Logs from Okta System |
_OKTA_SYSTEM_INPUT |
name of input: remap or source |
| 155-transform-filebeat-okta-system-logs.yml |
Processes Logs from Okta System |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind mmdb files (already defined on filebeat-route transform file) |
| 155-transform-filebeat-okta-system-logs.yml |
Processes Logs from Okta System |
GEOIP_ASN |
location of the geoip_asn mmdb file (already defined on filebeat-route transform file) |
| 155-transform-filebeat-okta-system-logs.yml |
Processes Logs from Okta System |
GEOIP_CITY |
location of the geoip_city mmdb file (already defined on filebeat-route transform file) |
| 156-transform-array-fields.yml |
[HSXDR-481] Transform file that explodes fields with array values |
_156_TRANSFORM_ARRAY_FIELDS_INPUT |
name of input: remap or source |
| 157-transform-epoch-timestamp-conversion.yml |
[HSXDR-482] transform file that converts timestamp fields into epochms |
_157_TRANSFORM_EPOCH_TIMESTAMP_CONVERSION_INPUT |
name of input: remap or source |
| 157-transform-epoch-timestamp-conversion.yml |
[HSXDR-482] transform file that converts timestamp fields into epochms |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder |
| 157-transform-epoch-timestamp-conversion.yml |
[HSXDR-482] transform file that converts timestamp fields into epochms |
TS_TO_EPOCH_MS_CSV |
path of csv file containing data for fields that needs to be transformed |
| 157-transform-epoch-timestamp-conversion.yml |
[HSXDR-482] transform file that converts timestamp fields into epochms |
FIELD_SETTER_ITERATION_GROUP |
string iterator for csv file |
| 157-transform-epoch-timestamp-conversion.yml |
[HSXDR-482] transform file that converts timestamp fields into epochms |
SUPPORTED_TIMESTAMP_FORMAT |
list of timestamp formats supported for transform |
| 157-transform-epoch-timestamp-conversion.yml |
[HSXDR-482] transform file that converts timestamp fields into epochms |
_157_TRANSFORM_EPOCH_TIMESTAMP_CONVERSION_INPUT |
name of input: remap or source |
| 157-transform-epoch-timestamp-conversion.yml |
[HSXDR-482] transform file that converts timestamp fields into epochms |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder |
| 157-transform-epoch-timestamp-conversion.yml |
[HSXDR-482] transform file that converts timestamp fields into epochms |
TS_TO_EPOCH_MS_CSV |
path of csv file containing data for fields that needs to be transformed |
| 157-transform-epoch-timestamp-conversion.yml |
[HSXDR-482] transform file that converts timestamp fields into epochms |
FIELD_SETTER_ITERATION_GROUP |
string iterator for csv file |
| 157-transform-epoch-timestamp-conversion.yml |
[HSXDR-482] transform file that converts timestamp fields into epochms |
SUPPORTED_TIMESTAMP_FORMAT |
list of timestamp formats supported for transform |
| 158-transform-timestamp-fields.yml |
Transform file that extracts and converts fields into timestamp format |
_158_TRANSFORM_TIMESTAMP_FIELD_INPUT |
name of input: remap or source |
| 158-transform-timestamp-fields.yml |
Transform file that extracts and converts fields into timestamp format |
FIELD_SETTER_ITERATION_GROUP |
iteration_group value |
| 158-transform-timestamp-fields.yml |
Transform file that extracts and converts fields into timestamp format |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder |
| 158-transform-timestamp-fields.yml |
Transform file that extracts and converts fields into timestamp format |
TIMESTAMP_FIELDS |
path of csv that contains data of the fields with datetime format |
| 158-transform-timestamp-fields.yml |
Transform file that extracts and converts fields into timestamp format |
SUPPORTED_TIMESTAMP_FORMAT |
list of supported datetime formats |
| 158-transform-timestamp-fields.yml |
Transform file that extracts and converts fields into timestamp format |
_158_TRANSFORM_TIMESTAMP_FIELD_INPUT |
name of input: remap or source |
| 158-transform-timestamp-fields.yml |
Transform file that extracts and converts fields into timestamp format |
FIELD_SETTER_ITERATION_GROUP |
iteration_group value |
| 158-transform-timestamp-fields.yml |
