diff --git a/src/plugins/home/public/assets/auditd_logs/screenshot.png b/src/plugins/home/public/assets/auditd_logs/screenshot.png new file mode 100644 index 0000000000000..732afa18dc11c Binary files /dev/null and b/src/plugins/home/public/assets/auditd_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/coredns_logs/screenshot.png b/src/plugins/home/public/assets/coredns_logs/screenshot.png new file mode 100644 index 0000000000000..70921fa9bafb2 Binary files /dev/null and b/src/plugins/home/public/assets/coredns_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/crowdstrike_logs/screenshot.png b/src/plugins/home/public/assets/crowdstrike_logs/screenshot.png new file mode 100644 index 0000000000000..b74edfe2293f9 Binary files /dev/null and b/src/plugins/home/public/assets/crowdstrike_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/googlecloud_logs/screenshot.png b/src/plugins/home/public/assets/googlecloud_logs/screenshot.png new file mode 100644 index 0000000000000..4f68932e9f709 Binary files /dev/null and b/src/plugins/home/public/assets/googlecloud_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/haproxy_logs/screenshot.png b/src/plugins/home/public/assets/haproxy_logs/screenshot.png new file mode 100644 index 0000000000000..85a24bf01f3aa Binary files /dev/null and b/src/plugins/home/public/assets/haproxy_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/icinga_logs/screenshot.png b/src/plugins/home/public/assets/icinga_logs/screenshot.png new file mode 100644 index 0000000000000..013b20fcf166e Binary files /dev/null and b/src/plugins/home/public/assets/icinga_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/logos/barracuda.svg b/src/plugins/home/public/assets/logos/barracuda.svg new file mode 100644 index 0000000000000..555cdd6f8a32b --- /dev/null +++ b/src/plugins/home/public/assets/logos/barracuda.svg @@ -0,0 +1,100 @@ + + + + + + + + + diff --git a/src/plugins/home/public/assets/logos/checkpoint.svg b/src/plugins/home/public/assets/logos/checkpoint.svg new file mode 100644 index 0000000000000..e71866e78c293 --- /dev/null +++ b/src/plugins/home/public/assets/logos/checkpoint.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/crowdstrike.svg b/src/plugins/home/public/assets/logos/crowdstrike.svg new file mode 100644 index 0000000000000..1b2195a2244f9 --- /dev/null +++ b/src/plugins/home/public/assets/logos/crowdstrike.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/cylance.svg b/src/plugins/home/public/assets/logos/cylance.svg new file mode 100644 index 0000000000000..ccd6004d19e76 --- /dev/null +++ b/src/plugins/home/public/assets/logos/cylance.svg @@ -0,0 +1,82 @@ + + + + +Cylance_BB_Logo_RGB_Vert_Black + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/plugins/home/public/assets/logos/f5.svg b/src/plugins/home/public/assets/logos/f5.svg new file mode 100644 index 0000000000000..d985bde96291f --- /dev/null +++ b/src/plugins/home/public/assets/logos/f5.svg @@ -0,0 +1 @@ +Asset 1 \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/fortinet.svg b/src/plugins/home/public/assets/logos/fortinet.svg new file mode 100644 index 0000000000000..d6a8448f320bc --- /dev/null +++ b/src/plugins/home/public/assets/logos/fortinet.svg @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/src/plugins/home/public/assets/logos/icinga.svg b/src/plugins/home/public/assets/logos/icinga.svg new file mode 100644 index 0000000000000..88161d61ca75e --- /dev/null +++ b/src/plugins/home/public/assets/logos/icinga.svg @@ -0,0 +1,87 @@ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/plugins/home/public/assets/logos/infoblox.svg b/src/plugins/home/public/assets/logos/infoblox.svg new file mode 100644 index 0000000000000..57b4d23b16812 --- /dev/null +++ b/src/plugins/home/public/assets/logos/infoblox.svg @@ -0,0 +1,93 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/plugins/home/public/assets/logos/juniper.svg b/src/plugins/home/public/assets/logos/juniper.svg new file mode 100644 index 0000000000000..8802414a5aafe --- /dev/null +++ b/src/plugins/home/public/assets/logos/juniper.svg @@ -0,0 +1,72 @@ + +image/svg+xml \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/linux.svg b/src/plugins/home/public/assets/logos/linux.svg new file mode 100644 index 0000000000000..c0a92e0c0f404 --- /dev/null +++ b/src/plugins/home/public/assets/logos/linux.svg @@ -0,0 +1,1532 @@ + + + + Tux + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + image/svg+xml + + Tux + 20 June 2012 + + + Garrett LeSage + + + + + + Larry Ewing, the creator of the original Tux graphic + + + + + tux + Linux + penguin + logo + + + + + Larry Ewing, Garrett LeSage + + + https://github.com/garrett/Tux + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/plugins/home/public/assets/logos/microsoft.svg b/src/plugins/home/public/assets/logos/microsoft.svg new file mode 100644 index 0000000000000..5334aa7ca6864 --- /dev/null +++ b/src/plugins/home/public/assets/logos/microsoft.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/misp.svg b/src/plugins/home/public/assets/logos/misp.svg new file mode 100644 index 0000000000000..1cc61eda0b608 --- /dev/null +++ b/src/plugins/home/public/assets/logos/misp.svg @@ -0,0 +1,167 @@ + + + + + + + + + + + + + + + + + image/svg+xml + + + + + + + + + + + + + + + + + + + + + Threat Sharing + + + + + + + + + + + + diff --git a/src/plugins/home/public/assets/logos/netscout.svg b/src/plugins/home/public/assets/logos/netscout.svg new file mode 100644 index 0000000000000..cbd25cd92594a --- /dev/null +++ b/src/plugins/home/public/assets/logos/netscout.svg @@ -0,0 +1,7 @@ + + + + + + + diff --git a/src/plugins/home/public/assets/logos/o365.svg b/src/plugins/home/public/assets/logos/o365.svg new file mode 100644 index 0000000000000..3763f267ffc7a --- /dev/null +++ b/src/plugins/home/public/assets/logos/o365.svg @@ -0,0 +1,16 @@ + + + logo-integrations-Desktop HD Copy 2 + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/okta.svg b/src/plugins/home/public/assets/logos/okta.svg new file mode 100644 index 0000000000000..d806cb7dc6451 --- /dev/null +++ b/src/plugins/home/public/assets/logos/okta.svg @@ -0,0 +1,19 @@ + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/oracle.svg b/src/plugins/home/public/assets/logos/oracle.svg new file mode 100644 index 0000000000000..1056521d9d5b3 --- /dev/null +++ b/src/plugins/home/public/assets/logos/oracle.svg @@ -0,0 +1,70 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/plugins/home/public/assets/logos/osquery.svg b/src/plugins/home/public/assets/logos/osquery.svg new file mode 100755 index 0000000000000..c2bf733d35931 --- /dev/null +++ b/src/plugins/home/public/assets/logos/osquery.svg @@ -0,0 +1,13 @@ + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/paloalto.svg b/src/plugins/home/public/assets/logos/paloalto.svg new file mode 100644 index 0000000000000..8c8e71ae0d9fc --- /dev/null +++ b/src/plugins/home/public/assets/logos/paloalto.svg @@ -0,0 +1,29 @@ + + + logo-integrations-Desktop HD + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/rabbitmq.svg b/src/plugins/home/public/assets/logos/rabbitmq.svg new file mode 100644 index 0000000000000..dabd2a5744cb4 --- /dev/null +++ b/src/plugins/home/public/assets/logos/rabbitmq.svg @@ -0,0 +1,3 @@ + + + diff --git a/src/plugins/home/public/assets/logos/radware.svg b/src/plugins/home/public/assets/logos/radware.svg new file mode 100644 index 0000000000000..6252efef77624 --- /dev/null +++ b/src/plugins/home/public/assets/logos/radware.svg @@ -0,0 +1,66 @@ + +image/svg+xml \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/sonicwall.svg b/src/plugins/home/public/assets/logos/sonicwall.svg new file mode 100644 index 0000000000000..fb1aded68a29e --- /dev/null +++ b/src/plugins/home/public/assets/logos/sonicwall.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/sophos.svg b/src/plugins/home/public/assets/logos/sophos.svg new file mode 100644 index 0000000000000..1f2cfc3a7f036 --- /dev/null +++ b/src/plugins/home/public/assets/logos/sophos.svg @@ -0,0 +1,69 @@ + + + +image/svg+xml \ No newline at end of file diff --git a/src/plugins/home/public/assets/logos/tomcat.svg b/src/plugins/home/public/assets/logos/tomcat.svg new file mode 100644 index 0000000000000..410a468872e17 --- /dev/null +++ b/src/plugins/home/public/assets/logos/tomcat.svg @@ -0,0 +1,107 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/src/plugins/home/public/assets/logos/zscaler.svg b/src/plugins/home/public/assets/logos/zscaler.svg new file mode 100644 index 0000000000000..b8a21a2fa6eed --- /dev/null +++ b/src/plugins/home/public/assets/logos/zscaler.svg @@ -0,0 +1 @@ +Zscaler-Logo-TM-Blue-RGB-May2019 \ No newline at end of file diff --git a/src/plugins/home/public/assets/microsoft_logs/screenshot.png b/src/plugins/home/public/assets/microsoft_logs/screenshot.png new file mode 100644 index 0000000000000..7df250e2ae885 Binary files /dev/null and b/src/plugins/home/public/assets/microsoft_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/misp_logs/screenshot.png b/src/plugins/home/public/assets/misp_logs/screenshot.png new file mode 100644 index 0000000000000..a02068ddf3038 Binary files /dev/null and b/src/plugins/home/public/assets/misp_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/mongodb_logs/screenshot.png b/src/plugins/home/public/assets/mongodb_logs/screenshot.png new file mode 100644 index 0000000000000..c77c37d5ce05b Binary files /dev/null and b/src/plugins/home/public/assets/mongodb_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/o365_logs/screenshot.png b/src/plugins/home/public/assets/o365_logs/screenshot.png new file mode 100644 index 0000000000000..a2413e7b909bc Binary files /dev/null and b/src/plugins/home/public/assets/o365_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/okta_logs/screenshot.png b/src/plugins/home/public/assets/okta_logs/screenshot.png new file mode 100644 index 0000000000000..6a28b4363b05b Binary files /dev/null and b/src/plugins/home/public/assets/okta_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/panw_logs/screenshot.png b/src/plugins/home/public/assets/panw_logs/screenshot.png new file mode 100644 index 0000000000000..ef9d5f706eca6 Binary files /dev/null and b/src/plugins/home/public/assets/panw_logs/screenshot.png differ diff --git a/src/plugins/home/public/assets/santa_logs/screenshot.png b/src/plugins/home/public/assets/santa_logs/screenshot.png new file mode 100644 index 0000000000000..31abdeb270a35 Binary files /dev/null and b/src/plugins/home/public/assets/santa_logs/screenshot.png differ diff --git a/src/plugins/home/server/tutorials/activemq_logs/index.ts b/src/plugins/home/server/tutorials/activemq_logs/index.ts index c11c070637ae1..b0214f7a6422b 100644 --- a/src/plugins/home/server/tutorials/activemq_logs/index.ts +++ b/src/plugins/home/server/tutorials/activemq_logs/index.ts @@ -53,11 +53,11 @@ export function activemqLogsSpecProvider(context: TutorialContext): TutorialSche artifacts: { dashboards: [ { - id: '26434790-1464-11ea-8fd8-030a13064883', + id: 'ffe86390-145f-11ea-8fd8-030a13064883', linkLabel: i18n.translate('home.tutorials.activemqLogs.artifacts.dashboards.linkLabel', { - defaultMessage: 'ActiveMQ Application Events', + defaultMessage: 'ActiveMQ Audit Events', }), - isOverview: true, + isOverview: false, }, ], exportedFields: { diff --git a/src/plugins/home/server/tutorials/auditd_logs/index.ts b/src/plugins/home/server/tutorials/auditd_logs/index.ts new file mode 100644 index 0000000000000..365a7dcca44fe --- /dev/null +++ b/src/plugins/home/server/tutorials/auditd_logs/index.ts @@ -0,0 +1,74 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function auditdLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'auditd'; + const platforms = ['DEB', 'RPM'] as const; + return { + id: 'auditdLogs', + name: i18n.translate('home.tutorials.auditdLogs.nameTitle', { + defaultMessage: 'Auditd logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.auditdLogs.shortDescription', { + defaultMessage: 'Collect logs from the Linux auditd daemon.', + }), + longDescription: i18n.translate('home.tutorials.auditdLogs.longDescription', { + defaultMessage: + 'The module collects and parses logs from the audit daemon ( `auditd`). \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-auditd.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/linux.svg', + artifacts: { + dashboards: [ + { + id: 'dfbb49f0-0a0f-11e7-8a62-2d05eaaac5cb-ecs', + linkLabel: i18n.translate('home.tutorials.auditdLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Audit Events', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-auditd.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/auditd_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/barracuda_logs/index.ts b/src/plugins/home/server/tutorials/barracuda_logs/index.ts new file mode 100644 index 0000000000000..b5792b7535cc3 --- /dev/null +++ b/src/plugins/home/server/tutorials/barracuda_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function barracudaLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'barracuda'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'barracudaLogs', + name: i18n.translate('home.tutorials.barracudaLogs.nameTitle', { + defaultMessage: 'Barracuda logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.barracudaLogs.shortDescription', { + defaultMessage: 'Collect Barracuda Web Application Firewall logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.barracudaLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Barracuda Web Application Firewall logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-barracuda.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/barracuda.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.barracudaLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-barracuda.