Merge pull request #14255 from Security-Onion-Solutions/foxtrot

ES 8.17.1

.github/.gitleaks.toml

@@ -536,7 +536,7 @@ secretGroup = 4
 
 [allowlist]
 description = "global allow lists"
-regexes = ['''219-09-9999''', '''078-05-1120''', '''(9[0-9]{2}|666)-\d{2}-\d{4}''', '''RPM-GPG-KEY.*''', '''.*:.*StrelkaHexDump.*''', '''.*:.*PLACEHOLDER.*''', '''ssl_.*password''']
+regexes = ['''219-09-9999''', '''078-05-1120''', '''(9[0-9]{2}|666)-\d{2}-\d{4}''', '''RPM-GPG-KEY.*''', '''.*:.*StrelkaHexDump.*''', '''.*:.*PLACEHOLDER.*''', '''ssl_.*password''', '''integration_key\s=\s"so-logs-"''']
 paths = [
     '''gitleaks.toml''',
     '''(.*?)(jpg|gif|doc|pdf|bin|svg|socket)$''',

salt/elasticfleet/defaults.yaml

@@ -10,6 +10,7 @@ elasticfleet:
       grid_enrollment: ''
     defend_filters:
       enable_auto_configuration: False
+    subscription_integrations: False
   logging:
     zeek:
       excluded:
@@ -32,97 +33,20 @@ elasticfleet:
         - stderr
         - stdout
   packages:
-    - apache
-    - auditd
-    - auth0
-    - aws
-    - azure
-    - barracuda
-    - barracuda_cloudgen_firewall
-    - carbonblack_edr
-    - cef
-    - checkpoint
-    - cisco_asa
-    - cisco_duo
-    - cisco_ftd
-    - cisco_ios
-    - cisco_ise
-    - cisco_meraki
-    - cisco_secure_email_gateway
-    - cisco_umbrella
-    - citrix_adc
-    - citrix_waf
-    - cloudflare
-    - cloudflare_logpush
-    - crowdstrike
-    - darktrace
     - elastic_agent
     - elasticsearch
     - endpoint
-    - f5_bigip
-    - fim
-    - fireeye
     - fleet_server
-    - fortinet
-    - fortinet_fortigate
-    - gcp
-    - github
-    - google_workspace
     - http_endpoint
     - httpjson
-    - iis
-    - imperva_cloud_waf
-    - journald
-    - juniper
-    - juniper_srx
-    - kafka_log
-    - lastpass
     - log
-    - m365_defender
-    - microsoft_defender_endpoint
-    - microsoft_dhcp
-    - microsoft_sqlserver
-    - mimecast
-    - mysql
-    - netflow
-    - nginx
-    - o365
-    - okta
     - osquery_manager
-    - panw
-    - pfsense
-    - proofpoint_tap
-    - pulse_connect_secure
     - redis
-    - sentinel_one
-    - snort
-    - snyk
-    - sonicwall_firewall
-    - sophos
-    - sophos_central
-    - symantec_endpoint
     - system
     - tcp
-    - tenable_io
-    - tenable_sc
-    - ti_abusech
-    - ti_anomali
-    - ti_cybersixgill
-    - ti_misp
-    - ti_opencti
-    - ti_otx
-    - ti_rapid7_threat_command
-    - ti_recordedfuture
-    - ti_threatq
-    - trendmicro
-    - trend_micro_vision_one
     - udp
-    - vsphere
     - windows
     - winlog
-    - zscaler_zia
-    - zscaler_zpa
-    - 1password
   optional_integrations:
     sublime_platform:
       enabled_nodes: []

salt/elasticfleet/enabled.sls

@@ -151,6 +151,10 @@ so-elastic-fleet-integration-upgrade:
   cmd.run:
     - name: /usr/sbin/so-elastic-fleet-integration-upgrade
 
+so-elastic-fleet-addon-integrations:
+  cmd.run:
+    - name: /usr/sbin/so-elastic-fleet-optional-integrations-load
+
 {%   if ELASTICFLEETMERGED.config.defend_filters.enable_auto_configuration %}
 so-elastic-defend-manage-filters-file-watch:
   cmd.run:

salt/elasticfleet/files/integrations/elastic-defend/elastic-defend-endpoints.json

@@ -5,7 +5,7 @@
 	"package": {
 		"name": "endpoint",
 		"title": "Elastic Defend",
-		"version": "8.14.0"
+		"version": "8.17.0"
 	},
 	"enabled": true,
 	"policy_id": "endpoints-initial",

salt/elasticfleet/files/integrations/grid-nodes_general/import-evtx-logs.json

@@ -20,7 +20,7 @@
             ],
             "data_stream.dataset": "import",
             "custom": "",
-            "processors": "- dissect:\n    tokenizer: \"/nsm/import/%{import.id}/evtx/%{import.file}\"\n    field: \"log.file.path\"\n    target_prefix: \"\"\n- decode_json_fields:\n    fields: [\"message\"]\n    target: \"\"\n- drop_fields:\n    fields: [\"host\"]\n    ignore_missing: true\n- add_fields:\n    target: data_stream\n    fields:\n      type: logs\n      dataset: system.security\n- add_fields:\n    target: event\n    fields:\n      dataset: system.security\n      module: system\n      imported: true\n- add_fields:\n    target: \"@metadata\"\n    fields:\n        pipeline: logs-system.security-1.59.0\n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-Sysmon/Operational'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: windows.sysmon_operational\n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.sysmon_operational\n          module: windows\n          imported: true\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-windows.sysmon_operational-1.45.1\n- if:\n    equals:\n      winlog.channel: 'Application'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: system.application\n    - add_fields:\n        target: event\n        fields:\n          dataset: system.application\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-system.application-1.59.0\n- if:\n    equals:\n      winlog.channel: 'System'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: system.system\n    - add_fields:\n        target: event\n        fields:\n          dataset: system.system\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-system.system-1.59.0\n    \n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-PowerShell/Operational'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: windows.powershell_operational\n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.powershell_operational\n          module: windows\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-windows.powershell_operational-1.45.1\n- add_fields:\n    target: data_stream\n    fields:\n        dataset: import",
+            "processors": "- dissect:\n    tokenizer: \"/nsm/import/%{import.id}/evtx/%{import.file}\"\n    field: \"log.file.path\"\n    target_prefix: \"\"\n- decode_json_fields:\n    fields: [\"message\"]\n    target: \"\"\n- drop_fields:\n    fields: [\"host\"]\n    ignore_missing: true\n- add_fields:\n    target: data_stream\n    fields:\n      type: logs\n      dataset: system.security\n- add_fields:\n    target: event\n    fields:\n      dataset: system.security\n      module: system\n      imported: true\n- add_fields:\n    target: \"@metadata\"\n    fields:\n        pipeline: logs-system.security-1.64.0\n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-Sysmon/Operational'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: windows.sysmon_operational\n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.sysmon_operational\n          module: windows\n          imported: true\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-windows.sysmon_operational-2.3.6\n- if:\n    equals:\n      winlog.channel: 'Application'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: system.application\n    - add_fields:\n        target: event\n        fields:\n          dataset: system.application\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-system.application-1.64.0\n- if:\n    equals:\n      winlog.channel: 'System'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: system.system\n    - add_fields:\n        target: event\n        fields:\n          dataset: system.system\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-system.system-1.64.0\n    \n- if:\n    equals:\n      winlog.channel: 'Microsoft-Windows-PowerShell/Operational'\n  then: \n    - add_fields:\n        target: data_stream\n        fields:\n          dataset: windows.powershell_operational\n    - add_fields:\n        target: event\n        fields:\n          dataset: windows.powershell_operational\n          module: windows\n    - add_fields:\n        target: \"@metadata\"\n        fields:\n            pipeline: logs-windows.powershell_operational-2.3.6\n- add_fields:\n    target: data_stream\n    fields:\n        dataset: import",
             "tags": [
               "import"
             ]