Transform file that extracts and converts fields into timestamp format |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder |
| 158-transform-timestamp-fields.yml |
Transform file that extracts and converts fields into timestamp format |
TIMESTAMP_FIELDS |
path of csv that contains data of the fields with datetime format |
| 158-transform-timestamp-fields.yml |
Transform file that extracts and converts fields into timestamp format |
SUPPORTED_TIMESTAMP_FORMAT |
list of supported datetime formats |
| 159-transform-dlq-event-category.yml |
Transform file that reroute events to kafka if org_id/event_category is missing on the csv |
_159_TRANSFORM_DLQ_EVENT_CATEGORY_INPUT |
name of input: remap or source |
| 159-transform-dlq-event-category.yml |
Transform file that reroute events to kafka if org_id/event_category is missing on the csv |
FIELD_SETTER_ITERATION_GROUP |
iteration_group value |
| 159-transform-dlq-event-category.yml |
Transform file that reroute events to kafka if org_id/event_category is missing on the csv |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder |
| 159-transform-dlq-event-category.yml |
Transform file that reroute events to kafka if org_id/event_category is missing on the csv |
DLQ_EVENT_CATEGORY_CSV |
path of csv that contains data of the fields with datetime format |
| 159-transform-dlq-event-category.yml |
Transform file that reroute events to kafka if org_id/event_category is missing on the csv |
_159_TRANSFORM_DLQ_EVENT_CATEGORY_INPUT |
name of input: remap or source |
| 159-transform-dlq-event-category.yml |
Transform file that reroute events to kafka if org_id/event_category is missing on the csv |
VECTOR_ENRICHMENT_PATH |
path of enrichment files folder |
| 159-transform-dlq-event-category.yml |
Transform file that reroute events to kafka if org_id/event_category is missing on the csv |
DLQ_EVENT_CATEGORY_CSV |
path of csv that contains data of the fields with datetime format |
| 160-transform-unnest-linux-audit.yml |
[HSXDR-508] Transform file that unnests array types on linux audit events |
_160_TRANSFORM_UNNEST_LINUX_AUDIT_INPUT |
name of input: remap or source |
| 161-transform-simple-blacklist-filter.yml |
[HSXDR-253] generic Filter (blacklist) |
_161_TRANSFORM_SIMPLE_BLACKLIST_FILTER_INPUT |
name of input: remap or source |
| 161-transform-simple-blacklist-filter.yml |
[HSXDR-253] generic Filter (blacklist) |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 161-transform-simple-blacklist-filter.yml |
[HSXDR-253] generic Filter (blacklist) |
FILTER_ITERATION_GROUP |
string iterator for csv |
| 161-transform-simple-blacklist-filter.yml |
[HSXDR-253] generic Filter (blacklist) |
FILTER_BLACKLIST_CSV |
csv containing the list of fields with their corresponding values |
| 161-transform-simple-blacklist-filter.yml |
[HSXDR-253] generic Filter (blacklist) |
_161_TRANSFORM_SIMPLE_BLACKLIST_FILTER_INPUT |
name of input: remap or source |
| 161-transform-simple-blacklist-filter.yml |
[HSXDR-253] generic Filter (blacklist) |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 161-transform-simple-blacklist-filter.yml |
[HSXDR-253] generic Filter (blacklist) |
FILTER_ITERATION_GROUP |
string iterator for csv |
| 161-transform-simple-blacklist-filter.yml |
[HSXDR-253] generic Filter (blacklist) |
FILTER_BLACKLIST_CSV |
csv containing the list of fields with their corresponding values |
| 162-transform-simple-whitelist-filter.yml |
[HSXDR-253] generic Filter (whitelist) |
_162_TRANSFORM_SIMPLE_WHITELIST_FILTER_INPUT |
name of input: remap or source |
| 162-transform-simple-whitelist-filter.yml |
[HSXDR-253] generic Filter (whitelist) |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 162-transform-simple-whitelist-filter.yml |
[HSXDR-253] generic Filter (whitelist) |
FILTER_ITERATION_GROUP |
string iterator for csv |
| 162-transform-simple-whitelist-filter.yml |
[HSXDR-253] generic Filter (whitelist) |
FILTER_WHITELIST_CSV |
csv containing the list of fields with their corresponding values |
| 162-transform-simple-whitelist-filter.yml |
[HSXDR-253] generic Filter (whitelist) |
_162_TRANSFORM_SIMPLE_WHITELIST_FILTER_INPUT |