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/bluecoat_logs/index.ts b/src/plugins/home/server/tutorials/bluecoat_logs/index.ts new file mode 100644 index 0000000000000..5e55b6b2c6455 --- /dev/null +++ b/src/plugins/home/server/tutorials/bluecoat_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function bluecoatLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'bluecoat'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'bluecoatLogs', + name: i18n.translate('home.tutorials.bluecoatLogs.nameTitle', { + defaultMessage: 'Bluecoat logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.bluecoatLogs.shortDescription', { + defaultMessage: 'Collect Blue Coat Director logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.bluecoatLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Blue Coat Director logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-bluecoat.html', + }, + }), + euiIconType: 'logoLogging', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.bluecoatLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-bluecoat.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/cef_logs/index.ts b/src/plugins/home/server/tutorials/cef_logs/index.ts new file mode 100644 index 0000000000000..6395f0ae76d5e --- /dev/null +++ b/src/plugins/home/server/tutorials/cef_logs/index.ts @@ -0,0 +1,78 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function cefLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'cef'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'cefLogs', + name: i18n.translate('home.tutorials.cefLogs.nameTitle', { + defaultMessage: 'CEF logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.cefLogs.shortDescription', { + defaultMessage: 'Collect Common Event Format (CEF) log data over syslog.', + }), + longDescription: i18n.translate('home.tutorials.cefLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Common Event Format (CEF) data over \ + Syslog. When messages are received over the syslog protocol the syslog \ + input will parse the header and set the timestamp value. Then the \ + processor is applied to parse the CEF encoded data. The decoded data \ + is written into a `cef` object field. Lastly any Elastic Common Schema \ + (ECS) fields that can be populated with the CEF data are populated. \ + [Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-cef.html', + }, + }), + euiIconType: 'logoLogging', + artifacts: { + dashboards: [ + { + id: 'dd0bc9af-2e89-4150-9b42-62517ea56b71', + linkLabel: i18n.translate('home.tutorials.cefLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'CEF Network Overview Dashboard', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-cef.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/checkpoint_logs/index.ts b/src/plugins/home/server/tutorials/checkpoint_logs/index.ts new file mode 100644 index 0000000000000..ed7051f63a32f --- /dev/null +++ b/src/plugins/home/server/tutorials/checkpoint_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function checkpointLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'checkpoint'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'checkpointLogs', + name: i18n.translate('home.tutorials.checkpointLogs.nameTitle', { + defaultMessage: 'Check Point logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.checkpointLogs.shortDescription', { + defaultMessage: 'Collect Check Point firewall logs.', + }), + longDescription: i18n.translate('home.tutorials.checkpointLogs.longDescription', { + defaultMessage: + 'This is a module for Check Point firewall logs. It supports logs from the Log Exporter in the Syslog format. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-checkpoint.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/checkpoint.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.checkpointLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-checkpoint.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/cisco_logs/index.ts b/src/plugins/home/server/tutorials/cisco_logs/index.ts index b771744a069c3..b60a2137d680e 100644 --- a/src/plugins/home/server/tutorials/cisco_logs/index.ts +++ b/src/plugins/home/server/tutorials/cisco_logs/index.ts @@ -35,17 +35,16 @@ export function ciscoLogsSpecProvider(context: TutorialContext): TutorialSchema return { id: 'ciscoLogs', name: i18n.translate('home.tutorials.ciscoLogs.nameTitle', { - defaultMessage: 'Cisco', + defaultMessage: 'Cisco logs', }), moduleName, category: TutorialsCategory.SECURITY_SOLUTION, shortDescription: i18n.translate('home.tutorials.ciscoLogs.shortDescription', { - defaultMessage: 'Collect and parse logs received from Cisco ASA firewalls.', + defaultMessage: 'Collect Cisco network device logs over syslog or from a file.', }), longDescription: i18n.translate('home.tutorials.ciscoLogs.longDescription', { defaultMessage: - 'This is a module for Cisco network device’s logs. Currently \ -supports the "asa" fileset for Cisco ASA firewall logs received over syslog or read from a file. \ + 'This is a module for Cisco network devices logs (ASA, FTD, IOS, Nexus). It includes the following filesets for receiving logs over syslog or read from a file: \ [Learn more]({learnMoreLink}).', values: { learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-cisco.html', @@ -53,13 +52,15 @@ supports the "asa" fileset for Cisco ASA firewall logs received over syslog or r }), euiIconType: '/plugins/home/assets/logos/cisco.svg', artifacts: { - dashboards: [], - application: { - path: '/app/security', - label: i18n.translate('home.tutorials.ciscoLogs.artifacts.dashboards.linkLabel', { - defaultMessage: 'Security App', - }), - }, + dashboards: [ + { + id: 'a555b160-4987-11e9-b8ce-ed898b5ef295', + linkLabel: i18n.translate('home.tutorials.ciscoLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'ASA Firewall Dashboard', + }), + isOverview: true, + }, + ], exportedFields: { documentationUrl: '{config.docs.beats.filebeat}/exported-fields-cisco.html', }, diff --git a/src/plugins/home/server/tutorials/coredns_logs/index.ts b/src/plugins/home/server/tutorials/coredns_logs/index.ts index 7fc8a2402d216..13467e628c7fb 100644 --- a/src/plugins/home/server/tutorials/coredns_logs/index.ts +++ b/src/plugins/home/server/tutorials/coredns_logs/index.ts @@ -31,7 +31,7 @@ import { export function corednsLogsSpecProvider(context: TutorialContext): TutorialSchema { const moduleName = 'coredns'; - const platforms = ['OSX', 'DEB', 'RPM'] as const; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; return { id: 'corednsLogs', name: i18n.translate('home.tutorials.corednsLogs.nameTitle', { @@ -40,12 +40,11 @@ export function corednsLogsSpecProvider(context: TutorialContext): TutorialSchem moduleName, category: TutorialsCategory.SECURITY_SOLUTION, shortDescription: i18n.translate('home.tutorials.corednsLogs.shortDescription', { - defaultMessage: 'Collect the logs created by Coredns.', + defaultMessage: 'Collect CoreDNS logs.', }), longDescription: i18n.translate('home.tutorials.corednsLogs.longDescription', { defaultMessage: - 'The `coredns` Filebeat module collects the logs from \ -[CoreDNS](https://coredns.io/manual/toc/). \ + 'This is a filebeat module for CoreDNS. It supports both standalone CoreDNS deployment and CoreDNS deployment in Kubernetes. \ [Learn more]({learnMoreLink}).', values: { learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-coredns.html', @@ -57,7 +56,7 @@ export function corednsLogsSpecProvider(context: TutorialContext): TutorialSchem { id: '53aa1f70-443e-11e9-8548-ab7fbe04f038', linkLabel: i18n.translate('home.tutorials.corednsLogs.artifacts.dashboards.linkLabel', { - defaultMessage: 'CoreDNS logs dashboard', + defaultMessage: '[Filebeat CoreDNS] Overview', }), isOverview: true, }, @@ -67,7 +66,7 @@ export function corednsLogsSpecProvider(context: TutorialContext): TutorialSchem }, }, completionTimeMinutes: 10, - previewImagePath: '/plugins/home/assets/coredns_logs/screenshot.jpg', + previewImagePath: '/plugins/home/assets/coredns_logs/screenshot.png', onPrem: onPremInstructions(moduleName, platforms, context), elasticCloud: cloudInstructions(moduleName, platforms), onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), diff --git a/src/plugins/home/server/tutorials/crowdstrike_logs/index.ts b/src/plugins/home/server/tutorials/crowdstrike_logs/index.ts new file mode 100644 index 0000000000000..e4dd2bc6bb9c2 --- /dev/null +++ b/src/plugins/home/server/tutorials/crowdstrike_logs/index.ts @@ -0,0 +1,74 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function crowdstrikeLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'crowdstrike'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'crowdstrikeLogs', + name: i18n.translate('home.tutorials.crowdstrikeLogs.nameTitle', { + defaultMessage: 'CrowdStrike logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.crowdstrikeLogs.shortDescription', { + defaultMessage: 'Collect CrowdStrike Falcon logs using the Falcon SIEM Connector.', + }), + longDescription: i18n.translate('home.tutorials.crowdstrikeLogs.longDescription', { + defaultMessage: + 'This is the Filebeat module for CrowdStrike Falcon using the Falcon \ + [SIEM Connector](https://www.crowdstrike.com/blog/tech-center/integrate-with-your-siem). \ + This module collects this data, converts it to ECS, and ingests it to view in the SIEM. \ + By default, the Falcon SIEM connector outputs JSON formatted Falcon Streaming API event data. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-crowdstrike.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/crowdstrike.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.crowdstrikeLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-crowdstrike.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/cylance_logs/index.ts b/src/plugins/home/server/tutorials/cylance_logs/index.ts new file mode 100644 index 0000000000000..387a56febb83b --- /dev/null +++ b/src/plugins/home/server/tutorials/cylance_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function cylanceLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'cylance'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'cylanceLogs', + name: i18n.translate('home.tutorials.cylanceLogs.nameTitle', { + defaultMessage: 'CylancePROTECT logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.cylanceLogs.shortDescription', { + defaultMessage: 'Collect CylancePROTECT logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.cylanceLogs.longDescription', { + defaultMessage: + 'This is a module for receiving CylancePROTECT logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-cylance.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/cylance.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.cylanceLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-cylance.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/elasticsearch_logs/index.ts b/src/plugins/home/server/tutorials/elasticsearch_logs/index.ts index f6c280d29f67f..b30457ea7848b 100644 --- a/src/plugins/home/server/tutorials/elasticsearch_logs/index.ts +++ b/src/plugins/home/server/tutorials/elasticsearch_logs/index.ts @@ -65,6 +65,7 @@ export function elasticsearchLogsSpecProvider(context: TutorialContext): Tutoria }, }, completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/elasticsearch_logs/screenshot.png', onPrem: onPremInstructions(moduleName, platforms, context), elasticCloud: cloudInstructions(moduleName, platforms), onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), diff --git a/src/plugins/home/server/tutorials/envoyproxy_logs/index.ts b/src/plugins/home/server/tutorials/envoyproxy_logs/index.ts index 0cf032e6b90c1..94b5af143447f 100644 --- a/src/plugins/home/server/tutorials/envoyproxy_logs/index.ts +++ b/src/plugins/home/server/tutorials/envoyproxy_logs/index.ts @@ -35,17 +35,16 @@ export function envoyproxyLogsSpecProvider(context: TutorialContext): TutorialSc return { id: 'envoyproxyLogs', name: i18n.translate('home.tutorials.envoyproxyLogs.nameTitle', { - defaultMessage: 'Envoyproxy', + defaultMessage: 'Envoy Proxy logs', }), moduleName, category: TutorialsCategory.SECURITY_SOLUTION, shortDescription: i18n.translate('home.tutorials.envoyproxyLogs.shortDescription', { - defaultMessage: 'Collect and parse logs received from the Envoy proxy.', + defaultMessage: 'Collect Envoy Proxy logs.', }), longDescription: i18n.translate('home.tutorials.envoyproxyLogs.longDescription', { defaultMessage: - 'This is a filebeat module for [Envoy proxy access log](https://www.envoyproxy.io/docs/envoy/v1.10.0/configuration/access_log). \ -It supports both standalone deployment and Envoy proxy deployment in Kubernetes. \ + 'This is a Filebeat module for Envoy proxy access log ( https://www.envoyproxy.io/docs/envoy/v1.10.0/configuration/access_log). It supports both standalone deployment and Envoy proxy deployment in Kubernetes. \ [Learn more]({learnMoreLink}).', values: { learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-envoyproxy.html', @@ -53,13 +52,18 @@ It supports both standalone deployment and Envoy proxy deployment in Kubernetes. }), euiIconType: '/plugins/home/assets/logos/envoyproxy.svg', artifacts: { - dashboards: [], - application: { - path: '/app/security', - label: i18n.translate('home.tutorials.envoyproxyLogs.artifacts.dashboards.linkLabel', { - defaultMessage: 'Security App', - }), - }, + dashboards: [ + { + id: '0c610510-5cbd-11e9-8477-077ec9664dbd', + linkLabel: i18n.translate( + 'home.tutorials.envoyproxyLogs.artifacts.dashboards.linkLabel', + { + defaultMessage: 'Envoy Proxy Overview', + } + ), + isOverview: true, + }, + ], exportedFields: { documentationUrl: '{config.docs.beats.filebeat}/exported-fields-envoyproxy.html', }, diff --git a/src/plugins/home/server/tutorials/f5_logs/index.ts b/src/plugins/home/server/tutorials/f5_logs/index.ts new file mode 100644 index 0000000000000..4b4ae367ab46e --- /dev/null +++ b/src/plugins/home/server/tutorials/f5_logs/index.ts @@ -0,0 +1,72 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function f5LogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'f5'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'f5Logs', + name: i18n.translate('home.tutorials.f5Logs.nameTitle', { + defaultMessage: 'F5 logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.f5Logs.shortDescription', { + defaultMessage: 'Collect F5 Big-IP Access Policy Manager logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.f5Logs.longDescription', { + defaultMessage: + 'This is a module for receiving Big-IP Access Policy Manager logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-f5.