salt/elasticfleet/files/integrations/grid-nodes_general/syslog-udp-514.json

@@ -11,7 +11,7 @@
     "udp-udp": {
       "enabled": true,
       "streams": {
-        "udp.generic": {
+        "udp.udp": {
           "enabled": true,
           "vars": {
             "listen_address": "0.0.0.0",
@@ -20,11 +20,13 @@
             "pipeline": "syslog",
             "max_message_size": "10KiB",
             "keep_null": false,
-            "processors": "- add_fields:\n    target: event\n    fields: \n      module: syslog\n",
+            "processors": "- add_fields:\n    target: event\n    fields: \n      module: syslog",
             "tags": [
               "syslog"
             ],
-            "syslog_options": "field: message\n#format: auto\n#timezone: Local"
+            "syslog_options": "field: message\n#format: auto\n#timezone: Local\n",
+            "preserve_original_event": false,
+            "custom": ""
           }
         }
       }

salt/elasticfleet/integration-defaults.map.jinja

@@ -0,0 +1,133 @@
+{# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+  or more contributor license agreements. Licensed under the Elastic License 2.0; you may not use
+  this file except in compliance with the Elastic License 2.0. #}
+
+
+{% import_json '/opt/so/state/esfleet_package_components.json' as ADDON_PACKAGE_COMPONENTS %}
+{% import_yaml 'elasticfleet/defaults.yaml' as ELASTICFLEETDEFAULTS %}
+
+{% set CORE_ESFLEET_PACKAGES = ELASTICFLEETDEFAULTS.get('elasticfleet', {}).get('packages', {}) %}
+{% set ADDON_INTEGRATION_DEFAULTS = {} %}
+
+{# Some fleet integrations don't follow the standard naming convention #}
+{% set WEIRD_INTEGRATIONS = {
+    'awsfirehose.logs': 'awsfirehose',
+    'awsfirehose.metrics': 'aws.cloudwatch',
+    'cribl.logs': 'cribl',
+    'sentinel_one_cloud_funnel.logins': 'sentinel_one_cloud_funnel.login',
+    'azure_application_insights.app_insights': 'azure.app_insights',
+    'azure_application_insights.app_state': 'azure.app_state',
+    'azure_billing.billing': 'azure.billing',
+    'azure_functions.metrics': 'azure.function',
+    'azure_metrics.compute_vm_scaleset': 'azure.compute_vm_scaleset',
+    'azure_metrics.compute_vm': 'azure.compute_vm',
+    'azure_metrics.container_instance': 'azure.container_instance',
+    'azure_metrics.container_registry': 'azure.container_registry',
+    'azure_metrics.container_service': 'azure.container_service',
+    'azure_metrics.database_account': 'azure.database_account',
+    'azure_metrics.monitor': 'azure.monitor',
+    'azure_metrics.storage_account': 'azure.storage_account',
+    'azure_openai.metrics': 'azure.open_ai',
+    'beat.state': 'beats.stack_monitoring.state',
+    'beat.stats': 'beats.stack_monitoring.stats',
+    'enterprisesearch.health': 'enterprisesearch.stack_monitoring.health',
+    'enterprisesearch.stats': 'enterprisesearch.stack_monitoring.stats',
+    'kibana.cluster_actions': 'kibana.stack_monitoring.cluster_actions',
+    'kibana.cluster_rules': 'kibana.stack_monitoring.cluster_rules',
+    'kibana.node_actions': 'kibana.stack_monitoring.node_actions',
+    'kibana.node_rules': 'kibana.stack_monitoring.node_rules',
+    'kibana.stats': 'kibana.stack_monitoring.stats',
+    'kibana.status': 'kibana.stack_monitoring.status',
+    'logstash.node_cel': 'logstash.stack_monitoring.node',
+    'logstash.node_stats': 'logstash.stack_monitoring.node_stats',
+    'synthetics.browser': 'synthetics-browser',
+    'synthetics.browser_network': 'synthetics-browser.network',
+    'synthetics.browser_screenshot': 'synthetics-browser.screenshot',
+    'synthetics.http': 'synthetics-http',
+    'synthetics.icmp': 'synthetics-icmp',
+    'synthetics.tcp': 'synthetics-tcp'
+   } %}
+
+{% for pkg in ADDON_PACKAGE_COMPONENTS %}
+{%   if pkg.name in CORE_ESFLEET_PACKAGES %}
+{#     skip core integrations #}
+{%   elif pkg.name not in CORE_ESFLEET_PACKAGES %}
+{#     generate defaults for each integration #}
+{%     if pkg.es_index_patterns is defined and pkg.es_index_patterns is not none %}
+{%       for pattern in pkg.es_index_patterns %}
+{%         if "metrics-" in pattern.name %}
+{%           set integration_type = "metrics-" %}
+{%         elif "logs-" in pattern.name %}
+{%           set integration_type = "logs-" %}
+{%         else %}
+{%           set integration_type = "" %}
+{%         endif %}
+{%           set component_name = pkg.name ~ "." ~ pattern.title %}
+{#           fix weirdly named components #}
+{%           if component_name in WEIRD_INTEGRATIONS %}
+{%             set component_name = WEIRD_INTEGRATIONS[component_name] %}
+{%           endif %}
+{#           component_name_x maintains the functionality of merging local pillar changes with generated 'defaults' via SOC UI #}
+{%           set component_name_x = component_name.replace(".","_x_") %}
+{#           pillar overrides/merge expects the key names to follow the naming in elasticsearch/defaults.yaml eg. so-logs-1password_x_item_usages . The _x_ is replaced later on in elasticsearch/template.map.jinja #}
+{%           set integration_key = "so-" ~ integration_type ~ component_name_x %}
+
+{#           Default integration settings #}
+{%           set integration_defaults = {
+              "index_sorting": false,
+              "index_template": {
+                  "composed_of": [integration_type ~ component_name ~ "@package", integration_type ~ component_name ~ "@custom", "so-fleet_integrations.ip_mappings-1", "so-fleet_globals-1", "so-fleet_agent_id_verification-1"],
+                  "data_stream": {
+                      "allow_custom_routing": false,
+                      "hidden": false
+                  },
+                  "ignore_missing_component_templates": [integration_type ~ component_name ~ "@custom"],
+                  "index_patterns": [pattern.name],
+                  "priority": 501,
+                  "template": {
+                      "settings": {
+                          "index": {
+                              "lifecycle": {"name": "so-" ~ integration_type ~ component_name ~ "-logs"},
+                              "number_of_replicas": 0
+                          }
+                      }
+                  }
+              },
+              "policy": {
+                  "phases": {
+                      "cold": {
+                          "actions": {
+                              "set_priority": {"priority": 0}
+                          },
+                          "min_age": "60d"
+                      },
+                      "delete": {
+                          "actions": {
+                              "delete": {}
+                          },
+                          "min_age": "365d"
+                      },
+                      "hot": {
+                          "actions": {
+                              "rollover": {
+                                  "max_age": "30d",
+                                  "max_primary_shard_size": "50gb"
+                              },
+                              "set_priority": {"priority": 100}
+                          },
+                          "min_age": "0ms"
+                      },
+                      "warm": {
+                          "actions": {
+                              "set_priority": {"priority": 50}
+                          },
+                          "min_age": "30d"
+                      }
+                  }
+              }
+          } %}
+{%         do ADDON_INTEGRATION_DEFAULTS.update({integration_key: integration_defaults}) %}
+{%       endfor %}
+{%     endif %}
+{%   endif %}
+{% endfor %}

salt/elasticfleet/soc_elasticfleet.yaml

@@ -40,6 +40,11 @@ elasticfleet:
         global: True
         helpLink: elastic-fleet.html
         advanced: True
+    subscription_integrations:
+      description: Enable the installation of integrations that require an Elastic license.
+      global: True
+      forcedType: bool
+      helpLink: elastic-fleet.html
     server:
       custom_fqdn:
         description: Custom FQDN for Agents to connect to. One per line.