name of input: remap or source |
| 162-transform-simple-whitelist-filter.yml |
[HSXDR-253] generic Filter (whitelist) |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 162-transform-simple-whitelist-filter.yml |
[HSXDR-253] generic Filter (whitelist) |
FILTER_ITERATION_GROUP |
string iterator for csv |
| 162-transform-simple-whitelist-filter.yml |
[HSXDR-253] generic Filter (whitelist) |
FILTER_WHITELIST_CSV |
csv containing the list of fields with their corresponding values |
| 163-transform-update-field-values.yml |
Transform file that remaps field value base on the set value of another field |
_163_TRANSFORM_UPDATE_FIELD_VALUES_INPUT |
name of input: remap or source |
| 163-transform-update-field-values.yml |
Transform file that remaps field value base on the set value of another field |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 163-transform-update-field-values.yml |
Transform file that remaps field value base on the set value of another field |
_163_TRANSFORM_UPDATE_FIELD_VALUES_ITERATION_GROUP |
string iterator for csv |
| 163-transform-update-field-values.yml |
Transform file that remaps field value base on the set value of another field |
_163_TRANSFORM_UPDATE_FIELD_VALUES_CSV |
Path to the csv file containing the field remappings. |
| 163-transform-update-field-values.yml |
Transform file that remaps field value base on the set value of another field |
_163_TRANSFORM_UPDATE_FIELD_VALUES_INPUT |
name of input: remap or source |
| 163-transform-update-field-values.yml |
Transform file that remaps field value base on the set value of another field |
VECTOR_ENRICHMENT_PATH |
path to enrichment files |
| 163-transform-update-field-values.yml |
Transform file that remaps field value base on the set value of another field |
_163_TRANSFORM_UPDATE_FIELD_VALUES_ITERATION_GROUP |
string iterator for csv |
| 163-transform-update-field-values.yml |
Transform file that remaps field value base on the set value of another field |
_163_TRANSFORM_UPDATE_FIELD_VALUES_CSV |
Path to the csv file containing the field remappings. |
| 164-transform-crowdstrike-flatten.yml |
Flatten crowdstrike fields |
_164_TRANSFORM_CROWDSTRIKE_FLATTEN_INPUT |
name of input: remap or source |
| 164-transform-crowdstrike-flatten.yml |
Flatten crowdstrike fields |
_164_TRANSFORM_CROWDSTRIKE_FLATTEN_INPUT |
name of input: remap or source |
| 164-transform-crowdstrike-flatten.yml |
Flatten crowdstrike fields |
_164_TRANSFORM_CROWDSTRIKE_FLATTEN_INPUT |
name of input: remap or source |
| 165-transform-set-logriginal-field.yml |
Add logoriginal field that contains raw event log if not yet set |
_165_TRANSFORM_LOGORIGINAL_FIELD_INPUT |
name of input: remap or source |
| 199-transform-passthrough.yml |
Simply passthrough stage (noop/dummy) |
N/A |
N/A |
| 200-test-file-sink.yml |
|
N/A |
N/A |
| 201-sink-clickhouse-saas.yml |
Clickhouse Sink for HyperSec XDR AWS SaaS deployment |
_201_SINK_CLICKHOUSE_SAAS_INPUT |
name of input: remap or source |
| 201-sink-clickhouse-saas.yml |
Clickhouse Sink for HyperSec XDR AWS SaaS deployment |
CLICKHOUSE_AUTH_PASSWORD |
clickhouse auth password |
| 201-sink-clickhouse-saas.yml |
Clickhouse Sink for HyperSec XDR AWS SaaS deployment |
CLICKHOUSE_ENDPOINT |
clickhouse endpoint |
| 202-sink-dlq-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
_202_SINK_DLQ_KAFKA_AWS_SAAS_INPUT |
name of input: remap or source |
| 202-sink-dlq-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_MTLS_PATH |
PKI certificates path for Kafka/MSK MTLS authentication. |
| 202-sink-dlq-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_BROKERS |
Comma-separated Kafka broker hosts and ports. |
| 202-sink-dlq-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
VECTOR_BUFFER_SIZE |
Specifies the maximum size of the buffer on disk in bytes. This setting is crucial for controlling how much data Vector buffers on disk before flushing. Size must be at least \~256 megabytes (268435456 bytes) to ensure proper operation and performance of the disk-based buffering system. Default: 400000000 bytes when configured for disk usage. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