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/f5.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.f5Logs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-f5.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/f5_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/fortinet_logs/index.ts b/src/plugins/home/server/tutorials/fortinet_logs/index.ts new file mode 100644 index 0000000000000..d60d383016295 --- /dev/null +++ b/src/plugins/home/server/tutorials/fortinet_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function fortinetLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'fortinet'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'fortinetLogs', + name: i18n.translate('home.tutorials.fortinetLogs.nameTitle', { + defaultMessage: 'Fortinet logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.fortinetLogs.shortDescription', { + defaultMessage: 'Collect Fortinet FortiOS logs over syslog.', + }), + longDescription: i18n.translate('home.tutorials.fortinetLogs.longDescription', { + defaultMessage: + 'This is a module for Fortinet FortiOS logs sent in the syslog format. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-fortinet.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/fortinet.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.fortinetLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-fortinet.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/googlecloud_logs/index.ts b/src/plugins/home/server/tutorials/googlecloud_logs/index.ts new file mode 100644 index 0000000000000..482ad38ddfbcd --- /dev/null +++ b/src/plugins/home/server/tutorials/googlecloud_logs/index.ts @@ -0,0 +1,79 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function googlecloudLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'googlecloud'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'googlecloudLogs', + name: i18n.translate('home.tutorials.googlecloudLogs.nameTitle', { + defaultMessage: 'Google Cloud logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.googlecloudLogs.shortDescription', { + defaultMessage: 'Collect Google Cloud audit, firewall, and VPC flow logs.', + }), + longDescription: i18n.translate('home.tutorials.googlecloudLogs.longDescription', { + defaultMessage: + 'This is a module for Google Cloud logs. It supports reading audit, VPC flow, \ + and firewall logs that have been exported from Stackdriver to a Google Pub/Sub \ + topic sink. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-googlecloud.html', + }, + }), + euiIconType: 'logoGoogleG', + artifacts: { + dashboards: [ + { + id: '6576c480-73a2-11ea-a345-f985c61fe654', + linkLabel: i18n.translate( + 'home.tutorials.googlecloudLogs.artifacts.dashboards.linkLabel', + { + defaultMessage: 'Audit Logs Dashbaord', + } + ), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-googlecloud.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/googlecloud_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/gsuite_logs/index.ts b/src/plugins/home/server/tutorials/gsuite_logs/index.ts new file mode 100644 index 0000000000000..0f7c0d7077d39 --- /dev/null +++ b/src/plugins/home/server/tutorials/gsuite_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function gsuiteLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'gsuite'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'gsuiteLogs', + name: i18n.translate('home.tutorials.gsuiteLogs.nameTitle', { + defaultMessage: 'GSuite logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.gsuiteLogs.shortDescription', { + defaultMessage: 'Collect GSuite activity reports.', + }), + longDescription: i18n.translate('home.tutorials.gsuiteLogs.longDescription', { + defaultMessage: + 'This is a module for ingesting data from the different GSuite audit reports APIs. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-gsuite.html', + }, + }), + euiIconType: 'logoGoogleG', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.gsuiteLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-gsuite.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/haproxy_logs/index.ts b/src/plugins/home/server/tutorials/haproxy_logs/index.ts new file mode 100644 index 0000000000000..82ef405ffe839 --- /dev/null +++ b/src/plugins/home/server/tutorials/haproxy_logs/index.ts @@ -0,0 +1,74 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function haproxyLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'haproxy'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'haproxyLogs', + name: i18n.translate('home.tutorials.haproxyLogs.nameTitle', { + defaultMessage: 'HAProxy logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.haproxyLogs.shortDescription', { + defaultMessage: 'Collect HAProxy logs.', + }), + longDescription: i18n.translate('home.tutorials.haproxyLogs.longDescription', { + defaultMessage: + 'The module collects and parses logs from a ( `haproxy`) process. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-haproxy.html', + }, + }), + euiIconType: 'logoHAproxy', + artifacts: { + dashboards: [ + { + id: '3560d580-aa34-11e8-9c06-877f0445e3e0-ecs', + linkLabel: i18n.translate('home.tutorials.haproxyLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'HAProxy Overview', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-haproxy.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/haproxy_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/icinga_logs/index.ts b/src/plugins/home/server/tutorials/icinga_logs/index.ts new file mode 100644 index 0000000000000..de494e5a15046 --- /dev/null +++ b/src/plugins/home/server/tutorials/icinga_logs/index.ts @@ -0,0 +1,74 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function icingaLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'icinga'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'icingaLogs', + name: i18n.translate('home.tutorials.icingaLogs.nameTitle', { + defaultMessage: 'Icinga logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.icingaLogs.shortDescription', { + defaultMessage: 'Collect Icinga main, debug, and startup logs.', + }), + longDescription: i18n.translate('home.tutorials.icingaLogs.longDescription', { + defaultMessage: + 'The module parses the main, debug, and startup logs of [Icinga](https://www.icinga.com/products/icinga-2/). \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-icinga.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/icinga.svg', + artifacts: { + dashboards: [ + { + id: 'f693d260-2417-11e7-a83b-d5f4cebac9ff-ecs', + linkLabel: i18n.translate('home.tutorials.icingaLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Icinga Main Log', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-icinga.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/icinga_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/imperva_logs/index.ts b/src/plugins/home/server/tutorials/imperva_logs/index.ts new file mode 100644 index 0000000000000..d723a4c2f49ef --- /dev/null +++ b/src/plugins/home/server/tutorials/imperva_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function impervaLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'imperva'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'impervaLogs', + name: i18n.translate('home.tutorials.impervaLogs.nameTitle', { + defaultMessage: 'Imperva logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.impervaLogs.shortDescription', { + defaultMessage: 'Collect Imperva SecureSphere logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.impervaLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Imperva SecureSphere logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-imperva.html', + }, + }), + euiIconType: 'logoLogging', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.impervaLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-imperva.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/infoblox_logs/index.ts b/src/plugins/home/server/tutorials/infoblox_logs/index.ts new file mode 100644 index 0000000000000..811f3110e7871 --- /dev/null +++ b/src/plugins/home/server/tutorials/infoblox_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function infobloxLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'infoblox'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'infobloxLogs', + name: i18n.translate('home.tutorials.infobloxLogs.nameTitle', { + defaultMessage: 'Infoblox logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.infobloxLogs.shortDescription', { + defaultMessage: 'Collect Infoblox NIOS logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.infobloxLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Infoblox NIOS logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-infoblox.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/infoblox.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.infobloxLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-infoblox.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/iptables_logs/index.ts b/src/plugins/home/server/tutorials/iptables_logs/index.ts index b3be133767447..dc44ae6107b1e 100644 --- a/src/plugins/home/server/tutorials/iptables_logs/index.ts +++ b/src/plugins/home/server/tutorials/iptables_logs/index.ts @@ -31,37 +31,39 @@ import { export function iptablesLogsSpecProvider(context: TutorialContext): TutorialSchema { const moduleName = 'iptables'; - const platforms = ['DEB', 'RPM'] as const; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; return { id: 'iptablesLogs', name: i18n.translate('home.tutorials.iptablesLogs.nameTitle', { - defaultMessage: 'Iptables / Ubiquiti', + defaultMessage: 'Iptables logs', }), moduleName, category: TutorialsCategory.SECURITY_SOLUTION, shortDescription: i18n.translate('home.tutorials.iptablesLogs.shortDescription', { - defaultMessage: 'Collect and parse iptables and ip6tables logs or from Ubiqiti firewalls.', + defaultMessage: 'Collect iptables and ip6tables logs.', }), longDescription: i18n.translate('home.tutorials.iptablesLogs.longDescription', { defaultMessage: - 'This is a module for iptables and ip6tables logs. It parses logs \ -received over the network via syslog or from a file. Also, it understands the \ -prefix added by some Ubiquiti firewalls, which includes the rule set name, rule \ -number and the action performed on the traffic (allow/deny).. \ -[Learn more]({learnMoreLink}).', + 'This is a module for iptables and ip6tables logs. It parses logs received \ + over the network via syslog or from a file. Also, it understands the prefix \ + added by some Ubiquiti firewalls, which includes the rule set name, rule \ + number and the action performed on the traffic (allow/deny). \ + [Learn more]({learnMoreLink}).', values: { learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-iptables.html', }, }), - euiIconType: '/plugins/home/assets/logos/ubiquiti.svg', + euiIconType: '/plugins/home/assets/logos/linux.svg', artifacts: { - dashboards: [], - application: { - path: '/app/security', - label: i18n.translate('home.tutorials.iptablesLogs.artifacts.dashboards.linkLabel', { - defaultMessage: 'Security App', - }), - }, + dashboards: [ + { + id: 'ceefb9e0-1f51-11e9-93ed-f7e068f4aebb-ecs', + linkLabel: i18n.translate('home.tutorials.iptablesLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Iptables Overview', + }), + isOverview: true, + }, + ], exportedFields: { documentationUrl: '{config.docs.beats.filebeat}/exported-fields-iptables.html', }, diff --git a/src/plugins/home/server/tutorials/juniper_logs/index.ts b/src/plugins/home/server/tutorials/juniper_logs/index.ts new file mode 100644 index 0000000000000..45688baa5bcdf --- /dev/null +++ b/src/plugins/home/server/tutorials/juniper_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function juniperLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'juniper'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'juniperLogs', + name: i18n.translate('home.tutorials.juniperLogs.nameTitle', { + defaultMessage: 'Juniper Logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.juniperLogs.shortDescription', { + defaultMessage: 'Collect Juniper JUNOS logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.juniperLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Juniper JUNOS logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-juniper.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/juniper.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.juniperLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-juniper.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/kibana_logs/index.ts b/src/plugins/home/server/tutorials/kibana_logs/index.ts new file mode 100644 index 0000000000000..88286a230f771 --- /dev/null +++ b/src/plugins/home/server/tutorials/kibana_logs/index.ts @@ -0,0 +1,70 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function kibanaLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'kibana'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'kibanaLogs', + name: i18n.translate('home.tutorials.kibanaLogs.nameTitle', { + defaultMessage: 'Kibana Logs', + }), + moduleName, + category: TutorialsCategory.LOGGING, + shortDescription: i18n.translate('home.tutorials.kibanaLogs.shortDescription', { + defaultMessage: 'Collect Kibana logs.', + }), + longDescription: i18n.translate('home.tutorials.kibanaLogs.longDescription', { + defaultMessage: 'This is the Kibana module. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-kibana.html', + }, + }), + euiIconType: 'logoKibana', + artifacts: { + dashboards: [], + application: { + label: i18n.translate('home.tutorials.kibanaLogs.artifacts.application.label', { + defaultMessage: 'Discover', + }), + path: '/app/discover#/', + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-kibana.