salt/elasticfleet/tools/sbin/so-elastic-fleet-common

@@ -97,11 +97,20 @@ elastic_fleet_package_install() {
     curl -s -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST -H 'kbn-xsrf: true' -H 'Content-Type: application/json'  -d '{"force":true}' "localhost:5601/api/fleet/epm/packages/$PKG/$VERSION"
 }
 
+elastic_fleet_bulk_package_install() {
+    BULK_PKG_LIST=$1
+    curl -s -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X POST -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d@$1 "localhost:5601/api/fleet/epm/packages/_bulk"
+}
+
 elastic_fleet_package_is_installed() {
     PACKAGE=$1
     curl -s -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X GET -H 'kbn-xsrf: true' "localhost:5601/api/fleet/epm/packages/$PACKAGE" | jq -r '.item.status'
 }
 
+elastic_fleet_installed_packages() {
+    curl -s -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X GET -H 'kbn-xsrf: true' -H 'Content-Type: application/json' "localhost:5601/api/fleet/epm/packages/installed?perPage=300"
+}
+
 elastic_fleet_agent_policy_ids() {
     curl -s -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X GET "localhost:5601/api/fleet/agent_policies" | jq -r .items[].id
     if [ $? -ne 0 ]; then

salt/elasticfleet/tools/sbin/so-elastic-fleet-optional-integrations-load

@@ -0,0 +1,111 @@
+#!/bin/bash
+
+# Copyright Security Onion Solutions LLC and/or licensed to Security Onion Solutions LLC under one
+# or more contributor license agreements. Licensed under the Elastic License 2.0; you may not use
+# this file except in compliance with the Elastic License 2.0.
+
+. /usr/sbin/so-common
+. /usr/sbin/so-elastic-fleet-common
+
+# Check that /opt/so/state/estemplates.txt exists to signal that Elasticsearch
+#  has completed its first run of core-only integrations/indices/components/ilm
+STATE_FILE_SUCCESS=/opt/so/state/estemplates.txt
+INSTALLED_PACKAGE_LIST=/tmp/esfleet_installed_packages.json
+BULK_INSTALL_PACKAGE_LIST=/tmp/esfleet_bulk_install.json
+BULK_INSTALL_PACKAGE_TMP=/tmp/esfleet_bulk_install_tmp.json
+BULK_INSTALL_OUTPUT=/opt/so/state/esfleet_bulk_install_results.json
+PACKAGE_COMPONENTS=/opt/so/state/esfleet_package_components.json
+
+SKIP_SUBSCRIPTION=true
+PENDING_UPDATE=false
+
+# Integrations which are included in the package registry, but excluded from automatic installation via this script.
+#   Requiring some level of manual Elastic Stack configuration before installation
+EXCLUDED_INTEGRATIONS=('apm')
+
+version_conversion(){
+    version=$1
+    echo "$version" | awk -F '.' '{ printf("%d%03d%03d\n", $1, $2, $3); }'
+}
+
+compare_versions() {
+    version1=$1
+    version2=$2
+
+    # Convert versions to numbers
+    num1=$(version_conversion "$version1")
+    num2=$(version_conversion "$version2")
+
+    # Compare using bc
+    if (( $(echo "$num1 < $num2" | bc -l) )); then
+        echo "less"
+    elif (( $(echo "$num1 > $num2" | bc -l) )); then
+        echo "greater"
+    else
+        echo "equal"
+    fi
+}
+
+if [[ -f $STATE_FILE_SUCCESS  ]]; then
+    if retry 3 1 "curl -s -K /opt/so/conf/elasticsearch/curl.config --output /dev/null --silent --head --fail localhost:5601/api/fleet/epm/packages"; then
+        # Package_list contains all integrations beta / non-beta.
+        latest_package_list=$(/usr/sbin/so-elastic-fleet-package-list)
+        echo '{ "packages" : []}' > $BULK_INSTALL_PACKAGE_LIST
+        rm -f $INSTALLED_PACKAGE_LIST
+        echo $latest_package_list | jq '{packages: [.items[] | {name: .name, latest_version: .version, installed_version: .savedObject.attributes.install_version, subscription: .conditions.elastic.subscription }]}' >> $INSTALLED_PACKAGE_LIST
+
+        while read -r package; do
+            # get package details
+            package_name=$(echo "$package" | jq -r '.name')
+            latest_version=$(echo "$package" | jq -r '.latest_version')
+            installed_version=$(echo "$package" | jq -r '.installed_version')
+            subscription=$(echo "$package" | jq -r '.subscription')
+            bulk_package=$(echo "$package" | jq '{name: .name, version: .latest_version}' )
+
+            if [[ ! "${EXCLUDED_INTEGRATIONS[@]}" =~ "$package_name" ]]; then
+                if $SKIP_SUBSCRIPTION && [[ "$subscription" != "basic" && "$subscription" != "null" && -n "$subscription" ]]; then
+                    # pass over integrations that require non-basic elastic license
+                    echo "$package_name integration requires an Elastic license of $subscription or greater... skipping"
+                    continue
+                else
+                    if [[ "$installed_version" == "null" || -z "$installed_version" ]]; then
+                        echo "$package_name is not installed... Adding to next update."
+                        jq --argjson package "$bulk_package" '.packages += [$package]' $BULK_INSTALL_PACKAGE_LIST > $BULK_INSTALL_PACKAGE_TMP && mv $BULK_INSTALL_PACKAGE_TMP $BULK_INSTALL_PACKAGE_LIST
+
+                        PENDING_UPDATE=true
+                    else
+                        results=$(compare_versions "$latest_version" "$installed_version")
+                        if [ $results == "greater" ]; then
+                            echo "$package_name is at version $installed_version latest version is $latest_version... Adding to next update."
+                            jq --argjson package "$bulk_package" '.packages += [$package]' $BULK_INSTALL_PACKAGE_LIST > $BULK_INSTALL_PACKAGE_TMP && mv $BULK_INSTALL_PACKAGE_TMP $BULK_INSTALL_PACKAGE_LIST
+
+                            PENDING_UPDATE=true
+                        fi
+                    fi
+                fi
+            else
+                echo "Skipping $package_name..."
+            fi
+        done <<< "$(jq -c '.packages[]' "$INSTALLED_PACKAGE_LIST")"
+
+        if [ "$PENDING_UPDATE" = true ]; then
+            # Run bulk install of packages
+            elastic_fleet_bulk_package_install $BULK_INSTALL_PACKAGE_LIST > $BULK_INSTALL_OUTPUT
+        else
+            echo "Elastic integrations don't appear to need installation/updating..."
+        fi
+        # Write out file for generating index/component/ilm templates
+        latest_installed_package_list=$(elastic_fleet_installed_packages)
+        echo $latest_installed_package_list | jq '[.items[] | {name: .name, es_index_patterns: .dataStreams}]' > $PACKAGE_COMPONENTS
+
+    else
+        # This is the installation of add-on integrations and upgrade of existing integrations. Exiting without error, next highstate will attempt to re-run.
+        echo "Elastic Fleet does not appear to be responding... Exiting... "
+        exit 0
+    fi
+else
+    # This message will appear when an update to core integration is made and this script is run at the same time as
+    #  elasticsearch.enabled -> detects change to core index settings -> deletes estemplates.txt
+    echo "Elasticsearch may not be fully configured yet or is currently updating core index settings."
+    exit 0
+fi

salt/elasticfleet/tools/sbin/so-elastic-fleet-package-list

@@ -10,6 +10,6 @@
 SESSIONCOOKIE=$(curl -s -K /opt/so/conf/elasticsearch/curl.config -c - -X GET http://localhost:5601/ | grep sid | awk '{print $7}')
 