VECTOR_ENRICHMENT_PATH |
Directory for CSV data enrichments; Default: /data/enrichment/ |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
EVENT_CATEGORY_MAP_CSV |
Event category mapping file; Default: /data/mappings/event_category.csv |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
_001_SOURCE_FILE |
Source Vector component path; Default: /data/source/ |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_MTLS_PATH |
PKI certificates path for Kafka/MSK MTLS authentication. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_BROKERS |
Comma-separated Kafka broker hosts and ports. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_TOPIC |
Destination topic for sending data. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
_202_SINK_KAFKA_AWS_SAAS_INPUT |
(Description and/or default value if applicable) |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
VECTOR_BUFFER_SIZE |
Specifies the maximum size of the buffer on disk in bytes. This setting is crucial for controlling how much data Vector buffers on disk before flushing. Size must be at least \~256 megabytes (268435456 bytes) to ensure proper operation and performance of the disk-based buffering system. Default: 400000000 bytes when configured for disk usage. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
VECTOR_ENRICHMENT_PATH |
Directory for CSV data enrichments; Default: /data/enrichment/ |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
EVENT_CATEGORY_MAP_CSV |
Event category mapping file; Default: /data/mappings/event_category.csv |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
_001_SOURCE_FILE |
Source Vector component path; Default: /data/source/ |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_MTLS_PATH |
PKI certificates path for Kafka/MSK MTLS authentication. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_BROKERS |
Comma-separated Kafka broker hosts and ports. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_TOPIC |
Destination topic for sending data. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
_202_SINK_KAFKA_AWS_SAAS_INPUT |
(Description and/or default value if applicable) |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
VECTOR_BUFFER_SIZE |
Specifies the maximum size of the buffer on disk in bytes. This setting is crucial for controlling how much data Vector buffers on disk before flushing. Size must be at least \~256 megabytes (268435456 bytes) to ensure proper operation and performance of the disk-based buffering system. Default: 400000000 bytes when configured for disk usage. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
_202_SINK_KAFKA_AWS_SAAS_INPUT |
name of input: remap or source |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_MTLS_PATH |
PKI certificates path for Kafka/MSK MTLS authentication. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_BROKERS |
Comma-separated Kafka broker hosts and ports. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
VECTOR_BUFFER_SIZE |
Specifies the maximum size of the buffer on disk in bytes. This setting is crucial for controlling how much data Vector buffers on disk before flushing. Size must be at least \~256 megabytes (268435456 bytes) to ensure proper operation and performance of the disk-based buffering system. Default: 400000000 bytes when configured for disk usage. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
_202_SINK_KAFKA_AWS_SAAS_TOPIC_SUFFIX |
suffix to be added on kafka topic (default value is set to "load") |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
_202_SINK_KAFKA_AWS_SAAS_INPUT |
Name of the input (e.g., remap or source). |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_MTLS_PATH |
PKI certificates path for Kafka/MSK MTLS authentication. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_BROKERS |
Comma-separated Kafka broker hosts and ports. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
VECTOR_BUFFER_SIZE |
Specifies the maximum size of the buffer on disk in bytes. Must be at least \~256 megabytes (268435456 bytes). Default: 46000000000 bytes. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