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/logstash_logs/index.ts b/src/plugins/home/server/tutorials/logstash_logs/index.ts index 32982cd1055a4..6998aaf9001e6 100644 --- a/src/plugins/home/server/tutorials/logstash_logs/index.ts +++ b/src/plugins/home/server/tutorials/logstash_logs/index.ts @@ -38,13 +38,13 @@ export function logstashLogsSpecProvider(context: TutorialContext): TutorialSche defaultMessage: 'Logstash logs', }), moduleName, - category: TutorialsCategory.LOGGING, + category: TutorialsCategory.SECURITY_SOLUTION, shortDescription: i18n.translate('home.tutorials.logstashLogs.shortDescription', { - defaultMessage: 'Collect and parse debug and slow logs created by Logstash itself.', + defaultMessage: 'Collect Logstash main and slow logs.', }), longDescription: i18n.translate('home.tutorials.logstashLogs.longDescription', { defaultMessage: - 'The `logstash` Filebeat module parses debug and slow logs created by Logstash itself. \ + 'The modules parse Logstash regular logs and the slow log, it will support the plain text format and the JSON format. \ [Learn more]({learnMoreLink}).', values: { learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-logstash.html', @@ -56,7 +56,7 @@ export function logstashLogsSpecProvider(context: TutorialContext): TutorialSche { id: 'Filebeat-Logstash-Log-Dashboard-ecs', linkLabel: i18n.translate('home.tutorials.logstashLogs.artifacts.dashboards.linkLabel', { - defaultMessage: 'Logstash logs dashboard', + defaultMessage: 'Logstash Logs', }), isOverview: true, }, @@ -66,7 +66,6 @@ export function logstashLogsSpecProvider(context: TutorialContext): TutorialSche }, }, completionTimeMinutes: 10, - previewImagePath: '/plugins/home/assets/logstash_logs/screenshot.png', onPrem: onPremInstructions(moduleName, platforms, context), elasticCloud: cloudInstructions(moduleName, platforms), onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), diff --git a/src/plugins/home/server/tutorials/microsoft_logs/index.ts b/src/plugins/home/server/tutorials/microsoft_logs/index.ts new file mode 100644 index 0000000000000..28739a5817ae7 --- /dev/null +++ b/src/plugins/home/server/tutorials/microsoft_logs/index.ts @@ -0,0 +1,74 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function microsoftLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'microsoft'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'microsoftLogs', + name: i18n.translate('home.tutorials.microsoftLogs.nameTitle', { + defaultMessage: 'Microsoft Defender ATP logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.microsoftLogs.shortDescription', { + defaultMessage: 'Collect Microsoft Defender ATP alerts.', + }), + longDescription: i18n.translate('home.tutorials.microsoftLogs.longDescription', { + defaultMessage: + 'Collect Microsoft Defender ATP alerts for use with Elastic Security. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-microsoft.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/microsoft.svg', + artifacts: { + dashboards: [ + { + id: '65402c30-ca6a-11ea-9d4d-9737a63aaa55', + linkLabel: i18n.translate('home.tutorials.microsoftLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Microsoft ATP Overview', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-microsoft.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/microsoft_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/misp_logs/index.ts b/src/plugins/home/server/tutorials/misp_logs/index.ts new file mode 100644 index 0000000000000..050c22fb39523 --- /dev/null +++ b/src/plugins/home/server/tutorials/misp_logs/index.ts @@ -0,0 +1,74 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function mispLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'misp'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'mispLogs', + name: i18n.translate('home.tutorials.mispLogs.nameTitle', { + defaultMessage: 'MISP threat intel logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.mispLogs.shortDescription', { + defaultMessage: 'Collect MISP threat intelligence data with Filebeat.', + }), + longDescription: i18n.translate('home.tutorials.mispLogs.longDescription', { + defaultMessage: + 'This is a filebeat module for reading threat intel information from the MISP platform ( https://www.circl.lu/doc/misp/). It uses the httpjson input to access the MISP REST API interface. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-misp.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/misp.svg', + artifacts: { + dashboards: [ + { + id: 'c6cac9e0-f105-11e9-9a88-690b10c8ee99', + linkLabel: i18n.translate('home.tutorials.mispLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'MISP Overview', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-misp.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/misp_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/mongodb_logs/index.ts b/src/plugins/home/server/tutorials/mongodb_logs/index.ts new file mode 100644 index 0000000000000..1c8db19a3873b --- /dev/null +++ b/src/plugins/home/server/tutorials/mongodb_logs/index.ts @@ -0,0 +1,74 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function mongodbLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'mongodb'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'mongodbLogs', + name: i18n.translate('home.tutorials.mongodbLogs.nameTitle', { + defaultMessage: 'MongoDB logs', + }), + moduleName, + category: TutorialsCategory.LOGGING, + shortDescription: i18n.translate('home.tutorials.mongodbLogs.shortDescription', { + defaultMessage: 'Collect MongoDB logs.', + }), + longDescription: i18n.translate('home.tutorials.mongodbLogs.longDescription', { + defaultMessage: + 'The module collects and parses logs created by [MongoDB](https://www.mongodb.com/). \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-mongodb.html', + }, + }), + euiIconType: 'logoMongodb', + artifacts: { + dashboards: [ + { + id: 'abcf35b0-0a82-11e8-bffe-ff7d4f68cf94-ecs', + linkLabel: i18n.translate('home.tutorials.mongodbLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'MongoDB Overview', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-mongodb.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/mongodb_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/mssql_logs/index.ts b/src/plugins/home/server/tutorials/mssql_logs/index.ts new file mode 100644 index 0000000000000..8a18da20f2e6a --- /dev/null +++ b/src/plugins/home/server/tutorials/mssql_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function mssqlLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'mssql'; + const platforms = ['DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'mssqlLogs', + name: i18n.translate('home.tutorials.mssqlLogs.nameTitle', { + defaultMessage: 'MSSQL logs', + }), + moduleName, + category: TutorialsCategory.LOGGING, + shortDescription: i18n.translate('home.tutorials.mssqlLogs.shortDescription', { + defaultMessage: 'Collect MSSQL logs.', + }), + longDescription: i18n.translate('home.tutorials.mssqlLogs.longDescription', { + defaultMessage: + 'The module parses error logs created by MSSQL. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-mssql.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/microsoft.svg', + artifacts: { + dashboards: [], + application: { + label: i18n.translate('home.tutorials.mssqlLogs.artifacts.application.label', { + defaultMessage: 'Discover', + }), + path: '/app/discover#/', + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-mssql.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/netflow/common_instructions.ts b/src/plugins/home/server/tutorials/netflow/common_instructions.ts deleted file mode 100644 index 8fe24ba9c7994..0000000000000 --- a/src/plugins/home/server/tutorials/netflow/common_instructions.ts +++ /dev/null @@ -1,281 +0,0 @@ -/* - * Licensed to Elasticsearch B.V. under one or more contributor - * license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright - * ownership. Elasticsearch B.V. licenses this file to you under - * the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -import { i18n } from '@kbn/i18n'; - -export function createCommonNetflowInstructions() { - return { - CONFIG: { - ON_PREM: { - OSX: [ - { - title: i18n.translate('home.tutorials.netflow.common.config.onPrem.osxTitle', { - defaultMessage: 'Edit the configuration', - }), - textPre: i18n.translate('home.tutorials.netflow.common.config.onPrem.osxTextPre', { - defaultMessage: 'Modify {logstashConfigPath} to set the configuration parameters:', - values: { - logstashConfigPath: '`config/logstash.yml`', - }, - }), - commands: ['modules:', ' - name: netflow', ' var.input.udp.port: '], - textPost: i18n.translate('home.tutorials.netflow.common.config.onPrem.osxTextPost', { - defaultMessage: - 'Where {udpPort} is the UDP port on which Logstash will receive Netflow data.', - values: { - udpPort: '``', - }, - }), - }, - ], - WINDOWS: [ - { - title: i18n.translate('home.tutorials.netflow.common.config.onPrem.windowsTitle', { - defaultMessage: 'Edit the configuration', - }), - textPre: i18n.translate('home.tutorials.netflow.common.config.onPrem.windowsTextPre', { - defaultMessage: 'Modify {logstashConfigPath} to set the configuration parameters:', - values: { - logstashConfigPath: '`config\\logstash.yml`', - }, - }), - commands: ['modules:', ' - name: netflow', ' var.input.udp.port: '], - textPost: i18n.translate( - 'home.tutorials.netflow.common.config.onPrem.windowsTextPost', - { - defaultMessage: - 'Where {udpPort} is the UDP port on which Logstash will receive Netflow data.', - values: { - udpPort: '``', - }, - } - ), - }, - ], - }, - ON_PREM_ELASTIC_CLOUD: { - OSX: [ - { - title: i18n.translate( - 'home.tutorials.netflow.common.config.onPremElasticCloud.osxTitle', - { - defaultMessage: 'Edit the configuration', - } - ), - textPre: i18n.translate( - 'home.tutorials.netflow.common.config.onPremElasticCloud.osxTextPre', - { - defaultMessage: 'Modify {logstashConfigPath} to set the configuration parameters:', - values: { - logstashConfigPath: '`config/logstash.yml`', - }, - } - ), - commands: [ - 'modules:', - ' - name: netflow', - ' var.input.udp.port: ', - ' var.elasticsearch.hosts: [ "" ]', - ' var.elasticsearch.username: elastic', - ' var.elasticsearch.password: ', - ], - textPost: i18n.translate( - 'home.tutorials.netflow.common.config.onPremElasticCloud.osxTextPost', - { - defaultMessage: - 'Where {udpPort} is the UDP port on which Logstash will receive Netflow data, \ - {esUrl} is the URL of Elasticsearch running on Elastic Cloud, and \ - {password} is the password of the {elastic} user.', - values: { - elastic: '`elastic`', - esUrl: '``', - password: '``', - udpPort: '``', - }, - } - ), - }, - ], - WINDOWS: [ - { - title: i18n.translate( - 'home.tutorials.netflow.common.config.onPremElasticCloud.windowsTitle', - { - defaultMessage: 'Edit the configuration', - } - ), - textPre: i18n.translate( - 'home.tutorials.netflow.common.config.onPremElasticCloud.windowsTextPre', - { - defaultMessage: 'Modify {logstashConfigPath} to set the configuration parameters:', - values: { - logstashConfigPath: '`config\\logstash.yml`', - }, - } - ), - commands: [ - 'modules:', - ' - name: netflow', - ' var.input.udp.port: ', - ' var.elasticsearch.hosts: [ "" ]', - ' var.elasticsearch.username: elastic', - ' var.elasticsearch.password: ', - ], - textPost: i18n.translate( - 'home.tutorials.netflow.common.config.onPremElasticCloud.windowsTextPost', - { - defaultMessage: - 'Where {udpPort} is the UDP port on which Logstash will receive Netflow data, \ - {esUrl} is the URL of Elasticsearch running on Elastic Cloud, and \ - {password} is the password of the {elastic} user.', - values: { - elastic: '`elastic`', - esUrl: '``', - password: '``', - udpPort: '``', - }, - } - ), - }, - ], - }, - ELASTIC_CLOUD: { - OSX: [ - { - title: i18n.translate('home.tutorials.netflow.common.config.elasticCloud.osxTitle', { - defaultMessage: 'Edit the configuration', - }), - textPre: i18n.translate( - 'home.tutorials.netflow.common.config.elasticCloud.osxTextPre', - { - defaultMessage: 'Modify {logstashConfigPath} to set the configuration parameters:', - values: { - logstashConfigPath: '`config/logstash.yml`', - }, - } - ), - commands: [ - 'cloud.id: "{config.cloud.id}"', - 'cloud.auth: "elastic:"', - ' ', - 'modules:', - ' - name: netflow', - ' var.input.udp.port: ', - ], - textPost: i18n.translate( - 'home.tutorials.netflow.common.config.elasticCloud.osxTextPost', - { - defaultMessage: - 'Where {udpPort} is the UDP port on which Logstash will receive Netflow data and \ - {password} is the password of the {elastic} user.', - values: { - elastic: '`elastic`', - password: '``', - udpPort: '``', - }, - } - ), - }, - ], - WINDOWS: [ - { - title: i18n.translate( - 'home.tutorials.netflow.common.config.elasticCloud.windowsTitle', - { - defaultMessage: 'Edit the configuration', - } - ), - textPre: i18n.translate( - 'home.tutorials.netflow.common.config.elasticCloud.windowsTextPre', - { - defaultMessage: 'Modify {logstashConfigPath} to set the configuration parameters:', - values: { - logstashConfigPath: '`config\\logstash.yml`', - }, - } - ), - commands: [ - 'cloud.id: "{config.cloud.id}"', - 'cloud.auth: "elastic:"', - ' ', - 'modules:', - ' - name: netflow', - ' var.input.udp.port: ', - ], - textPost: i18n.translate( - 'home.tutorials.netflow.common.config.elasticCloud.windowsTextPost', - { - defaultMessage: - 'Where {udpPort} is the UDP port on which Logstash will receive Netflow data and \ - {password} is the password of the {elastic} user.', - values: { - elastic: '`elastic`', - password: '``', - udpPort: '``', - }, - } - ), - }, - ], - }, - }, - SETUP: { - OSX: [ - { - title: i18n.translate('home.tutorials.netflow.common.setup.osxTitle', { - defaultMessage: 'Run the Netflow module', - }), - textPre: i18n.translate('home.tutorials.netflow.common.setup.osxTextPre', { - defaultMessage: 'Run:', - }), - commands: ['./bin/logstash --modules netflow --setup'], - textPost: i18n.translate('home.tutorials.netflow.common.setup.osxTextPost', { - defaultMessage: - 'The {setupOption} option creates a {netflowPrefix} index pattern in Elasticsearch and imports \ - Kibana dashboards and visualizations. Omit this option for subsequent runs to avoid overwriting existing dashboards.', - values: { - setupOption: '`--setup`', - netflowPrefix: '`netflow-*`', - }, - }), - }, - ], - WINDOWS: [ - { - title: i18n.translate('home.tutorials.netflow.common.setup.windowsTitle', { - defaultMessage: 'Run the Netflow module', - }), - textPre: i18n.translate('home.tutorials.netflow.common.setup.windowsTextPre', { - defaultMessage: 'Run:', - }), - commands: ['bin\\logstash --modules netflow --setup'], - textPost: i18n.translate('home.tutorials.netflow.common.setup.windowsTextPost', { - defaultMessage: - 'The {setupOption} option creates a {netflowPrefix} index pattern in Elasticsearch and imports \ - Kibana dashboards and visualizations. Omit this option for subsequent runs to avoid overwriting existing dashboards.', - values: { - setupOption: '`--setup`', - netflowPrefix: '`netflow-*`', - }, - }), - }, - ], - }, - }; -} diff --git a/src/plugins/home/server/tutorials/netflow/elastic_cloud.ts b/src/plugins/home/server/tutorials/netflow/elastic_cloud.ts deleted file mode 100644 index fbedc6abfbb8a..0000000000000 --- a/src/plugins/home/server/tutorials/netflow/elastic_cloud.ts +++ /dev/null @@ -1,58 +0,0 @@ -/* - * Licensed to Elasticsearch B.V. under one or more contributor - * license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright - * ownership. Elasticsearch B.V. licenses this file to you under - * the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -import { i18n } from '@kbn/i18n'; - -import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant'; -import { createLogstashInstructions } from '../instructions/logstash_instructions'; -import { createCommonNetflowInstructions } from './common_instructions'; - -// TODO: compare with onPremElasticCloud and onPrem scenarios and extract out common bits -export function createElasticCloudInstructions() { - const COMMON_NETFLOW_INSTRUCTIONS = createCommonNetflowInstructions(); - const LOGSTASH_INSTRUCTIONS = createLogstashInstructions(); - - return { - instructionSets: [ - { - title: i18n.translate('home.tutorials.netflow.elasticCloudInstructions.title', { - defaultMessage: 'Getting Started', - }), - instructionVariants: [ - { - id: INSTRUCTION_VARIANT.OSX, - instructions: [ - ...LOGSTASH_INSTRUCTIONS.INSTALL.OSX, - ...COMMON_NETFLOW_INSTRUCTIONS.CONFIG.ELASTIC_CLOUD.OSX, - ...COMMON_NETFLOW_INSTRUCTIONS.SETUP.OSX, - ], - }, - { - id: INSTRUCTION_VARIANT.WINDOWS, - instructions: [ - ...LOGSTASH_INSTRUCTIONS.INSTALL.WINDOWS, - ...COMMON_NETFLOW_INSTRUCTIONS.CONFIG.ELASTIC_CLOUD.WINDOWS, - ...COMMON_NETFLOW_INSTRUCTIONS.SETUP.WINDOWS, - ], - }, - ], - }, - ], - }; -} diff --git a/src/plugins/home/server/tutorials/netflow/index.ts b/src/plugins/home/server/tutorials/netflow/index.ts deleted file mode 100644 index 5be30bbb152b7..0000000000000 --- a/src/plugins/home/server/tutorials/netflow/index.ts +++ /dev/null @@ -1,52 +0,0 @@ -/* - * Licensed to Elasticsearch B.V. under one or more contributor - * license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright - * ownership. Elasticsearch B.V. licenses this file to you under - * the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -import { i18n } from '@kbn/i18n'; - -import { TutorialsCategory } from '../../services/tutorials'; -import { createOnPremInstructions } from './on_prem'; -import { createElasticCloudInstructions } from './elastic_cloud'; -import { createOnPremElasticCloudInstructions } from './on_prem_elastic_cloud'; - -export function netflowSpecProvider() { - const moduleName = 'netflow'; - return { - id: 'netflow', - name: 'Netflow', - moduleName, - category: TutorialsCategory.SECURITY_SOLUTION, - shortDescription: i18n.translate('home.tutorials.netflow.tutorialShortDescription', { - defaultMessage: 'Collect Netflow records sent by a Netflow exporter.', - }), - longDescription: i18n.translate('home.tutorials.netflow.tutorialLongDescription', { - defaultMessage: - 'The Logstash Netflow module collects and parses network flow data, \ -indexes the events into Elasticsearch, and installs a suite of Kibana dashboards. \ -This module support Netflow Version 5 and 9. [Learn more]({linkUrl}).', - values: { - linkUrl: '{config.docs.logstash}/netflow-module.html', - }, - }), - completionTimeMinutes: 10, - // previewImagePath: 'kibana-apache.png', TODO - onPrem: createOnPremInstructions(), - elasticCloud: createElasticCloudInstructions(), - onPremElasticCloud: createOnPremElasticCloudInstructions(), - }; -} diff --git a/src/plugins/home/server/tutorials/netflow/on_prem.ts b/src/plugins/home/server/tutorials/netflow/on_prem.ts deleted file mode 100644 index ef8c3e172af87..0000000000000 --- a/src/plugins/home/server/tutorials/netflow/on_prem.ts +++ /dev/null @@ -1,58 +0,0 @@ -/* - * Licensed to Elasticsearch B.V. under one or more contributor - * license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright - * ownership. Elasticsearch B.V. licenses this file to you under - * the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -import { i18n } from '@kbn/i18n'; - -import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant'; -import { createLogstashInstructions } from '../instructions/logstash_instructions'; -import { createCommonNetflowInstructions } from './common_instructions'; - -// TODO: compare with onPremElasticCloud and elasticCloud scenarios and extract out common bits -export function createOnPremInstructions() { - const COMMON_NETFLOW_INSTRUCTIONS = createCommonNetflowInstructions(); - const LOGSTASH_INSTRUCTIONS = createLogstashInstructions(); - - return { - instructionSets: [ - { - title: i18n.translate('home.tutorials.netflow.onPremInstructions.title', { - defaultMessage: 'Getting Started', - }), - instructionVariants: [ - { - id: INSTRUCTION_VARIANT.OSX, - instructions: [ - ...LOGSTASH_INSTRUCTIONS.INSTALL.OSX, - ...COMMON_NETFLOW_INSTRUCTIONS.CONFIG.ON_PREM.OSX, - ...COMMON_NETFLOW_INSTRUCTIONS.SETUP.OSX, - ], - }, - { - id: INSTRUCTION_VARIANT.WINDOWS, - instructions: [ - ...LOGSTASH_INSTRUCTIONS.INSTALL.WINDOWS, - ...COMMON_NETFLOW_INSTRUCTIONS.CONFIG.ON_PREM.WINDOWS, - ...COMMON_NETFLOW_INSTRUCTIONS.SETUP.WINDOWS, - ], - }, - ], - }, - ], - }; -} diff --git a/src/plugins/home/server/tutorials/netflow/on_prem_elastic_cloud.ts b/src/plugins/home/server/tutorials/netflow/on_prem_elastic_cloud.ts deleted file mode 100644 index 85aa694970491..0000000000000 --- a/src/plugins/home/server/tutorials/netflow/on_prem_elastic_cloud.ts +++ /dev/null @@ -1,68 +0,0 @@ -/* - * Licensed to Elasticsearch B.V. under one or more contributor - * license agreements. See the NOTICE file distributed with - * this work for additional information regarding copyright - * ownership. Elasticsearch B.V. licenses this file to you under - * the Apache License, Version 2.0 (the "License"); you may - * not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, - * software distributed under the License is distributed on an - * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY - * KIND, either express or implied. See the License for the - * specific language governing permissions and limitations - * under the License. - */ - -import { i18n } from '@kbn/i18n'; - -import { INSTRUCTION_VARIANT } from '../../../common/instruction_variant'; -import { createLogstashInstructions } from '../instructions/logstash_instructions'; -import { - createTrycloudOption1, - createTrycloudOption2, -} from '../instructions/onprem_cloud_instructions'; -import { createCommonNetflowInstructions } from './common_instructions'; - -// TODO: compare with onPrem and elasticCloud scenarios and extract out common bits -export function createOnPremElasticCloudInstructions() { - const COMMON_NETFLOW_INSTRUCTIONS = createCommonNetflowInstructions(); - const TRYCLOUD_OPTION1 = createTrycloudOption1(); - const TRYCLOUD_OPTION2 = createTrycloudOption2(); - const LOGSTASH_INSTRUCTIONS = createLogstashInstructions(); - - return { - instructionSets: [ - { - title: i18n.translate('home.tutorials.netflow.onPremElasticCloudInstructions.title', { - defaultMessage: 'Getting Started', - }), - instructionVariants: [ - { - id: INSTRUCTION_VARIANT.OSX, - instructions: [ - TRYCLOUD_OPTION1, - TRYCLOUD_OPTION2, - ...LOGSTASH_INSTRUCTIONS.INSTALL.OSX, - ...COMMON_NETFLOW_INSTRUCTIONS.CONFIG.ON_PREM_ELASTIC_CLOUD.OSX, - ...COMMON_NETFLOW_INSTRUCTIONS.SETUP.OSX, - ], - }, - { - id: INSTRUCTION_VARIANT.WINDOWS, - instructions: [ - TRYCLOUD_OPTION1, - TRYCLOUD_OPTION2, - ...LOGSTASH_INSTRUCTIONS.INSTALL.WINDOWS, - ...COMMON_NETFLOW_INSTRUCTIONS.CONFIG.ON_PREM_ELASTIC_CLOUD.WINDOWS, - ...COMMON_NETFLOW_INSTRUCTIONS.SETUP.WINDOWS, - ], - }, - ], - }, - ], - }; -} diff --git a/src/plugins/home/server/tutorials/netflow_logs/index.ts b/src/plugins/home/server/tutorials/netflow_logs/index.ts new file mode 100644 index 0000000000000..0e36bcafae580 --- /dev/null +++ b/src/plugins/home/server/tutorials/netflow_logs/index.ts @@ -0,0 +1,73 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function netflowLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'netflow'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'netflowLogs', + name: i18n.translate('home.tutorials.netflowLogs.nameTitle', { + defaultMessage: 'NetFlow / IPFIX Collector', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.netflowLogs.shortDescription', { + defaultMessage: 'Collect NetFlow and IPFIX flow records.', + }), + longDescription: i18n.translate('home.tutorials.netflowLogs.longDescription', { + defaultMessage: + 'This is a module for receiving NetFlow and IPFIX flow records over UDP. This input supports NetFlow versions 1, 5, 6, 7, 8 and 9, as well as IPFIX. For NetFlow versions older than 9, fields are mapped automatically to NetFlow v9. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-netflow.html', + }, + }), + euiIconType: 'logoBeats', + artifacts: { + dashboards: [ + { + id: '34e26884-161a-4448-9556-43b5bf2f62a2', + linkLabel: i18n.translate('home.tutorials.netflowLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Netflow Overview', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-netflow.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/netscout_logs/index.ts b/src/plugins/home/server/tutorials/netscout_logs/index.ts new file mode 100644 index 0000000000000..b94e0df0bf795 --- /dev/null +++ b/src/plugins/home/server/tutorials/netscout_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function netscoutLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'netscout'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'netscoutLogs', + name: i18n.translate('home.tutorials.netscoutLogs.nameTitle', { + defaultMessage: 'Arbor Peakflow logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.netscoutLogs.shortDescription', { + defaultMessage: 'Collect Netscout Arbor Peakflow SP logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.netscoutLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Arbor Peakflow SP logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-netscout.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/netscout.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.netscoutLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-netscout.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/o365_logs/index.ts b/src/plugins/home/server/tutorials/o365_logs/index.ts new file mode 100644 index 0000000000000..2ee3f3550a0d7 --- /dev/null +++ b/src/plugins/home/server/tutorials/o365_logs/index.ts @@ -0,0 +1,77 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function o365LogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'o365'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'o365Logs', + name: i18n.translate('home.tutorials.o365Logs.nameTitle', { + defaultMessage: 'Office 365 logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.o365Logs.shortDescription', { + defaultMessage: 'Collect Office 365 activity logs via the Office 365 API.', + }), + longDescription: i18n.translate('home.tutorials.o365Logs.longDescription', { + defaultMessage: + 'This is a module for Office 365 logs received via one of the Office 365 \ + API endpoints. It currently supports user, admin, system, and policy \ + actions and events from Office 365 and Azure AD activity logs exposed \ + by the Office 365 Management Activity API. \ + [Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-o365.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/o365.svg', + artifacts: { + dashboards: [ + { + id: '712e2c00-685d-11ea-8d6a-292ef5d68366', + linkLabel: i18n.translate('home.tutorials.o365Logs.artifacts.dashboards.linkLabel', { + defaultMessage: 'O365 Audit Dashboard', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-o365.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/o365_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/okta_logs/index.ts b/src/plugins/home/server/tutorials/okta_logs/index.ts new file mode 100644 index 0000000000000..6371d9848af2e --- /dev/null +++ b/src/plugins/home/server/tutorials/okta_logs/index.ts @@ -0,0 +1,75 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function oktaLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'okta'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'oktaLogs', + name: i18n.translate('home.tutorials.oktaLogs.nameTitle', { + defaultMessage: 'Okta logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.oktaLogs.shortDescription', { + defaultMessage: 'Collect the Okta system log via the Okta API.', + }), + longDescription: i18n.translate('home.tutorials.oktaLogs.longDescription', { + defaultMessage: + 'The Okta module collects events from the [Okta API](https://developer.okta.com/docs/reference/). \ + Specifically this supports reading from the [Okta System Log API](https://developer.okta.com/docs/reference/api/system-log/). \ + [Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-okta.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/okta.svg', + artifacts: { + dashboards: [ + { + id: '749203a0-67b1-11ea-a76f-bf44814e437d', + linkLabel: i18n.translate('home.tutorials.oktaLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Okta Overview', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-okta.