 # List configured package policies
-curl -s -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X GET "localhost:5601/api/fleet/epm/packages" -H 'kbn-xsrf: true' | jq
+curl -s -K /opt/so/conf/elasticsearch/curl.config -b "sid=$SESSIONCOOKIE" -L -X GET "localhost:5601/api/fleet/epm/packages?prerelease=true" -H 'kbn-xsrf: true' | jq
 
 echo

salt/elasticsearch/files/ingest/global@custom

@@ -8,7 +8,9 @@
   "processors": [
     { "set":        { "ignore_failure": true,  "field": "event.module", "value": "elastic_agent" } },
     { "split":      { "if": "ctx.event?.dataset != null && ctx.event.dataset.contains('.')", "field": "event.dataset", "separator": "\\.", "target_field": "module_temp"  } },
+    { "split":      { "if": "ctx.data_stream?.dataset.contains('.')", "field":"data_stream.dataset", "separator":"\\.", "target_field":"datastream_dataset_temp", "ignore_missing":true } },
     { "set":        { "if": "ctx.module_temp != null", "override": true, "field": "event.module", "value": "{{module_temp.0}}" } },
+    { "set":        { "if": "ctx.datastream_dataset_temp != null && ctx.datastream_dataset_temp[0] == 'network_traffic'", "field":"event.module", "value":"{{ datastream_dataset_temp.0 }}", "ignore_failure":true, "ignore_empty_value":true, "description":"Fix EA network packet capture" } },
     { "gsub":       { "if": "ctx.event?.dataset != null && ctx.event.dataset.contains('.')", "field": "event.dataset", "pattern": "^[^.]*.", "replacement": "", "target_field": "dataset_tag_temp" } },
     { "append":     { "if": "ctx.dataset_tag_temp != null", "field": "tags", "value": "{{dataset_tag_temp}}", "allow_duplicates": false  } },
     { "set":        { "if": "ctx.network?.direction == 'egress'", "override": true, "field": "network.initiated", "value": "true" } },
@@ -22,6 +24,6 @@
     { "set":        { "if": "ctx.event?.module == 'fim'", "override": true, "field": "event.module", "value": "file_integrity" } },
     { "rename":        { "if": "ctx.winlog?.provider_name == 'Microsoft-Windows-Windows Defender'", "ignore_missing": true, "field": "winlog.event_data.Threat Name", "target_field": "winlog.event_data.threat_name" } },
     { "set":        { "if": "ctx?.metadata?.kafka != null" , "field": "kafka.id", "value": "{{metadata.kafka.partition}}{{metadata.kafka.offset}}{{metadata.kafka.timestamp}}", "ignore_failure": true } },
-    { "remove":     { "field": [ "message2", "type", "fields", "category", "module", "dataset", "event.dataset_temp", "dataset_tag_temp", "module_temp" ], "ignore_missing": true, "ignore_failure": true } } 
+    { "remove":     { "field": [ "message2", "type", "fields", "category", "module", "dataset", "event.dataset_temp", "dataset_tag_temp", "module_temp", "datastream_dataset_temp" ], "ignore_missing": true, "ignore_failure": true } }
   ]
 }