_202_SINK_KAFKA_AWS_SAAS_TOPIC_SUFFIX |
Suffix to be added to the Kafka topic. Default: "load". |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_COMPRESSION |
Compression type for Kafka messages. Supported options: gzip, lz4, none, snappy, zstd. Default: "lz4". |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_MESSAGE_TIMEOUT_MS |
Message timeout in milliseconds. Default: 300000. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_SOCKET_TIMEOUT_MS |
Socket timeout in milliseconds. Default: 60000. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_BATCH_NUM_MESSAGES |
Maximum number of messages to batch before sending. Default: 10000. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_BATCH_SIZE |
Maximum size (in bytes) of a batch. Default: 1000000. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_QUEUE_BUFFERING_MAX_MS |
Maximum time (in milliseconds) to buffer messages before sending. Default: 200. |
| 202-sink-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_ACKS |
Number of acknowledgments required from the broker before considering a request complete. Default: "1". |
| 202-sink-msk-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
_202_SINK_MFK_KAFKA_AWS_SAAS_INPUT |
name of input: remap or source |
| 202-sink-msk-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_MTLS_PATH |
PKI certificates path for Kafka/MSK MTLS authentication. |
| 202-sink-msk-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
KAFKA_BROKERS |
Comma-separated Kafka broker hosts and ports. |
| 202-sink-msk-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
VECTOR_BUFFER_SIZE |
Specifies the maximum size of the buffer on disk in bytes. This setting is crucial for controlling how much data Vector buffers on disk before flushing. Size must be at least \~256 megabytes (268435456 bytes) to ensure proper operation and performance of the disk-based buffering system. Default: 400000000 bytes when configured for disk usage. |
| 202-sink-msk-kafka-aws-saas.yml |
Acts as a sink for HyperSec XDR within AWS SaaS deployments, enabling secure and efficient data processing. |
_202_SINK_MFK_KAFKA_AWS_SAAS_TOPIC_SUFFIX |
suffix to be added on kafka topic (default value is set to "load") |
| 203-sink-opensearch-aws-saas-index.yml |
Sink for HyperSec XDR AWS SaaS deployment |
OPENSEARCH_ENDPOINT |
PKI certificates path for Kafka/MSK MTLS authentication; Default |
| 203-sink-opensearch-aws-saas-index.yml |
Sink for HyperSec XDR AWS SaaS deployment |
VECTOR_BUFFER_SIZE |
Specifies the maximum size of the buffer on disk in bytes. This setting is crucial for controlling how much data Vector buffers on disk before flushing. Size must be at least \~256 megabytes (268435456 bytes) to ensure proper operation and performance of the disk-based buffering system. Default: 400000000 bytes when configured for disk usage. |
| 204-sink-opensearch-aws-saas-stream.yml |
OpenSearch Sink for HyperSec XDR AWS SaaS deployment |
_204_SINK_OPENSEARCH_AWS_SAAS_STREAM_INPUT |
name of input: remap or source |
| 204-sink-opensearch-aws-saas-stream.yml |
OpenSearch Sink for HyperSec XDR AWS SaaS deployment |
OPENSEARCH_ENDPOINT |
Custom endpoint for use with AWS-compatible services. |
| 204-sink-opensearch-aws-saas-stream.yml |
OpenSearch Sink for HyperSec XDR AWS SaaS deployment |
AWS_DEFAULT_REGION |
AWS region of the target service. |
| 204-sink-opensearch-aws-saas-stream-test.yml |
Sink for HyperSec XDR AWS SaaS deployment |
N/A |
N/A |
| 205-sink-opensearch-index.yml |
Sink for HyperSec XDR AWS SaaS deployment |
N/A |
N/A |
| 206-sink-opensearch-stream.yml |
Sink for HyperSec XDR AWS SaaS deployment |
N/A |
N/A |
| 207-sink-aws-s3.yml |
AWS S3 Sink for HyperSec XDR Archive |
_207_SINK_AWS_S3_INPUT |
name of input: remap or source |
| 207-sink-aws-s3.yml |
AWS S3 Sink for HyperSec XDR Archive |
_207_SINK_AWS_S3_BUCKET_NAME |
S3 bucket name |
| 207-sink-aws-s3.yml |
AWS S3 Sink for HyperSec XDR Archive |
_207_SINK_AWS_S3_REGION |
AWS region of the target service. |
| 208-sink-custom-prometheus.yml |