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/okta_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/oracle_metrics/index.ts b/src/plugins/home/server/tutorials/oracle_metrics/index.ts index d2ddd19b930a2..4fd946c08e58a 100644 --- a/src/plugins/home/server/tutorials/oracle_metrics/index.ts +++ b/src/plugins/home/server/tutorials/oracle_metrics/index.ts @@ -51,6 +51,7 @@ export function oracleMetricsSpecProvider(context: TutorialContext): TutorialSch learnMoreLink: '{config.docs.beats.metricbeat}/metricbeat-module-' + moduleName + '.html', }, }), + euiIconType: '/plugins/home/assets/logos/oracle.svg', artifacts: { application: { label: i18n.translate('home.tutorials.oracleMetrics.artifacts.application.label', { diff --git a/src/plugins/home/server/tutorials/osquery_logs/index.ts b/src/plugins/home/server/tutorials/osquery_logs/index.ts index c4869a889a085..1d98b30b324ce 100644 --- a/src/plugins/home/server/tutorials/osquery_logs/index.ts +++ b/src/plugins/home/server/tutorials/osquery_logs/index.ts @@ -40,23 +40,27 @@ export function osqueryLogsSpecProvider(context: TutorialContext): TutorialSchem moduleName, category: TutorialsCategory.SECURITY_SOLUTION, shortDescription: i18n.translate('home.tutorials.osqueryLogs.shortDescription', { - defaultMessage: 'Collect the result logs created by osqueryd.', + defaultMessage: 'Collect osquery logs in JSON format.', }), longDescription: i18n.translate('home.tutorials.osqueryLogs.longDescription', { defaultMessage: - 'The `osquery` Filebeat module collects the JSON result logs collected by `osqueryd`. \ -[Learn more]({learnMoreLink}).', + 'The module collects and decodes the result logs written by \ + [osqueryd](https://osquery.readthedocs.io/en/latest/introduction/using-osqueryd/) in \ + the JSON format. To set up osqueryd follow the osquery installation instructions for \ + your operating system and configure the `filesystem` logging driver (the default). \ + Make sure UTC timestamps are enabled. \ + [Learn more]({learnMoreLink}).', values: { learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-osquery.html', }, }), - euiIconType: 'logoOsquery', + euiIconType: '/plugins/home/assets/logos/osquery.svg', artifacts: { dashboards: [ { id: '69f5ae20-eb02-11e7-8f04-51231daa5b05-ecs', linkLabel: i18n.translate('home.tutorials.osqueryLogs.artifacts.dashboards.linkLabel', { - defaultMessage: 'Osquery logs dashboard', + defaultMessage: 'Osquery Compliance Pack', }), isOverview: true, }, @@ -66,7 +70,6 @@ export function osqueryLogsSpecProvider(context: TutorialContext): TutorialSchem }, }, completionTimeMinutes: 10, - previewImagePath: '/plugins/home/assets/osquery_logs/screenshot.png', onPrem: onPremInstructions(moduleName, platforms, context), elasticCloud: cloudInstructions(moduleName, platforms), onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), diff --git a/src/plugins/home/server/tutorials/panw_logs/index.ts b/src/plugins/home/server/tutorials/panw_logs/index.ts new file mode 100644 index 0000000000000..5a0da7538b4c0 --- /dev/null +++ b/src/plugins/home/server/tutorials/panw_logs/index.ts @@ -0,0 +1,77 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function panwLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'panw'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'panwLogs', + name: i18n.translate('home.tutorials.panwLogs.nameTitle', { + defaultMessage: 'Palo Alto Networks PAN-OS logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.panwLogs.shortDescription', { + defaultMessage: + 'Collect Palo Alto Networks PAN-OS threat and traffic logs over syslog or from a log file.', + }), + longDescription: i18n.translate('home.tutorials.panwLogs.longDescription', { + defaultMessage: + 'This is a module for Palo Alto Networks PAN-OS firewall monitoring \ + logs received over Syslog or read from a file. It currently supports \ + messages of Traffic and Threat types. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-panw.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/paloalto.svg', + artifacts: { + dashboards: [ + { + id: 'e40ba240-7572-11e9-976e-65a8f47cc4c1', + linkLabel: i18n.translate('home.tutorials.panwLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'PANW Network Flows', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-panw.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/panw_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/rabbitmq_logs/index.ts b/src/plugins/home/server/tutorials/rabbitmq_logs/index.ts new file mode 100644 index 0000000000000..2676f8b52306c --- /dev/null +++ b/src/plugins/home/server/tutorials/rabbitmq_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function rabbitmqLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'rabbitmq'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'rabbitmqLogs', + name: i18n.translate('home.tutorials.rabbitmqLogs.nameTitle', { + defaultMessage: 'RabbitMQ logs', + }), + moduleName, + category: TutorialsCategory.LOGGING, + shortDescription: i18n.translate('home.tutorials.rabbitmqLogs.shortDescription', { + defaultMessage: 'Collect RabbitMQ logs.', + }), + longDescription: i18n.translate('home.tutorials.rabbitmqLogs.longDescription', { + defaultMessage: + 'This is the module for parsing [RabbitMQ log files](https://www.rabbitmq.com/logging.html) \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-rabbitmq.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/rabbitmq.svg', + artifacts: { + dashboards: [], + application: { + label: i18n.translate('home.tutorials.rabbitmqLogs.artifacts.application.label', { + defaultMessage: 'Discover', + }), + path: '/app/discover#/', + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-rabbitmq.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/radware_logs/index.ts b/src/plugins/home/server/tutorials/radware_logs/index.ts new file mode 100644 index 0000000000000..10f32c7b767ab --- /dev/null +++ b/src/plugins/home/server/tutorials/radware_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function radwareLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'radware'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'radwareLogs', + name: i18n.translate('home.tutorials.radwareLogs.nameTitle', { + defaultMessage: 'Radware DefensePro logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.radwareLogs.shortDescription', { + defaultMessage: 'Collect Radware DefensePro logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.radwareLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Radware DefensePro logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-radware.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/radware.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.radwareLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-radware.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/register.ts b/src/plugins/home/server/tutorials/register.ts index c48423edb2a07..67e9f5a406803 100644 --- a/src/plugins/home/server/tutorials/register.ts +++ b/src/plugins/home/server/tutorials/register.ts @@ -16,82 +16,115 @@ * specific language governing permissions and limitations * under the License. */ -import { systemLogsSpecProvider } from './system_logs'; -import { systemMetricsSpecProvider } from './system_metrics'; +import { activemqLogsSpecProvider } from './activemq_logs'; +import { activemqMetricsSpecProvider } from './activemq_metrics'; +import { aerospikeMetricsSpecProvider } from './aerospike_metrics'; import { apacheLogsSpecProvider } from './apache_logs'; import { apacheMetricsSpecProvider } from './apache_metrics'; +import { auditbeatSpecProvider } from './auditbeat'; +import { auditdLogsSpecProvider } from './auditd_logs'; +import { awsLogsSpecProvider } from './aws_logs'; +import { awsMetricsSpecProvider } from './aws_metrics'; +import { azureLogsSpecProvider } from './azure_logs'; +import { azureMetricsSpecProvider } from './azure_metrics'; +import { barracudaLogsSpecProvider } from './barracuda_logs'; +import { bluecoatLogsSpecProvider } from './bluecoat_logs'; +import { cefLogsSpecProvider } from './cef_logs'; +import { cephMetricsSpecProvider } from './ceph_metrics'; +import { checkpointLogsSpecProvider } from './checkpoint_logs'; +import { ciscoLogsSpecProvider } from './cisco_logs'; +import { cloudwatchLogsSpecProvider } from './cloudwatch_logs'; +import { cockroachdbMetricsSpecProvider } from './cockroachdb_metrics'; +import { consulMetricsSpecProvider } from './consul_metrics'; +import { corednsLogsSpecProvider } from './coredns_logs'; +import { corednsMetricsSpecProvider } from './coredns_metrics'; +import { couchbaseMetricsSpecProvider } from './couchbase_metrics'; +import { couchdbMetricsSpecProvider } from './couchdb_metrics'; +import { crowdstrikeLogsSpecProvider } from './crowdstrike_logs'; +import { cylanceLogsSpecProvider } from './cylance_logs'; +import { dockerMetricsSpecProvider } from './docker_metrics'; +import { dropwizardMetricsSpecProvider } from './dropwizard_metrics'; import { elasticsearchLogsSpecProvider } from './elasticsearch_logs'; +import { elasticsearchMetricsSpecProvider } from './elasticsearch_metrics'; +import { envoyproxyLogsSpecProvider } from './envoyproxy_logs'; +import { envoyproxyMetricsSpecProvider } from './envoyproxy_metrics'; +import { etcdMetricsSpecProvider } from './etcd_metrics'; +import { f5LogsSpecProvider } from './f5_logs'; +import { fortinetLogsSpecProvider } from './fortinet_logs'; +import { golangMetricsSpecProvider } from './golang_metrics'; +import { googlecloudLogsSpecProvider } from './googlecloud_logs'; +import { googlecloudMetricsSpecProvider } from './googlecloud_metrics'; +import { gsuiteLogsSpecProvider } from './gsuite_logs'; +import { haproxyLogsSpecProvider } from './haproxy_logs'; +import { haproxyMetricsSpecProvider } from './haproxy_metrics'; +import { ibmmqLogsSpecProvider } from './ibmmq_logs'; +import { ibmmqMetricsSpecProvider } from './ibmmq_metrics'; +import { icingaLogsSpecProvider } from './icinga_logs'; import { iisLogsSpecProvider } from './iis_logs'; +import { iisMetricsSpecProvider } from './iis_metrics'; +import { impervaLogsSpecProvider } from './imperva_logs'; +import { infobloxLogsSpecProvider } from './infoblox_logs'; +import { iptablesLogsSpecProvider } from './iptables_logs'; +import { juniperLogsSpecProvider } from './juniper_logs'; import { kafkaLogsSpecProvider } from './kafka_logs'; +import { kafkaMetricsSpecProvider } from './kafka_metrics'; +import { kibanaLogsSpecProvider } from './kibana_logs'; +import { kibanaMetricsSpecProvider } from './kibana_metrics'; +import { kubernetesMetricsSpecProvider } from './kubernetes_metrics'; import { logstashLogsSpecProvider } from './logstash_logs'; -import { nginxLogsSpecProvider } from './nginx_logs'; -import { nginxMetricsSpecProvider } from './nginx_metrics'; +import { logstashMetricsSpecProvider } from './logstash_metrics'; +import { memcachedMetricsSpecProvider } from './memcached_metrics'; +import { microsoftLogsSpecProvider } from './microsoft_logs'; +import { mispLogsSpecProvider } from './misp_logs'; +import { mongodbLogsSpecProvider } from './mongodb_logs'; +import { mongodbMetricsSpecProvider } from './mongodb_metrics'; +import { mssqlLogsSpecProvider } from './mssql_logs'; +import { mssqlMetricsSpecProvider } from './mssql_metrics'; +import { muninMetricsSpecProvider } from './munin_metrics'; import { mysqlLogsSpecProvider } from './mysql_logs'; import { mysqlMetricsSpecProvider } from './mysql_metrics'; -import { mongodbMetricsSpecProvider } from './mongodb_metrics'; +import { natsLogsSpecProvider } from './nats_logs'; +import { natsMetricsSpecProvider } from './nats_metrics'; +import { netflowLogsSpecProvider } from './netflow_logs'; +import { netscoutLogsSpecProvider } from './netscout_logs'; +import { nginxLogsSpecProvider } from './nginx_logs'; +import { nginxMetricsSpecProvider } from './nginx_metrics'; +import { o365LogsSpecProvider } from './o365_logs'; +import { oktaLogsSpecProvider } from './okta_logs'; +import { openmetricsMetricsSpecProvider } from './openmetrics_metrics'; +import { oracleMetricsSpecProvider } from './oracle_metrics'; import { osqueryLogsSpecProvider } from './osquery_logs'; +import { panwLogsSpecProvider } from './panw_logs'; import { phpfpmMetricsSpecProvider } from './php_fpm_metrics'; -import { postgresqlMetricsSpecProvider } from './postgresql_metrics'; import { postgresqlLogsSpecProvider } from './postgresql_logs'; +import { postgresqlMetricsSpecProvider } from './postgresql_metrics'; +import { prometheusMetricsSpecProvider } from './prometheus_metrics'; +import { rabbitmqLogsSpecProvider } from './rabbitmq_logs'; import { rabbitmqMetricsSpecProvider } from './rabbitmq_metrics'; +import { radwareLogsSpecProvider } from './radware_logs'; import { redisLogsSpecProvider } from './redis_logs'; import { redisMetricsSpecProvider } from './redis_metrics'; +import { redisenterpriseMetricsSpecProvider } from './redisenterprise_metrics'; +import { santaLogsSpecProvider } from './santa_logs'; +import { sonicwallLogsSpecProvider } from './sonicwall_logs'; +import { sophosLogsSpecProvider } from './sophos_logs'; +import { squidLogsSpecProvider } from './squid_logs'; +import { stanMetricsSpecProvider } from './stan_metrics'; +import { statsdMetricsSpecProvider } from './statsd_metrics'; import { suricataLogsSpecProvider } from './suricata_logs'; -import { dockerMetricsSpecProvider } from './docker_metrics'; -import { kubernetesMetricsSpecProvider } from './kubernetes_metrics'; -import { uwsgiMetricsSpecProvider } from './uwsgi_metrics'; -import { netflowSpecProvider } from './netflow'; +import { systemLogsSpecProvider } from './system_logs'; +import { systemMetricsSpecProvider } from './system_metrics'; +import { tomcatLogsSpecProvider } from './tomcat_logs'; import { traefikLogsSpecProvider } from './traefik_logs'; -import { cephMetricsSpecProvider } from './ceph_metrics'; -import { aerospikeMetricsSpecProvider } from './aerospike_metrics'; -import { couchbaseMetricsSpecProvider } from './couchbase_metrics'; -import { dropwizardMetricsSpecProvider } from './dropwizard_metrics'; -import { elasticsearchMetricsSpecProvider } from './elasticsearch_metrics'; -import { etcdMetricsSpecProvider } from './etcd_metrics'; -import { haproxyMetricsSpecProvider } from './haproxy_metrics'; -import { kafkaMetricsSpecProvider } from './kafka_metrics'; -import { kibanaMetricsSpecProvider } from './kibana_metrics'; -import { memcachedMetricsSpecProvider } from './memcached_metrics'; -import { muninMetricsSpecProvider } from './munin_metrics'; +import { traefikMetricsSpecProvider } from './traefik_metrics'; +import { uptimeMonitorsSpecProvider } from './uptime_monitors'; +import { uwsgiMetricsSpecProvider } from './uwsgi_metrics'; import { vSphereMetricsSpecProvider } from './vsphere_metrics'; -import { windowsMetricsSpecProvider } from './windows_metrics'; import { windowsEventLogsSpecProvider } from './windows_event_logs'; -import { golangMetricsSpecProvider } from './golang_metrics'; -import { logstashMetricsSpecProvider } from './logstash_metrics'; -import { prometheusMetricsSpecProvider } from './prometheus_metrics'; -import { zookeeperMetricsSpecProvider } from './zookeeper_metrics'; -import { uptimeMonitorsSpecProvider } from './uptime_monitors'; -import { cloudwatchLogsSpecProvider } from './cloudwatch_logs'; -import { awsMetricsSpecProvider } from './aws_metrics'; -import { mssqlMetricsSpecProvider } from './mssql_metrics'; -import { natsMetricsSpecProvider } from './nats_metrics'; -import { natsLogsSpecProvider } from './nats_logs'; +import { windowsMetricsSpecProvider } from './windows_metrics'; import { zeekLogsSpecProvider } from './zeek_logs'; -import { corednsMetricsSpecProvider } from './coredns_metrics'; -import { corednsLogsSpecProvider } from './coredns_logs'; -import { auditbeatSpecProvider } from './auditbeat'; -import { iptablesLogsSpecProvider } from './iptables_logs'; -import { ciscoLogsSpecProvider } from './cisco_logs'; -import { envoyproxyLogsSpecProvider } from './envoyproxy_logs'; -import { couchdbMetricsSpecProvider } from './couchdb_metrics'; -import { consulMetricsSpecProvider } from './consul_metrics'; -import { cockroachdbMetricsSpecProvider } from './cockroachdb_metrics'; -import { traefikMetricsSpecProvider } from './traefik_metrics'; -import { awsLogsSpecProvider } from './aws_logs'; -import { activemqLogsSpecProvider } from './activemq_logs'; -import { activemqMetricsSpecProvider } from './activemq_metrics'; -import { azureMetricsSpecProvider } from './azure_metrics'; -import { ibmmqLogsSpecProvider } from './ibmmq_logs'; -import { stanMetricsSpecProvider } from './stan_metrics'; -import { envoyproxyMetricsSpecProvider } from './envoyproxy_metrics'; -import { ibmmqMetricsSpecProvider } from './ibmmq_metrics'; -import { statsdMetricsSpecProvider } from './statsd_metrics'; -import { redisenterpriseMetricsSpecProvider } from './redisenterprise_metrics'; -import { openmetricsMetricsSpecProvider } from './openmetrics_metrics'; -import { oracleMetricsSpecProvider } from './oracle_metrics'; -import { iisMetricsSpecProvider } from './iis_metrics'; -import { azureLogsSpecProvider } from './azure_logs'; -import { googlecloudMetricsSpecProvider } from './googlecloud_metrics'; +import { zookeeperMetricsSpecProvider } from './zookeeper_metrics'; +import { zscalerLogsSpecProvider } from './zscaler_logs'; export const builtInTutorials = [ systemLogsSpecProvider, @@ -118,7 +151,7 @@ export const builtInTutorials = [ dockerMetricsSpecProvider, kubernetesMetricsSpecProvider, uwsgiMetricsSpecProvider, - netflowSpecProvider, + netflowLogsSpecProvider, traefikLogsSpecProvider, cephMetricsSpecProvider, aerospikeMetricsSpecProvider, @@ -170,4 +203,37 @@ export const builtInTutorials = [ iisMetricsSpecProvider, azureLogsSpecProvider, googlecloudMetricsSpecProvider, + auditdLogsSpecProvider, + barracudaLogsSpecProvider, + bluecoatLogsSpecProvider, + cefLogsSpecProvider, + checkpointLogsSpecProvider, + crowdstrikeLogsSpecProvider, + cylanceLogsSpecProvider, + f5LogsSpecProvider, + fortinetLogsSpecProvider, + googlecloudLogsSpecProvider, + gsuiteLogsSpecProvider, + haproxyLogsSpecProvider, + icingaLogsSpecProvider, + impervaLogsSpecProvider, + infobloxLogsSpecProvider, + juniperLogsSpecProvider, + kibanaLogsSpecProvider, + microsoftLogsSpecProvider, + mispLogsSpecProvider, + mongodbLogsSpecProvider, + mssqlLogsSpecProvider, + netscoutLogsSpecProvider, + o365LogsSpecProvider, + oktaLogsSpecProvider, + panwLogsSpecProvider, + rabbitmqLogsSpecProvider, + radwareLogsSpecProvider, + santaLogsSpecProvider, + sonicwallLogsSpecProvider, + sophosLogsSpecProvider, + squidLogsSpecProvider, + tomcatLogsSpecProvider, + zscalerLogsSpecProvider, ]; diff --git a/src/plugins/home/server/tutorials/santa_logs/index.ts b/src/plugins/home/server/tutorials/santa_logs/index.ts new file mode 100644 index 0000000000000..3cdab67a08b57 --- /dev/null +++ b/src/plugins/home/server/tutorials/santa_logs/index.ts @@ -0,0 +1,75 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function santaLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'santa'; + const platforms = ['OSX'] as const; + return { + id: 'santaLogs', + name: i18n.translate('home.tutorials.santaLogs.nameTitle', { + defaultMessage: 'Google Santa logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.santaLogs.shortDescription', { + defaultMessage: 'Collect Google Santa logs about process executions on MacOS.', + }), + longDescription: i18n.translate('home.tutorials.santaLogs.longDescription', { + defaultMessage: + 'The module collects and parses logs from [Google Santa](https://github.com/google/santa), \ + a security tool for macOS that monitors process executions and can blacklist/whitelist binaries. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-santa.html', + }, + }), + euiIconType: 'logoLogging', + artifacts: { + dashboards: [ + { + id: '161855f0-ff6a-11e8-93c5-d5ecd1b3e307-ecs', + linkLabel: i18n.translate('home.tutorials.santaLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Santa Overview', + }), + isOverview: true, + }, + ], + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-santa.html', + }, + }, + completionTimeMinutes: 10, + previewImagePath: '/plugins/home/assets/santa_logs/screenshot.png', + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/sonicwall_logs/index.ts b/src/plugins/home/server/tutorials/sonicwall_logs/index.ts new file mode 100644 index 0000000000000..49cfa694f3888 --- /dev/null +++ b/src/plugins/home/server/tutorials/sonicwall_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function sonicwallLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'sonicwall'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'sonicwallLogs', + name: i18n.translate('home.tutorials.sonicwallLogs.nameTitle', { + defaultMessage: 'Sonicwall FW logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.sonicwallLogs.shortDescription', { + defaultMessage: 'Collect Sonicwall-FW logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.sonicwallLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Sonicwall-FW logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-sonicwall.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/sonicwall.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.radwareLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-sonicwall.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/sophos_logs/index.ts b/src/plugins/home/server/tutorials/sophos_logs/index.ts new file mode 100644 index 0000000000000..0c732fe954d3b --- /dev/null +++ b/src/plugins/home/server/tutorials/sophos_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function sophosLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'sophos'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'sophosLogs', + name: i18n.translate('home.tutorials.sophosLogs.nameTitle', { + defaultMessage: 'Sophos logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.sophosLogs.shortDescription', { + defaultMessage: 'Collect Sophos XG SFOS logs over syslog.', + }), + longDescription: i18n.translate('home.tutorials.sophosLogs.longDescription', { + defaultMessage: + 'This is a module for Sophos Products, currently it supports XG SFOS logs sent in the syslog format. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-sophos.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/sophos.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.sophosLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-sophos.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/squid_logs/index.ts b/src/plugins/home/server/tutorials/squid_logs/index.ts new file mode 100644 index 0000000000000..c697f728b8e0e --- /dev/null +++ b/src/plugins/home/server/tutorials/squid_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function squidLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'squid'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'squidLogs', + name: i18n.translate('home.tutorials.squidLogs.nameTitle', { + defaultMessage: 'Squid logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.squidLogs.shortDescription', { + defaultMessage: 'Collect Squid logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.squidLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Squid logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-squid.html', + }, + }), + euiIconType: 'logoLogging', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.squidLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-squid.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/suricata_logs/index.ts b/src/plugins/home/server/tutorials/suricata_logs/index.ts index eec81b9496647..85ea3062f8b6d 100644 --- a/src/plugins/home/server/tutorials/suricata_logs/index.ts +++ b/src/plugins/home/server/tutorials/suricata_logs/index.ts @@ -40,13 +40,13 @@ export function suricataLogsSpecProvider(context: TutorialContext): TutorialSche moduleName, category: TutorialsCategory.SECURITY_SOLUTION, shortDescription: i18n.translate('home.tutorials.suricataLogs.shortDescription', { - defaultMessage: 'Collect the result logs created by Suricata IDS/IPS/NSM.', + defaultMessage: 'Collect Suricata IDS/IPS/NSM logs.', }), longDescription: i18n.translate('home.tutorials.suricataLogs.longDescription', { defaultMessage: - 'The `suricata` Filebeat module collects the logs from the \ -[Suricata Eve JSON output](https://suricata.readthedocs.io/en/latest/output/eve/eve-json-format.html). \ -[Learn more]({learnMoreLink}).', + 'This is a module to the Suricata IDS/IPS/NSM log. It parses logs that are \ + in the [Suricata Eve JSON format](https://suricata.readthedocs.io/en/latest/output/eve/eve-json-format.html). \ + [Learn more]({learnMoreLink}).', values: { learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-suricata.html', }, @@ -55,9 +55,9 @@ export function suricataLogsSpecProvider(context: TutorialContext): TutorialSche artifacts: { dashboards: [ { - id: '69f5ae20-eb02-11e7-8f04-51231daa5b05', + id: '78289c40-86da-11e8-b59d-21efb914e65c-ecs', linkLabel: i18n.translate('home.tutorials.suricataLogs.artifacts.dashboards.linkLabel', { - defaultMessage: 'Suricata logs dashboard', + defaultMessage: 'Suricata Events Overview', }), isOverview: true, }, diff --git a/src/plugins/home/server/tutorials/system_logs/index.ts b/src/plugins/home/server/tutorials/system_logs/index.ts index f39df25461a5f..f94098399938f 100644 --- a/src/plugins/home/server/tutorials/system_logs/index.ts +++ b/src/plugins/home/server/tutorials/system_logs/index.ts @@ -31,33 +31,32 @@ import { export function systemLogsSpecProvider(context: TutorialContext): TutorialSchema { const moduleName = 'system'; - const platforms = ['OSX', 'DEB', 'RPM'] as const; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; return { id: 'systemLogs', name: i18n.translate('home.tutorials.systemLogs.nameTitle', { defaultMessage: 'System logs', }), moduleName, - category: TutorialsCategory.LOGGING, + category: TutorialsCategory.SECURITY_SOLUTION, shortDescription: i18n.translate('home.tutorials.systemLogs.shortDescription', { - defaultMessage: 'Collect and parse logs written by the local Syslog server.', + defaultMessage: 'Collect system logs of common Unix/Linux based distributions.', }), longDescription: i18n.translate('home.tutorials.systemLogs.longDescription', { defaultMessage: - 'The `system` Filebeat module collects and parses logs created by the system logging service of common \ -Unix/Linux based distributions. This module is not available on Windows. \ + 'The module collects and parses logs created by the system logging service of common Unix/Linux based distributions. \ [Learn more]({learnMoreLink}).', values: { learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-system.html', }, }), - euiIconType: '/plugins/home/assets/logos/system.svg', + euiIconType: 'logoLogging', artifacts: { dashboards: [ { id: 'Filebeat-syslog-dashboard-ecs', linkLabel: i18n.translate('home.tutorials.systemLogs.artifacts.dashboards.linkLabel', { - defaultMessage: 'System logs dashboard', + defaultMessage: 'System Syslog Dashboard', }), isOverview: true, }, @@ -67,7 +66,6 @@ Unix/Linux based distributions. This module is not available on Windows. \ }, }, completionTimeMinutes: 10, - previewImagePath: '/plugins/home/assets/system_logs/screenshot.png', onPrem: onPremInstructions(moduleName, platforms, context), elasticCloud: cloudInstructions(moduleName, platforms), onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), diff --git a/src/plugins/home/server/tutorials/tomcat_logs/index.ts b/src/plugins/home/server/tutorials/tomcat_logs/index.ts new file mode 100644 index 0000000000000..4b3c9f7357719 --- /dev/null +++ b/src/plugins/home/server/tutorials/tomcat_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function tomcatLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'tomcat'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'tomcatLogs', + name: i18n.translate('home.tutorials.tomcatLogs.nameTitle', { + defaultMessage: 'Tomcat logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.tomcatLogs.shortDescription', { + defaultMessage: 'Collect Apache Tomcat logs over syslog or from a file.', + }), + longDescription: i18n.translate('home.tutorials.tomcatLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Apache Tomcat logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-tomcat.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/tomcat.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.tomcatLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-tomcat.