salt/elasticsearch/files/ingest/logs-pfsense.log-1.16.0

@@ -1,389 +0,0 @@
-{
-  "description": "Pipeline for PFsense",
-  "processors": [
-    {
-      "set": {
-        "field": "ecs.version",
-        "value": "8.10.0"
-      }
-    },
-    {
-      "set": {
-        "field": "observer.vendor",
-        "value": "netgate"
-      }
-    },
-    {
-      "set": {
-        "field": "observer.type",
-        "value": "firewall"
-      }
-    },
-    {
-      "rename": {
-        "field": "message",
-        "target_field": "event.original"
-      }
-    },
-    {
-      "set": {
-        "field": "event.kind",
-        "value": "event"
-      }
-    },
-    {
-      "set": {
-        "field": "event.timezone",
-        "value": "{{_tmp.tz_offset}}",
-        "if": "ctx._tmp?.tz_offset != null && ctx._tmp?.tz_offset != 'local'"
-      }
-    },
-    {
-      "grok": {
-        "description": "Parse syslog header",
-        "field": "event.original",
-        "patterns": [
-          "^(%{ECS_SYSLOG_PRI})?%{TIMESTAMP} %{GREEDYDATA:message}"
-        ],
-        "pattern_definitions": {
-          "ECS_SYSLOG_PRI": "<%{NONNEGINT:log.syslog.priority:long}>(\\d )?",
-          "TIMESTAMP": "(?:%{BSD_TIMESTAMP_FORMAT}|%{SYSLOG_TIMESTAMP_FORMAT})",
-          "BSD_TIMESTAMP_FORMAT": "%{SYSLOGTIMESTAMP:_tmp.timestamp}(%{SPACE}%{BSD_PROCNAME}|%{SPACE}%{OBSERVER}%{SPACE}%{BSD_PROCNAME})(\\[%{POSINT:process.pid:long}\\])?:",
-          "BSD_PROCNAME": "(?:\\b%{NAME:process.name}|\\(%{NAME:process.name}\\))",
-          "NAME": "[[[:alnum:]]_-]+",
-          "SYSLOG_TIMESTAMP_FORMAT": "%{TIMESTAMP_ISO8601:_tmp.timestamp8601}%{SPACE}%{OBSERVER}%{SPACE}%{PROCESS}%{SPACE}(%{POSINT:process.pid:long}|-) - (-|%{META})",
-          "TIMESTAMP_ISO8601": "%{YEAR}-%{MONTHNUM}-%{MONTHDAY}[T ]%{HOUR}:?%{MINUTE}(?::?%{SECOND})?%{ISO8601_TIMEZONE:event.timezone}?",
-          "OBSERVER": "(?:%{IP:observer.ip}|%{HOSTNAME:observer.name})",
-          "PROCESS": "(\\(%{DATA:process.name}\\)|(?:%{UNIXPATH}*/)?%{BASEPATH:process.name})",
-          "BASEPATH": "[[[:alnum:]]_%!$@:.,+~-]+",
-          "META": "\\[[^\\]]*\\]"
-        }
-      }
-    },
-    {
-      "date": {
-        "if": "ctx._tmp.timestamp8601 != null",
-        "field": "_tmp.timestamp8601",
-        "target_field": "@timestamp",
-        "formats": [
-          "ISO8601"
-        ]
-      }
-    },
-    {
-      "date": {
-        "if": "ctx.event?.timezone != null && ctx._tmp?.timestamp != null",
-        "field": "_tmp.timestamp",
-        "target_field": "@timestamp",
-        "formats": [
-          "MMM  d HH:mm:ss",
-          "MMM d HH:mm:ss",
-          "MMM dd HH:mm:ss"
-        ],
-        "timezone": "{{ event.timezone }}"
-      }
-    },
-    {
-      "grok": {
-        "description": "Set Event Provider",
-        "field": "process.name",
-        "patterns": [
-          "^%{HYPHENATED_WORDS:event.provider}"
-        ],
-        "pattern_definitions": {
-          "HYPHENATED_WORDS": "\\b[A-Za-z0-9_]+(-[A-Za-z_]+)*\\b"
-        }
-      }
-    },
-    {
-      "pipeline": {
-        "name": "logs-pfsense.log-1.16.0-firewall",
-        "if": "ctx.event.provider == 'filterlog'"
-      }
-    },
-    {
-      "pipeline": {
-        "name": "logs-pfsense.log-1.16.0-openvpn",
-        "if": "ctx.event.provider == 'openvpn'"
-      }
-    },
-    {
-      "pipeline": {
-        "name": "logs-pfsense.log-1.16.0-ipsec",
-        "if": "ctx.event.provider == 'charon'"
-      }
-    },
-    {
-      "pipeline": {
-        "name": "logs-pfsense.log-1.16.0-dhcp",
-        "if": "[\"dhcpd\", \"dhclient\", \"dhcp6c\"].contains(ctx.event.provider)"
-      }
-    },
-    {
-      "pipeline": {
-        "name": "logs-pfsense.log-1.16.0-unbound",
-        "if": "ctx.event.provider == 'unbound'"
-      }
-    },
-    {
-      "pipeline": {
-        "name": "logs-pfsense.log-1.16.0-haproxy",
-        "if": "ctx.event.provider == 'haproxy'"
-      }
-    },
-    {
-      "pipeline": {
-        "name": "logs-pfsense.log-1.16.0-php-fpm",
-        "if": "ctx.event.provider == 'php-fpm'"
-      }
-    },
-    {
-      "pipeline": {
-        "name": "logs-pfsense.log-1.16.0-squid",
-        "if": "ctx.event.provider == 'squid'"
-      }
-    },
-    {
-     "pipeline": {
-        "name": "logs-pfsense.log-1.16.0-suricata",
-        "if": "ctx.event.provider == 'suricata'"
-      }
-    },
-    {
-      "drop": {
-        "if": "![\"filterlog\", \"openvpn\", \"charon\", \"dhcpd\", \"dhclient\", \"dhcp6c\", \"unbound\", \"haproxy\", \"php-fpm\", \"squid\", \"suricata\"].contains(ctx.event?.provider)"
-      }
-    },
-    {
-      "append": {
-        "field": "event.category",
-        "value": "network",
-        "if": "ctx.network != null"
-      }
-    },
-    {
-      "convert": {
-        "field": "source.address",
-        "target_field": "source.ip",
-        "type": "ip",
-        "ignore_failure": true,
-        "ignore_missing": true
-      }
-    },
-    {
-      "convert": {
-        "field": "destination.address",
-        "target_field": "destination.ip",
-        "type": "ip",
-        "ignore_failure": true,
-        "ignore_missing": true
-      }
-    },
-    {
-      "set": {
-        "field": "network.type",
-        "value": "ipv6",
-        "if": "ctx.source?.ip != null && ctx.source.ip.contains(\":\")"
-      }
-    },
-    {
-      "set": {
-        "field": "network.type",
-        "value": "ipv4",
-        "if": "ctx.source?.ip != null && ctx.source.ip.contains(\".\")"
-      }
-    },
-    {
-      "geoip": {
-        "field": "source.ip",
-        "target_field": "source.geo",
-        "ignore_missing": true
-      }
-    },
-    {
-      "geoip": {
-        "field": "destination.ip",
-        "target_field": "destination.geo",
-        "ignore_missing": true
-      }
-    },
-    {
-      "geoip": {
-        "ignore_missing": true,
-        "database_file": "GeoLite2-ASN.mmdb",
-        "field": "source.ip",
-        "target_field": "source.as",
-        "properties": [
-          "asn",
-          "organization_name"
-        ]
-      }
-    },
-    {
-      "geoip": {
-        "database_file": "GeoLite2-ASN.mmdb",
-        "field": "destination.ip",
-        "target_field": "destination.as",
-        "properties": [
-          "asn",
-          "organization_name"
-        ],
-        "ignore_missing": true
-      }
-    },
-    {
-      "rename": {
-        "field": "source.as.asn",
-        "target_field": "source.as.number",
-        "ignore_missing": true
-      }
-    },
-    {
-      "rename": {
-        "field": "source.as.organization_name",
-        "target_field": "source.as.organization.name",
-        "ignore_missing": true
-      }
-    },
-    {
-      "rename": {
-        "field": "destination.as.asn",
-        "target_field": "destination.as.number",
-        "ignore_missing": true
-      }
-    },
-    {
-      "rename": {
-        "field": "destination.as.organization_name",
-        "target_field": "destination.as.organization.name",
-        "ignore_missing": true
-      }
-    },
-    {
-      "community_id": {
-        "target_field": "network.community_id",
-        "ignore_failure": true
-      }
-    },
-    {
-      "grok": {
-        "field": "observer.ingress.interface.name",
-        "patterns": [
-          "%{DATA}.%{NONNEGINT:observer.ingress.vlan.id}"
-        ],
-        "ignore_missing": true,
-        "ignore_failure": true
-      }
-    },
-    {
-      "set": {
-        "field": "network.vlan.id",
-        "copy_from": "observer.ingress.vlan.id",
-        "ignore_empty_value": true
-      }
-    },
-    {
-      "append": {
-        "field": "related.ip",
-        "value": "{{destination.ip}}",
-        "allow_duplicates": false,
-        "if": "ctx.destination?.ip != null"
-      }
-    },
-    {
-      "append": {
-        "field": "related.ip",
-        "value": "{{source.ip}}",
-        "allow_duplicates": false,
-        "if": "ctx.source?.ip != null"
-      }
-    },
-    {
-      "append": {
-        "field": "related.ip",
-        "value": "{{source.nat.ip}}",
-        "allow_duplicates": false,
-        "if": "ctx.source?.nat?.ip != null"
-      }
-    },
-    {
-      "append": {
-        "field": "related.hosts",
-        "value": "{{destination.domain}}",
-        "if": "ctx.destination?.domain != null"
-      }
-    },
-    {
-      "append": {
-        "field": "related.user",
-        "value": "{{user.name}}",
-        "if": "ctx.user?.name != null"
-      }
-    },
-    {
-      "set": {
-        "field": "network.direction",
-        "value": "{{network.direction}}bound",
-        "if": "ctx.network?.direction != null && ctx.network?.direction =~ /^(in|out)$/"
-      }
-    },
-    {
-      "remove": {
-        "field": [
-          "_tmp"
-        ],
-        "ignore_failure": true
-      }
-    },
-    {
-      "script": {
-        "lang": "painless",
-        "description": "This script processor iterates over the whole document to remove fields with null values.",
-        "source": "void handleMap(Map map) {\n  for (def x : map.values()) {\n    if (x instanceof Map) {\n        handleMap(x);\n    } else if (x instanceof List) {\n        handleList(x);\n    }\n  }\n  map.values().removeIf(v -> v == null || (v instanceof String && v == \"-\"));\n}\nvoid handleList(List list) {\n  for (def x : list) {\n      if (x instanceof Map) {\n          handleMap(x);\n      } else if (x instanceof List) {\n          handleList(x);\n      }\n  }\n}\nhandleMap(ctx);\n"
-      }
-    },
-    {
-      "remove": {
-        "field": "event.original",
-        "if": "ctx.tags == null || !(ctx.tags.contains('preserve_original_event'))",
-        "ignore_failure": true,
-        "ignore_missing": true
-      }
-    },
-    {
-      "pipeline": {
-        "name": "logs-pfsense.log@custom",
-        "ignore_missing_pipeline": true
-      }
-    }
-  ],
-  "on_failure": [
-    {
-      "remove": {
-        "field": [
-          "_tmp"
-        ],
-        "ignore_failure": true
-      }
-    },
-    {
-      "set": {
-        "field": "event.kind",
-        "value": "pipeline_error"
-      }
-    },
-    {
-      "append": {
-        "field": "error.message",
-        "value": "{{{ _ingest.on_failure_message }}}"
-      }
-    }
-  ],
-  "_meta": {
-    "managed_by": "fleet",
-    "managed": true,
-    "package": {
-      "name": "pfsense"
-    }
-  }
-}