[HSXDR-229] Expose messages/events from kafka topic for Prometheus scraping |
_208_SINK_CUSTOM_PROMETHEUS_INPUT |
name of input: remap or source |
| 208-sink-custom-prometheus.yml |
[HSXDR-229] Expose messages/events from kafka topic for Prometheus scraping |
_208_SINK_CUSTOM_PROMETHEUS_ENDPOINT |
endpoint to send data to |
| 208-sink-custom-prometheus.yml |
[HSXDR-229] Expose messages/events from kafka topic for Prometheus scraping |
_208_SINK_CUSTOM_PROMETHEUS_AUTH_REGION |
AWS region of the target service. |
| hs-xdr-vector-ct-all-main.yml |
Main (common for all) component template. Data path and GraphQL. |
VECTOR_DATA_DIR |
The directory used for persisting Vector state, such as on-disk buffers, file checkpoints, and more. Please make sure the Vector project has write permissions to this directory. |
| hs-xdr-vector-ct-all-prometheus.yml |
Expose vector metricss for the running vector process for Prometheus scraping |
PROMETHEUS_EXPORTER |
address to expose for scraping. |
| hypersec-receiver.yml |
|
N/A |
N/A |
| hypersec-receiver-sink.yml |
|
N/A |
N/A |
| hypersec-receiver-sink.yml |
|
N/A |
N/A |
| hypersec-receiver-sink.yml |
HyperSec Sink Receiver container configuration |
PROMETHEUS_EXPORTER |
address to expose for scraping. |
| hypersec-receiver-sink.yml |
HyperSec Sink Receiver container configuration |
KAFKA_MTLS_PATH |
PKI certificates path for Kafka/MSK MTLS authentication. |
| hypersec-receiver-sink.yml |
HyperSec Sink Receiver container configuration |
KAFKA_BROKERS |
Comma-separated Kafka broker hosts and ports. |
| hypersec-receiver-sink-notest.yml |
HyperSec Receiver container configuration |
PROMETHEUS_EXPORTER |
address to expose for scraping. |
| hypersec-receiver-sink-notest.yml |
HyperSec Receiver container configuration |
KAFKA_MTLS_PATH |
PKI certificates path for Kafka/MSK MTLS authentication. |
| hypersec-receiver-sink-notest.yml |
HyperSec Receiver container configuration |
KAFKA_BROKERS |
Comma-separated Kafka broker hosts and ports. |
| hypersec-receiver-source.yml |
HyperSec Source Receiver container configuration |
VECTOR_DATA_DIR |
The directory used for persisting Vector state, such as on-disk buffers, file checkpoints, and more. Please make sure the Vector project has write permissions to this directory. |
| hypersec-receiver-source.yml |
HyperSec Source Receiver container configuration |
VECTOR_MTLS_PATH |
PKI certificates path for Kafka/MSK MTLS authentication. |
| hypersec-receiver-transform-event-category.yml |
HyperSec Transform Receiver container configuration for setting tags.event.category values |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind enrichment files |
| hypersec-receiver-transform-event-category.yml |
HyperSec Transform Receiver container configuration for setting tags.event.category values |
FIELD_SETTER_ITERATION_GROUP |
string iterator for the enrichment csv used |
| hypersec-receiver-transform-timestamp.yml |
HyperSec Transform Receiver container configuration for normalizing timestamp fields |
VECTOR_ENRICHMENT_PATH |
the path to the maxmind enrichment files |
| hypersec-receiver-transform-timestamp.yml |
HyperSec Transform Receiver container configuration for normalizing timestamp fields |
FIELD_SETTER_ITERATION_GROUP |
string iterator for the enrichment csv used |
| hypersec-receiver-transform-timestamp.yml |
HyperSec Transform Receiver container configuration for normalizing timestamp fields |
TIME_FIELDS |
path of csv that contains data of the fields with datetime format |
| hypersec-receiver-transform-timestamp.yml |
HyperSec Transform Receiver container configuration for normalizing timestamp fields |
TS_TZ_MATCH |
path of csv that contains data of the timezone to be used if mapped |
| hypersec-receiver-transform-timestamp.yml |
HyperSec Transform Receiver container configuration for normalizing timestamp fields |
TZ_OFFSET_MAPPING |
path of csv that contains data for the timezone and UTC offset mapping |
| hypersec-receiver-transform-timestamp.yml |
HyperSec Transform Receiver container configuration for normalizing timestamp fields |
SUPPORTED_TIMESTAMP_FORMAT |
list of supported datetime formats |