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/src/plugins/home/server/tutorials/traefik_logs/index.ts b/src/plugins/home/server/tutorials/traefik_logs/index.ts index 0a84dcb081883..8bcc806ad59a0 100644 --- a/src/plugins/home/server/tutorials/traefik_logs/index.ts +++ b/src/plugins/home/server/tutorials/traefik_logs/index.ts @@ -38,13 +38,13 @@ export function traefikLogsSpecProvider(context: TutorialContext): TutorialSchem defaultMessage: 'Traefik logs', }), moduleName, - category: TutorialsCategory.LOGGING, + category: TutorialsCategory.SECURITY_SOLUTION, shortDescription: i18n.translate('home.tutorials.traefikLogs.shortDescription', { - defaultMessage: 'Collect and parse access logs created by the Traefik Proxy.', + defaultMessage: 'Collect Traefik access logs.', }), longDescription: i18n.translate('home.tutorials.traefikLogs.longDescription', { defaultMessage: - 'The `traefik` Filebeat module parses access logs created by Traefik. \ + 'The module parses access logs created by [Træfik](https://traefik.io/). \ [Learn more]({learnMoreLink}).', values: { learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-traefik.html', @@ -56,7 +56,7 @@ export function traefikLogsSpecProvider(context: TutorialContext): TutorialSchem { id: 'Filebeat-Traefik-Dashboard-ecs', linkLabel: i18n.translate('home.tutorials.traefikLogs.artifacts.dashboards.linkLabel', { - defaultMessage: 'Traefik logs dashboard', + defaultMessage: 'Traefik Access Logs', }), isOverview: true, }, @@ -66,7 +66,6 @@ export function traefikLogsSpecProvider(context: TutorialContext): TutorialSchem }, }, completionTimeMinutes: 10, - previewImagePath: '/plugins/home/assets/traefik_logs/screenshot.png', onPrem: onPremInstructions(moduleName, platforms, context), elasticCloud: cloudInstructions(moduleName, platforms), onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), diff --git a/src/plugins/home/server/tutorials/zeek_logs/index.ts b/src/plugins/home/server/tutorials/zeek_logs/index.ts index e39dcd3409490..dbc07d27b4f8a 100644 --- a/src/plugins/home/server/tutorials/zeek_logs/index.ts +++ b/src/plugins/home/server/tutorials/zeek_logs/index.ts @@ -31,7 +31,7 @@ import { export function zeekLogsSpecProvider(context: TutorialContext): TutorialSchema { const moduleName = 'zeek'; - const platforms = ['OSX', 'DEB', 'RPM'] as const; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; return { id: 'zeekLogs', name: i18n.translate('home.tutorials.zeekLogs.nameTitle', { @@ -40,13 +40,13 @@ export function zeekLogsSpecProvider(context: TutorialContext): TutorialSchema { moduleName, category: TutorialsCategory.SECURITY_SOLUTION, shortDescription: i18n.translate('home.tutorials.zeekLogs.shortDescription', { - defaultMessage: 'Collect the logs created by Zeek/Bro.', + defaultMessage: 'Collect Zeek network security monitoring logs.', }), longDescription: i18n.translate('home.tutorials.zeekLogs.longDescription', { defaultMessage: - 'The `zeek` Filebeat module collects the logs from \ -[Zeek](https://www.zeek.org//documentation/index.html). \ -[Learn more]({learnMoreLink}).', + 'This is a module for Zeek, which used to be called Bro. It parses logs \ + that are in the [Zeek JSON format](https://www.zeek.org/manual/release/logs/index.html). \ + [Learn more]({learnMoreLink}).', values: { learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-zeek.html', }, @@ -57,7 +57,7 @@ export function zeekLogsSpecProvider(context: TutorialContext): TutorialSchema { { id: '7cbb5410-3700-11e9-aa6d-ff445a78330c', linkLabel: i18n.translate('home.tutorials.zeekLogs.artifacts.dashboards.linkLabel', { - defaultMessage: 'Zeek logs dashboard', + defaultMessage: 'Zeek Overview', }), isOverview: true, }, diff --git a/src/plugins/home/server/tutorials/zscaler_logs/index.ts b/src/plugins/home/server/tutorials/zscaler_logs/index.ts new file mode 100644 index 0000000000000..800702fe7da96 --- /dev/null +++ b/src/plugins/home/server/tutorials/zscaler_logs/index.ts @@ -0,0 +1,71 @@ +/* + * Licensed to Elasticsearch B.V. under one or more contributor + * license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright + * ownership. Elasticsearch B.V. licenses this file to you under + * the Apache License, Version 2.0 (the "License"); you may + * not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ + +import { i18n } from '@kbn/i18n'; +import { TutorialsCategory } from '../../services/tutorials'; +import { + onPremInstructions, + cloudInstructions, + onPremCloudInstructions, +} from '../instructions/filebeat_instructions'; +import { + TutorialContext, + TutorialSchema, +} from '../../services/tutorials/lib/tutorials_registry_types'; + +export function zscalerLogsSpecProvider(context: TutorialContext): TutorialSchema { + const moduleName = 'zscaler'; + const platforms = ['OSX', 'DEB', 'RPM', 'WINDOWS'] as const; + return { + id: 'zscalerLogs', + name: i18n.translate('home.tutorials.zscalerLogs.nameTitle', { + defaultMessage: 'Zscaler Logs', + }), + moduleName, + category: TutorialsCategory.SECURITY_SOLUTION, + shortDescription: i18n.translate('home.tutorials.zscalerLogs.shortDescription', { + defaultMessage: 'This is a module for receiving Zscaler NSS logs over Syslog or a file.', + }), + longDescription: i18n.translate('home.tutorials.zscalerLogs.longDescription', { + defaultMessage: + 'This is a module for receiving Zscaler NSS logs over Syslog or a file. \ +[Learn more]({learnMoreLink}).', + values: { + learnMoreLink: '{config.docs.beats.filebeat}/filebeat-module-zscaler.html', + }, + }), + euiIconType: '/plugins/home/assets/logos/zscaler.svg', + artifacts: { + dashboards: [], + application: { + path: '/app/security', + label: i18n.translate('home.tutorials.zscalerLogs.artifacts.dashboards.linkLabel', { + defaultMessage: 'Security App', + }), + }, + exportedFields: { + documentationUrl: '{config.docs.beats.filebeat}/exported-fields-zscaler.html', + }, + }, + completionTimeMinutes: 10, + onPrem: onPremInstructions(moduleName, platforms, context), + elasticCloud: cloudInstructions(moduleName, platforms), + onPremElasticCloud: onPremCloudInstructions(moduleName, platforms), + }; +} diff --git a/test/functional/apps/home/_add_data.js b/test/functional/apps/home/_add_data.js index 6ba123e579f7a..401a5becceb30 100644 --- a/test/functional/apps/home/_add_data.js +++ b/test/functional/apps/home/_add_data.js @@ -28,7 +28,7 @@ export default function ({ getService, getPageObjects }) { await PageObjects.common.navigateToUrl('home', 'tutorial_directory', { useActualUrl: true }); await PageObjects.header.waitUntilLoadingHasFinished(); await retry.try(async () => { - const tutorialExists = await PageObjects.home.doesSynopsisExist('netflow'); + const tutorialExists = await PageObjects.home.doesSynopsisExist('netflowlogs'); expect(tutorialExists).to.be(true); }); }); diff --git a/x-pack/plugins/translations/translations/ja-JP.json b/x-pack/plugins/translations/translations/ja-JP.json index 37b49ee0c2d47..22b2bc059739c 100644 --- a/x-pack/plugins/translations/translations/ja-JP.json +++ b/x-pack/plugins/translations/translations/ja-JP.json @@ -2162,35 +2162,6 @@ "home.tutorials.natsMetrics.longDescription": "Metricbeat モジュール「nats」は、Nats から監視メトリックを取得します。[詳細] {learnMoreLink})。", "home.tutorials.natsMetrics.nameTitle": "NATSメトリック", "home.tutorials.natsMetrics.shortDescription": "Nats サーバーから監視メトリックを取得します。", - "home.tutorials.netflow.common.config.elasticCloud.osxTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートで、{password} は {elastic} ユーザーのパスワードです。", - "home.tutorials.netflow.common.config.elasticCloud.osxTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.elasticCloud.osxTitle": "構成を編集する", - "home.tutorials.netflow.common.config.elasticCloud.windowsTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートで、{password} は {elastic} ユーザーのパスワードです。", - "home.tutorials.netflow.common.config.elasticCloud.windowsTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.elasticCloud.windowsTitle": "構成を編集する", - "home.tutorials.netflow.common.config.onPrem.osxTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートです。", - "home.tutorials.netflow.common.config.onPrem.osxTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.onPrem.osxTitle": "構成を編集する", - "home.tutorials.netflow.common.config.onPrem.windowsTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートです。", - "home.tutorials.netflow.common.config.onPrem.windowsTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.onPrem.windowsTitle": "構成を編集する", - "home.tutorials.netflow.common.config.onPremElasticCloud.osxTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートで、{esUrl} は Elastic Cloud で実行中の Elasticsearch の URL で、{password} は {elastic} ユーザーのパスワードです。", - "home.tutorials.netflow.common.config.onPremElasticCloud.osxTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.onPremElasticCloud.osxTitle": "構成を編集する", - "home.tutorials.netflow.common.config.onPremElasticCloud.windowsTextPost": "{udpPort} は Logstash が Netflow データを受信する UDP ポートで、{esUrl} は Elastic Cloud で実行中の Elasticsearch の URL で、{password} は {elastic} ユーザーのパスワードです。", - "home.tutorials.netflow.common.config.onPremElasticCloud.windowsTextPre": "{logstashConfigPath} を編集して構成パラメーターを設定します。", - "home.tutorials.netflow.common.config.onPremElasticCloud.windowsTitle": "構成を編集する", - "home.tutorials.netflow.common.setup.osxTextPost": "{setupOption} オプションは Elasticsearch で {netflowPrefix} インデックスパターンを作成し、Kibana のダッシュボードとビジュアライゼーションをインポートします。以降の実行時に既存のダッシュボードに上書きしないよう、このオプションを省略します。", - "home.tutorials.netflow.common.setup.osxTextPre": "実行:", - "home.tutorials.netflow.common.setup.osxTitle": "Netflow モジュールを実行", - "home.tutorials.netflow.common.setup.windowsTextPost": "{setupOption} オプションは Elasticsearch で {netflowPrefix} インデックスパターンを作成し、Kibana のダッシュボードとビジュアライゼーションをインポートします。以降の実行時に既存のダッシュボードに上書きしないよう、このオプションを省略します。", - "home.tutorials.netflow.common.setup.windowsTextPre": "実行:", - "home.tutorials.netflow.common.setup.windowsTitle": "Netflow モジュールを実行", - "home.tutorials.netflow.elasticCloudInstructions.title": "はじめに", - "home.tutorials.netflow.onPremElasticCloudInstructions.title": "はじめに", - "home.tutorials.netflow.onPremInstructions.title": "はじめに", - "home.tutorials.netflow.tutorialLongDescription": "Logstash NetFlow モジュールは、ネットワークフローデータを収集してパースしたり、イベントを Elasticsearch でインデックスしたり、Kibana ダッシュボードをインストールしたりできます。このモジュールは Netflow バージョン 5 と 9 をサポートしています。[詳細]({linkUrl})。", - "home.tutorials.netflow.tutorialShortDescription": "Netflow エクスポーターが送信した Netflow の記録を収集します。", "home.tutorials.nginxLogs.artifacts.dashboards.linkLabel": "Nginx ログダッシュボード", "home.tutorials.nginxLogs.longDescription": "「nginx」Filebeat モジュールは、Nginx HTTP サーバーが作成したアクセスとエラーのログをパースします。[詳細]({learnMoreLink})。", "home.tutorials.nginxLogs.nameTitle": "Nginx ログ", diff --git a/x-pack/plugins/translations/translations/zh-CN.json b/x-pack/plugins/translations/translations/zh-CN.json index 292dca3fc5cae..c968ad13de4b2 100644 --- a/x-pack/plugins/translations/translations/zh-CN.json +++ b/x-pack/plugins/translations/translations/zh-CN.json @@ -2163,35 +2163,6 @@ "home.tutorials.natsMetrics.longDescription": "Metricbeat 模块 `nats` 从 Nats 提取监测指标。[了解详情]({learnMoreLink})。", "home.tutorials.natsMetrics.nameTitle": "NATS 指标", "home.tutorials.natsMetrics.shortDescription": "从 Nats 服务器提取监测指标。", - "home.tutorials.netflow.common.config.elasticCloud.osxTextPost": "其中 {udpPort} 是 Logstash 用于接收 Netflow 数据的 UDP 端口， {password} 是 {elastic} 用户的密码。", - "home.tutorials.netflow.common.config.elasticCloud.osxTextPre": "修改 {logstashConfigPath} 以设置配置参数：", - "home.tutorials.netflow.common.config.elasticCloud.osxTitle": "编辑配置", - "home.tutorials.netflow.common.config.elasticCloud.windowsTextPost": "其中 {udpPort} 是 Logstash 用于接收 Netflow 数据的 UDP 端口， {password} 是 {elastic} 用户的密码。", - "home.tutorials.netflow.common.config.elasticCloud.windowsTextPre": "修改 {logstashConfigPath} 以设置配置参数：", - "home.tutorials.netflow.common.config.elasticCloud.windowsTitle": "编辑配置", - "home.tutorials.netflow.common.config.onPrem.osxTextPost": "其中 {udpPort} 是 Logstash 用于接收 Netflow 数据的 UDP 端口。", - "home.tutorials.netflow.common.config.onPrem.osxTextPre": "修改 {logstashConfigPath} 以设置配置参数：", - "home.tutorials.netflow.common.config.onPrem.osxTitle": "编辑配置", - "home.tutorials.netflow.common.config.onPrem.windowsTextPost": "其中 {udpPort} 是 Logstash 用于接收 Netflow 数据的 UDP 端口。", - "home.tutorials.netflow.common.config.onPrem.windowsTextPre": "修改 {logstashConfigPath} 以设置配置参数：", - "home.tutorials.netflow.common.config.onPrem.windowsTitle": "编辑配置", - "home.tutorials.netflow.common.config.onPremElasticCloud.osxTextPost": "其中 {udpPort} 是 Logstash 用于接收 Netflow 数据的 UDP 端口， {esUrl} 是在 Elastic Cloud 上运行的 Elasticsearch 的 URL， {password} 是 {elastic} 用户的密码。", - "home.tutorials.netflow.common.config.onPremElasticCloud.osxTextPre": "修改 {logstashConfigPath} 以设置配置参数：", - "home.tutorials.netflow.common.config.onPremElasticCloud.osxTitle": "编辑配置", - "home.tutorials.netflow.common.config.onPremElasticCloud.windowsTextPost": "其中 {udpPort} 是 Logstash 用于接收 Netflow 数据的 UDP 端口， {esUrl} 是在 Elastic Cloud 上运行的 Elasticsearch 的 URL， {password} 是 {elastic} 用户的密码。", - "home.tutorials.netflow.common.config.onPremElasticCloud.windowsTextPre": "修改 {logstashConfigPath} 以设置配置参数：", - "home.tutorials.netflow.common.config.onPremElasticCloud.windowsTitle": "编辑配置", - "home.tutorials.netflow.common.setup.osxTextPost": "{setupOption} 选项在 Elasticsearch 中创建 {netflowPrefix} 索引模式并导入 Kibana 仪表板和可视化。对随后的运行省略此选项可避免覆盖现有仪表板。", - "home.tutorials.netflow.common.setup.osxTextPre": "运行：", - "home.tutorials.netflow.common.setup.osxTitle": "运行 Netflow 模块", - "home.tutorials.netflow.common.setup.windowsTextPost": "{setupOption} 选项在 Elasticsearch 中创建 {netflowPrefix} 索引模式并导入 Kibana 仪表板和可视化。对随后的运行省略此选项可避免覆盖现有仪表板。", - "home.tutorials.netflow.common.setup.windowsTextPre": "运行：", - "home.tutorials.netflow.common.setup.windowsTitle": "运行 Netflow 模块", - "home.tutorials.netflow.elasticCloudInstructions.title": "入门", - "home.tutorials.netflow.onPremElasticCloudInstructions.title": "入门", - "home.tutorials.netflow.onPremInstructions.title": "入门", - "home.tutorials.netflow.tutorialLongDescription": "Logstash Netflow 模块收集并解析网络流数据，将事件索引到 Elasticsearch 中，并安装一套 Kibana 仪表板。此模块支持 Netflow 版本 5 和 9。[了解详情]({linkUrl})。", - "home.tutorials.netflow.tutorialShortDescription": "收集 Netflow 导出器发送的 Netflow 记录。", "home.tutorials.nginxLogs.artifacts.dashboards.linkLabel": "Nginx 日志仪表板", "home.tutorials.nginxLogs.longDescription": "Filebeat 模块 `nginx` 解析 Nginx HTTP 服务器创建的访问和错误日志。[了解详情]({learnMoreLink})。", "home.tutorials.nginxLogs.nameTitle": "Nginx 日志",