salt/elasticsearch/files/ingest/logs-pfsense.log-1.20.2

@@ -1,5 +1,12 @@
 {
   "description": "Pipeline for PFsense",
+  "_meta": {
+    "package": {
+      "name": "pfsense"
+    },
+    "managed_by": "fleet",
+    "managed": true
+  },
   "processors": [
     {
       "set": {
@@ -36,7 +43,7 @@
     {
       "set": {
         "field": "event.timezone",
-        "value": "{{_tmp.tz_offset}}",
+        "value": "{{{_tmp.tz_offset}}}",
         "if": "ctx._tmp?.tz_offset != null && ctx._tmp?.tz_offset != 'local'"
       }
     },
@@ -83,7 +90,7 @@
           "MMM d HH:mm:ss",
           "MMM dd HH:mm:ss"
         ],
-        "timezone": "{{ event.timezone }}"
+        "timezone": "{{{ event.timezone }}}"
       }
     },
     {
@@ -100,61 +107,67 @@
     },
     {
       "pipeline": {
-        "name": "logs-pfsense.log-1.19.1-firewall",
+        "name": "logs-pfsense.log-1.20.2-firewall",
         "if": "ctx.event.provider == 'filterlog'"
       }
     },
     {
       "pipeline": {
-        "name": "logs-pfsense.log-1.19.1-openvpn",
+        "name": "logs-pfsense.log-1.20.2-openvpn",
         "if": "ctx.event.provider == 'openvpn'"
       }
     },
     {
       "pipeline": {
-        "name": "logs-pfsense.log-1.19.1-ipsec",
+        "name": "logs-pfsense.log-1.20.2-ipsec",
         "if": "ctx.event.provider == 'charon'"
       }
     },
     {
       "pipeline": {
-        "name": "logs-pfsense.log-1.19.1-dhcp",
+        "name": "logs-pfsense.log-1.20.2-dhcp",
         "if": "[\"dhcpd\", \"dhclient\", \"dhcp6c\"].contains(ctx.event.provider)"
       }
     },
     {
       "pipeline": {
-        "name": "logs-pfsense.log-1.19.1-unbound",
+        "name": "logs-pfsense.log-1.20.2-unbound",
         "if": "ctx.event.provider == 'unbound'"
       }
     },
     {
       "pipeline": {
-        "name": "logs-pfsense.log-1.19.1-haproxy",
+        "name": "logs-pfsense.log-1.20.2-haproxy",
         "if": "ctx.event.provider == 'haproxy'"
       }
     },
     {
       "pipeline": {
-        "name": "logs-pfsense.log-1.19.1-php-fpm",
+        "name": "logs-pfsense.log-1.20.2-php-fpm",
         "if": "ctx.event.provider == 'php-fpm'"
       }
     },
     {
       "pipeline": {
-        "name": "logs-pfsense.log-1.19.1-squid",
+        "name": "logs-pfsense.log-1.20.2-squid",
         "if": "ctx.event.provider == 'squid'"
       }
     },
     {
       "pipeline": {
-        "name": "logs-pfsense.log-1.16.0-suricata",
+        "name": "logs-pfsense.log-1.20.2-snort",
+        "if": "ctx.event.provider == 'snort'"
+      }
+    },
+    {
+      "pipeline": {
+        "name": "logs-pfsense.log-1.20.2-suricata",
         "if": "ctx.event.provider == 'suricata'"
       }
     },
     {
       "drop": {
-        "if": "![\"filterlog\", \"openvpn\", \"charon\", \"dhcpd\", \"dhclient\", \"dhcp6c\", \"unbound\", \"haproxy\", \"php-fpm\", \"squid\", \"suricata\"].contains(ctx.event?.provider)"
+        "if": "![\"filterlog\", \"openvpn\", \"charon\", \"dhcpd\", \"dhclient\", \"dhcp6c\", \"unbound\", \"haproxy\", \"php-fpm\", \"squid\", \"snort\", \"suricata\"].contains(ctx.event?.provider)"
       }
     },
     {
@@ -288,7 +301,7 @@
     {
       "append": {
         "field": "related.ip",
-        "value": "{{destination.ip}}",
+        "value": "{{{destination.ip}}}",
         "allow_duplicates": false,
         "if": "ctx.destination?.ip != null"
       }
@@ -296,7 +309,7 @@
     {
       "append": {
         "field": "related.ip",
-        "value": "{{source.ip}}",
+        "value": "{{{source.ip}}}",
         "allow_duplicates": false,
         "if": "ctx.source?.ip != null"
       }
@@ -304,7 +317,7 @@
     {
       "append": {
         "field": "related.ip",
-        "value": "{{source.nat.ip}}",
+        "value": "{{{source.nat.ip}}}",
         "allow_duplicates": false,
         "if": "ctx.source?.nat?.ip != null"
       }
@@ -312,21 +325,21 @@
     {
       "append": {
         "field": "related.hosts",
-        "value": "{{destination.domain}}",
+        "value": "{{{destination.domain}}}",
         "if": "ctx.destination?.domain != null"
       }
     },
     {
       "append": {
         "field": "related.user",
-        "value": "{{user.name}}",
+        "value": "{{{user.name}}}",
         "if": "ctx.user?.name != null"
       }
     },
     {
       "set": {
         "field": "network.direction",
-        "value": "{{network.direction}}bound",
+        "value": "{{{network.direction}}}bound",
         "if": "ctx.network?.direction != null && ctx.network?.direction =~ /^(in|out)$/"
       }
     },
@@ -403,12 +416,5 @@
         "value": "{{{ _ingest.on_failure_message }}}"
       }
     }
-  ],
+  ]
-  "_meta": {
-    "managed_by": "fleet",
-    "managed": true,
-    "package": {
-      "name": "pfsense"
-    }
-  }
 }

