|
| 1 | +{ |
| 2 | + "//": "Generated by fleet-terraform-generator - DO NOT EDIT", |
| 3 | + "variable": { |
| 4 | + "api_token": { |
| 5 | + "type": "string", |
| 6 | + "description": "API Token of the SentinelOne with API Access Level type.", |
| 7 | + "sensitive": true, |
| 8 | + "nullable": false |
| 9 | + }, |
| 10 | + "batch_size": { |
| 11 | + "type": "number", |
| 12 | + "description": "Batch size for the response of the Sentinel One API. The maximum supported page size value is 1000.", |
| 13 | + "default": 1000, |
| 14 | + "nullable": false |
| 15 | + }, |
| 16 | + "enable_request_tracer": { |
| 17 | + "type": "bool", |
| 18 | + "description": "The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details.", |
| 19 | + "default": false |
| 20 | + }, |
| 21 | + "fleet_agent_policy_id": { |
| 22 | + "type": "string", |
| 23 | + "description": "Agent policy ID to add the package policy to." |
| 24 | + }, |
| 25 | + "fleet_data_stream_namespace": { |
| 26 | + "type": "string", |
| 27 | + "description": "Namespace to use for the data stream.", |
| 28 | + "default": "default" |
| 29 | + }, |
| 30 | + "fleet_package_policy_description": { |
| 31 | + "type": "string", |
| 32 | + "description": "Description to use for the package policy.", |
| 33 | + "default": "" |
| 34 | + }, |
| 35 | + "fleet_package_policy_force": { |
| 36 | + "type": "bool", |
| 37 | + "description": "Force reinstallation of the package even if already installed. When true, bypasses \"already installed\" checks and triggers complete re-installation. This deletes and recreates Kibana assets (dashboards, visualizations), removes transforms and their destination indices, and overwrites ingest pipelines and templates.", |
| 38 | + "default": true |
| 39 | + }, |
| 40 | + "fleet_package_policy_name_suffix": { |
| 41 | + "type": "string", |
| 42 | + "description": "Suffix to append to the end of the package policy name.", |
| 43 | + "default": "" |
| 44 | + }, |
| 45 | + "fleet_package_version": { |
| 46 | + "type": "string", |
| 47 | + "description": "Version of the sentinel_one package to use.", |
| 48 | + "default": "2.1.0" |
| 49 | + }, |
| 50 | + "http_client_timeout": { |
| 51 | + "type": "string", |
| 52 | + "description": "Duration before declaring that the HTTP client connection has timed out. Supported time units are ns, us, ms, s, m, h.", |
| 53 | + "default": "30s", |
| 54 | + "nullable": false |
| 55 | + }, |
| 56 | + "interval": { |
| 57 | + "type": "string", |
| 58 | + "description": "Duration between requests to the Sentinel One API. Supported units for this parameter are h/m/s.", |
| 59 | + "default": "24h", |
| 60 | + "nullable": false |
| 61 | + }, |
| 62 | + "preserve_duplicate_custom_fields": { |
| 63 | + "type": "bool", |
| 64 | + "description": "Preserve sentinel_one.application_risk fields that were copied to Elastic Common Schema (ECS) fields.", |
| 65 | + "default": null |
| 66 | + }, |
| 67 | + "preserve_original_event": { |
| 68 | + "type": "bool", |
| 69 | + "description": "Preserves a raw copy of the original event, added to the field `event.original`.", |
| 70 | + "default": false |
| 71 | + }, |
| 72 | + "processors_yaml": { |
| 73 | + "type": "string", |
| 74 | + "description": "Processors are used to reduce the number of fields in the exported event or to enhance the event with metadata. This executes in the agent before the logs are parsed.", |
| 75 | + "default": null |
| 76 | + }, |
| 77 | + "proxy_url": { |
| 78 | + "type": "string", |
| 79 | + "description": "URL to proxy connections in the form of http\\[s\\]://<user>:<password>@<server name/ip>:<port>. Please ensure your username and password are in URL encoded format.", |
| 80 | + "default": null |
| 81 | + }, |
| 82 | + "site_ids": { |
| 83 | + "type": "string", |
| 84 | + "description": "Comma separated list of Site IDs to filter by. Example - \"225494730938493804,225494730938493915\".", |
| 85 | + "default": null |
| 86 | + }, |
| 87 | + "ssl_yaml": { |
| 88 | + "type": "string", |
| 89 | + "description": "SSL configuration options. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html#ssl-common-config) for details.", |
| 90 | + "default": "#certificate_authorities:\n# - |\n# -----BEGIN CERTIFICATE-----\n# MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n# ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n# MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n# BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n# fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n# 94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n# /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n# PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n# CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n# BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n# 8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n# 874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n# 3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n# H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n# 8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n# yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n# sxSmbIUfc2SGJGCJD4I=\n# -----END CERTIFICATE-----\n" |
| 91 | + }, |
| 92 | + "tags": { |
| 93 | + "type": "list(string)", |
| 94 | + "default": [ |
| 95 | + "forwarded", |
| 96 | + "sentinel_one-application_risk" |
| 97 | + ], |
| 98 | + "nullable": false |
| 99 | + }, |
| 100 | + "url": { |
| 101 | + "type": "string", |
| 102 | + "description": "Base URL of the SentinelOne Singularity Operations Center. It will be in the format `https://<your-tenant>.sentinelone.net`.", |
| 103 | + "nullable": false |
| 104 | + } |
| 105 | + }, |
| 106 | + "output": { |
| 107 | + "id": { |
| 108 | + "description": "Package policy ID", |
| 109 | + "value": "${module.fleet_package_policy.id}" |
| 110 | + } |
| 111 | + }, |
| 112 | + "module": { |
| 113 | + "fleet_package_policy": { |
| 114 | + "agent_policy_id": "${var.fleet_agent_policy_id}", |
| 115 | + "all_data_streams": [ |
| 116 | + "application", |
| 117 | + "application_risk", |
| 118 | + "threat_event" |
| 119 | + ], |
| 120 | + "all_policy_template_inputs": [ |
| 121 | + "sentinel_one-cel", |
| 122 | + "sentinel_one-httpjson" |
| 123 | + ], |
| 124 | + "data_stream": "application_risk", |
| 125 | + "data_stream_variables_json": "${jsonencode({\n batch_size = var.batch_size\n enable_request_tracer = var.enable_request_tracer\n http_client_timeout = var.http_client_timeout\n interval = var.interval\n preserve_duplicate_custom_fields = var.preserve_duplicate_custom_fields\n preserve_original_event = var.preserve_original_event\n processors = var.processors_yaml\n site_ids = var.site_ids\n tags = var.tags\n})}", |
| 126 | + "description": "${var.fleet_package_policy_description}", |
| 127 | + "force": "${var.fleet_package_policy_force}", |
| 128 | + "input_type": "cel", |
| 129 | + "input_variables_json": "${jsonencode({\n api_token = var.api_token\n proxy_url = var.proxy_url\n ssl = var.ssl_yaml\n url = var.url\n})}", |
| 130 | + "namespace": "${var.fleet_data_stream_namespace}", |
| 131 | + "package_name": "sentinel_one", |
| 132 | + "package_policy_name": "sentinel_one-application_risk-${var.fleet_data_stream_namespace}${var.fleet_package_policy_name_suffix}", |
| 133 | + "package_version": "${var.fleet_package_version}", |
| 134 | + "policy_template": "sentinel_one", |
| 135 | + "source": "../../fleet_package_policy" |
| 136 | + } |
| 137 | + } |
| 138 | +} |
0 commit comments