salt/elasticsearch/soc_elasticsearch.yaml

@@ -77,6 +77,12 @@ elasticsearch:
     custom008: *pipelines
     custom009: *pipelines
     custom010: *pipelines
+  managed_integrations:
+    description: List of integrations to add into SOC config UI. Enter the full or partial integration name. Eg. 1password, 1pass
+    forcedType: "[]string"
+    global: True
+    advanced: True
+    helpLink: elasticsearch.html
   index_settings:
     global_overrides:
       index_template:
@@ -166,7 +172,7 @@ elasticsearch:
       index_template:
         index_patterns:
           description: Patterns for matching multiple indices or tables.
-          forceType: "[]string"
+          forcedType: "[]string"
           multiline: True
           global: True
           advanced: True
@@ -358,161 +364,9 @@ elasticsearch:
     so-logs-windows_x_powershell_operational: *indexSettings
     so-logs-windows_x_sysmon_operational: *indexSettings
     so-logs-winlog_x_winlog: *indexSettings
-    so-logs-apache_x_access: *indexSettings
-    so-logs-apache_x_error: *indexSettings
-    so-logs-auditd_x_log: *indexSettings
-    so-logs-aws_x_cloudtrail: *indexSettings
-    so-logs-aws_x_cloudwatch_logs: *indexSettings
-    so-logs-aws_x_ec2_logs: *indexSettings
-    so-logs-aws_x_elb_logs: *indexSettings
-    so-logs-aws_x_firewall_logs: *indexSettings
-    so-logs-aws_x_route53_public_logs: *indexSettings
-    so-logs-aws_x_route53_resolver_logs: *indexSettings
-    so-logs-aws_x_s3access: *indexSettings
-    so-logs-aws_x_vpcflow: *indexSettings
-    so-logs-aws_x_waf: *indexSettings
-    so-logs-azure_x_activitylogs: *indexSettings
-    so-logs-azure_x_application_gateway: *indexSettings
-    so-logs-azure_x_auditlogs: *indexSettings
-    so-logs-azure_x_eventhub: *indexSettings
-    so-logs-azure_x_firewall_logs: *indexSettings
-    so-logs-azure_x_identity_protection: *indexSettings
-    so-logs-azure_x_platformlogs: *indexSettings
-    so-logs-azure_x_provisioning: *indexSettings
-    so-logs-azure_x_signinlogs: *indexSettings
-    so-logs-azure_x_springcloudlogs: *indexSettings
-    so-logs-barracuda_x_waf: *indexSettings
-    so-logs-barracuda_cloudgen_firewall_x_log: *indexSettings
-    so-logs-cef_x_log: *indexSettings
-    so-logs-cisco_asa_x_log: *indexSettings
-    so-logs-cisco_ftd_x_log: *indexSettings
-    so-logs-cisco_ios_x_log: *indexSettings
-    so-logs-cisco_ise_x_log: *indexSettings
-    so-logs-citrix_adc_x_interface: *indexSettings
-    so-logs-citrix_adc_x_lbvserver: *indexSettings
-    so-logs-citrix_adc_x_service: *indexSettings
-    so-logs-citrix_adc_x_system: *indexSettings
-    so-logs-citrix_adc_x_vpn: *indexSettings
-    so-logs-citrix_waf_x_log: *indexSettings
-    so-logs-cloudflare_x_audit: *indexSettings
-    so-logs-cloudflare_x_logpull: *indexSettings
-    so-logs-crowdstrike_x_alert: *indexSettings
-    so-logs-crowdstrike_x_falcon: *indexSettings
-    so-logs-crowdstrike_x_fdr: *indexSettings
-    so-logs-crowdstrike_x_host: *indexSettings
-    so-logs-darktrace_x_ai_analyst_alert: *indexSettings
-    so-logs-darktrace_x_model_breach_alert: *indexSettings
-    so-logs-darktrace_x_system_status_alert: *indexSettings
     so-logs-detections_x_alerts: *indexSettings
-    so-logs-f5_bigip_x_log: *indexSettings
-    so-logs-fim_x_event: *indexSettings
-    so-logs-fortinet_x_clientendpoint: *indexSettings
-    so-logs-fortinet_x_firewall: *indexSettings
-    so-logs-fortinet_x_fortimail: *indexSettings
-    so-logs-fortinet_x_fortimanager: *indexSettings
-    so-logs-fortinet_x_fortigate: *indexSettings
-    so-logs-gcp_x_audit: *indexSettings
-    so-logs-gcp_x_dns: *indexSettings
-    so-logs-gcp_x_firewall: *indexSettings
-    so-logs-gcp_x_loadbalancing_logs: *indexSettings
-    so-logs-gcp_x_vpcflow: *indexSettings
-    so-logs-github_x_audit: *indexSettings
-    so-logs-github_x_code_scanning: *indexSettings
-    so-logs-github_x_dependabot: *indexSettings
-    so-logs-github_x_issues: *indexSettings
-    so-logs-github_x_secret_scanning: *indexSettings
-    so-logs-google_workspace_x_access_transparency: *indexSettings
-    so-logs-google_workspace_x_admin: *indexSettings
-    so-logs-google_workspace_x_alert: *indexSettings
-    so-logs-google_workspace_x_context_aware_access: *indexSettings
-    so-logs-google_workspace_x_device: *indexSettings
-    so-logs-google_workspace_x_drive: *indexSettings
-    so-logs-google_workspace_x_gcp: *indexSettings
-    so-logs-google_workspace_x_group_enterprise: *indexSettings
-    so-logs-google_workspace_x_groups: *indexSettings
-    so-logs-google_workspace_x_login: *indexSettings
-    so-logs-google_workspace_x_rules: *indexSettings
-    so-logs-google_workspace_x_saml: *indexSettings
-    so-logs-google_workspace_x_token: *indexSettings
-    so-logs-google_workspace_x_user_accounts: *indexSettings
     so-logs-http_endpoint_x_generic: *indexSettings
     so-logs-httpjson_x_generic: *indexSettings
-    so-logs-iis_x_access: *indexSettings
-    so-logs-iis_x_error: *indexSettings
-    so-logs-imperva_cloud_waf_x_event: *indexSettings
-    so-logs-juniper_x_junos: *indexSettings
-    so-logs-juniper_x_netscreen: *indexSettings
-    so-logs-juniper_x_srx: *indexSettings
-    so-logs-juniper_srx_x_log: *indexSettings
-    so-logs-kafka_log_x_generic: *indexSettings
-    so-logs-lastpass_x_detailed_shared_folder: *indexSettings
-    so-logs-lastpass_x_event_report: *indexSettings
-    so-logs-lastpass_x_user: *indexSettings
-    so-logs-m365_defender_x_event: *indexSettings
-    so-logs-m365_defender_x_incident: *indexSettings
-    so-logs-m365_defender_x_log: *indexSettings
-    so-logs-microsoft_defender_endpoint_x_log: *indexSettings
-    so-logs-microsoft_dhcp_x_log: *indexSettings
-    so-logs-microsoft_sqlserver_x_audit: *indexSettings
-    so-logs-microsoft_sqlserver_x_log: *indexSettings
-    so-logs-mysql_x_error: *indexSettings
-    so-logs-mysql_x_slowlog: *indexSettings
-    so-logs-netflow_x_log: *indexSettings
-    so-logs-nginx_x_access: *indexSettings
-    so-logs-nginx_x_error: *indexSettings
-    so-logs-o365_x_audit: *indexSettings
-    so-logs-okta_x_system: *indexSettings
-    so-logs-panw_x_panos: *indexSettings
-    so-logs-pfsense_x_log: *indexSettings
-    so-logs-proofpoint_tap_x_clicks_blocked: *indexSettings
-    so-logs-proofpoint_tap_x_clicks_permitted: *indexSettings
-    so-logs-proofpoint_tap_x_message_blocked: *indexSettings
-    so-logs-proofpoint_tap_x_message_delivered: *indexSettings
-    so-logs-sentinel_one_x_activity: *indexSettings
-    so-logs-sentinel_one_x_agent: *indexSettings
-    so-logs-sentinel_one_x_alert: *indexSettings
-    so-logs-sentinel_one_x_group: *indexSettings
-    so-logs-sentinel_one_x_threat: *indexSettings
-    so-logs-sonicwall_firewall_x_log: *indexSettings
-    so-logs-snort_x_log: *indexSettings
-    so-logs-symantec_endpoint_x_log: *indexSettings
-    so-logs-tenable_io_x_asset: *indexSettings
-    so-logs-tenable_io_x_plugin: *indexSettings
-    so-logs-tenable_io_x_scan: *indexSettings
-    so-logs-tenable_io_x_vulnerability: *indexSettings
-    so-logs-tenable_sc_x_asset: *indexSettings
-    so-logs-tenable_sc_x_plugin: *indexSettings
-    so-logs-tenable_sc_x_vulnerability: *indexSettings
-    so-logs-ti_abusech_x_malware: *indexSettings
-    so-logs-ti_abusech_x_malwarebazaar: *indexSettings
-    so-logs-ti_abusech_x_threatfox: *indexSettings
-    so-logs-ti_abusech_x_url: *indexSettings
-    so-logs-ti_anomali_x_threatstream: *indexSettings
-    so-logs-ti_cybersixgill_x_threat: *indexSettings
-    so-logs-ti_misp_x_threat: *indexSettings
-    so-logs-ti_misp_x_threat_attributes: *indexSettings
-    so-logs-ti_opencti_x_indicator: *indexSettings
-    so-logs-ti_otx_x_pulses_subscribed: *indexSettings  
-    so-logs-ti_otx_x_threat: *indexSettings
-    so-logs-ti_recordedfuture_x_latest_ioc-template: *indexSettings
-    so-logs-ti_recordedfuture_x_threat: *indexSettings
-    so-logs-ti_threatq_x_threat: *indexSettings
-    so-logs-trend_micro_vision_one_x_alert: *indexSettings
-    so-logs-trend_micro_vision_one_x_audit: *indexSettings
-    so-logs-trend_micro_vision_one_x_detection: *indexSettings
-    so-logs-trendmicro_x_deep_security: *indexSettings
-    so-logs-zscaler_zia_x_alerts: *indexSettings
-    so-logs-zscaler_zia_x_dns: *indexSettings
-    so-logs-zscaler_zia_x_firewall: *indexSettings
-    so-logs-zscaler_zia_x_tunnel: *indexSettings
-    so-logs-zscaler_zia_x_web: *indexSettings
-    so-logs-zscaler_zpa_x_app_connector_status: *indexSettings
-    so-logs-zscaler_zpa_x_audit: *indexSettings
-    so-logs-zscaler_zpa_x_browser_access: *indexSettings
-    so-logs-zscaler_zpa_x_user_activity: *indexSettings
-    so-logs-zscaler_zpa_x_user_status: *indexSettings
-    so-logs-1password_x_item_usages: *indexSettings
-    so-logs-1password_x_signin_attempts: *indexSettings
     so-logs-osquery-manager-actions: *indexSettings
     so-logs-osquery-manager-action_x_responses: *indexSettings
     so-logs-elastic_agent_x_apm_server: *indexSettings
@@ -538,6 +392,9 @@ elasticsearch:
     so-metrics-endpoint_x_metrics: *indexSettings
     so-metrics-endpoint_x_policy: *indexSettings
     so-metrics-nginx_x_stubstatus: *indexSettings
+    so-metrics-vsphere_x_datastore: *indexSettings
+    so-metrics-vsphere_x_host: *indexSettings
+    so-metrics-vsphere_x_virtualmachine: *indexSettings
     so-case: *indexSettings
     so-common: *indexSettings
     so-endgame: *indexSettings

salt/elasticsearch/template.map.jinja

@@ -14,6 +14,15 @@
 
 {% set ES_INDEX_SETTINGS_ORIG = ELASTICSEARCHDEFAULTS.elasticsearch.index_settings %}
 
+{# start generation of integration default index_settings #}
+{% if salt['file.file_exists']('/opt/so/state/esfleet_package_components.json') %}
+{%   from 'elasticfleet/integration-defaults.map.jinja' import ADDON_INTEGRATION_DEFAULTS %}
+{%   for index, settings in ADDON_INTEGRATION_DEFAULTS.items() %}
+{%     do ES_INDEX_SETTINGS_ORIG.update({index: settings}) %}
+{%   endfor %}
+{% endif %}
+{# end generation of integration default index_settings #}
+
 {% set ES_INDEX_SETTINGS_GLOBAL_OVERRIDES = {} %}
 {% for index in ES_INDEX_SETTINGS_ORIG.keys() %}
 {%   do ES_INDEX_SETTINGS_GLOBAL_OVERRIDES.update({index: salt['defaults.merge'](ELASTICSEARCHDEFAULTS.elasticsearch.index_settings[index], PILLAR_GLOBAL_OVERRIDES, in_place=False)}) %}

salt/elasticsearch/templates/component/elastic-agent/logs-1password.item_usages@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-1password.signin_attempts@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-apache.access@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-apache.error@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-auditd.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-auth0.logs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.cloudfront_logs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.cloudtrail@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.cloudwatch_logs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.ec2_logs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.elb_logs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.firewall_logs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.guardduty@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.inspector@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.route53_public_logs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.route53_resolver_logs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.s3access@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.securityhub_findings@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.securityhub_insights@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.vpcflow@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-aws.waf@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-azure.activitylogs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-azure.application_gateway@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-azure.auditlogs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-azure.eventhub@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-azure.firewall_logs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-azure.identity_protection@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-azure.platformlogs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-azure.provisioning@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-azure.signinlogs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-azure.springcloudlogs@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-barracuda.waf@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-barracuda_cloudgen_firewall.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-carbonblack_edr.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cef.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-checkpoint.firewall@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_asa.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_duo.admin@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_duo.auth@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_duo.offline_enrollment@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_duo.summary@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_duo.telephony@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_ftd.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_ios.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_ise.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_meraki.events@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_meraki.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_secure_email_gateway.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cisco_umbrella.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-citrix_adc.interface@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-citrix_adc.lbvserver@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-citrix_adc.service@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-citrix_adc.system@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-citrix_adc.vpn@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-citrix_waf.log@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare.audit@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare.logpull@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.access_request@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.audit@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.casb@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.device_posture@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.dns@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.dns_firewall@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.firewall_event@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.gateway_dns@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.gateway_http@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.gateway_network@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.http_request@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.magic_ids@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.nel_report@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.network_analytics@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.network_session@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.sinkhole_http@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.spectrum_event@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-cloudflare_logpush.workers_trace@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-crowdstrike.alert@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-crowdstrike.falcon@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-crowdstrike.fdr@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-crowdstrike.host@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-darktrace.ai_analyst_alert@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-darktrace.model_breach_alert@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}

salt/elasticsearch/templates/component/elastic-agent/logs-darktrace.system_status_alert@custom.json

@@ -1,36 +0,0 @@
-{
-  "template": {
-    "mappings": {
-      "properties": {
-        "host": {
-	  "properties":{
-            "ip": {
-              "type": "ip"
-            }
-	  }
-	},
-	"related": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"destination": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        },
-	"source": {
-          "properties":{
-            "ip": {
-              "type": "ip"
-            }
-          }
-        }
-      }
-    }
-  }
-}