New integration created for "cloud_defend" for containers feature

.github/CODEOWNERS

@@ -204,3 +204,4 @@
 /packages/influxdb @elastic/obs-service-integrations
 /packages/jolokia_input @elastic/obs-service-integrations
 /packages/ded @elastic/ml-ui
+/packages/cloud_defend @elastic/awp-viz

packages/cloud_defend/LICENSE.txt

@@ -0,0 +1,93 @@
+Elastic License 2.0
+
+URL: https://www.elastic.co/licensing/elastic-license
+
+## Acceptance
+
+By using the software, you agree to all of the terms and conditions below.
+
+## Copyright License
+
+The licensor grants you a non-exclusive, royalty-free, worldwide,
+non-sublicensable, non-transferable license to use, copy, distribute, make
+available, and prepare derivative works of the software, in each case subject to
+the limitations and conditions below.
+
+## Limitations
+
+You may not provide the software to third parties as a hosted or managed
+service, where the service provides users with access to any substantial set of
+the features or functionality of the software.
+
+You may not move, change, disable, or circumvent the license key functionality
+in the software, and you may not remove or obscure any functionality in the
+software that is protected by the license key.
+
+You may not alter, remove, or obscure any licensing, copyright, or other notices
+of the licensor in the software. Any use of the licensor’s trademarks is subject
+to applicable law.
+
+## Patents
+
+The licensor grants you a license, under any patent claims the licensor can
+license, or becomes able to license, to make, have made, use, sell, offer for
+sale, import and have imported the software, in each case subject to the
+limitations and conditions in this license. This license does not cover any
+patent claims that you cause to be infringed by modifications or additions to
+the software. If you or your company make any written claim that the software
+infringes or contributes to infringement of any patent, your patent license for
+the software granted under these terms ends immediately. If your company makes
+such a claim, your patent license ends immediately for work on behalf of your
+company.
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of the software from you
+also gets a copy of these terms.
+
+If you modify the software, you must include in any modified copies of the
+software prominent notices stating that you have modified the software.
+
+## No Other Rights
+
+These terms do not imply any licenses other than those expressly granted in
+these terms.
+
+## Termination
+
+If you use the software in violation of these terms, such use is not licensed,
+and your licenses will automatically terminate. If the licensor provides you
+with a notice of your violation, and you cease all violation of this license no
+later than 30 days after you receive that notice, your licenses will be
+reinstated retroactively. However, if you violate these terms after such
+reinstatement, any additional violation of these terms will cause your licenses
+to terminate automatically and permanently.
+
+## No Liability
+
+*As far as the law allows, the software comes as is, without any warranty or
+condition, and the licensor will not be liable to you for any damages arising
+out of these terms or the use or nature of the software, under any kind of
+legal claim.*
+
+## Definitions
+
+The **licensor** is the entity offering these terms, and the **software** is the
+software the licensor makes available under these terms, including any portion
+of it.
+
+**you** refers to the individual or entity agreeing to these terms.
+
+**your company** is any legal entity, sole proprietorship, or other kind of
+organization that you work for, plus all organizations that have control over,
+are under the control of, or are under common control with that
+organization. **control** means ownership of substantially all the assets of an
+entity, or the power to direct its management and policies by vote, contract, or
+otherwise. Control can be direct or indirect.
+
+**your licenses** are all the licenses granted to you for the software under
+these terms.
+
+**use** means anything you do with the software requiring one of your licenses.
+
+**trademark** means trademarks, service marks, and similar rights.

packages/cloud_defend/changelog.yml

@@ -0,0 +1,6 @@
+# newer versions go on top
+- version: "0.0.1"
+ changes:
+ - description: Initial draft of the package
+ type: enhancement
+ link: https://github.com/elastic/integrations/pull/4680

packages/cloud_defend/data_stream/alerts/agent/stream/stream.yml.hbs

@@ -0,0 +1 @@
+{{configuration}}

packages/cloud_defend/data_stream/alerts/elasticsearch/ingest_pipeline/default.yml

@@ -0,0 +1,10 @@
+---
+description: Pipeline for cloud defend alerts
+processors:
+- set:
+ field: event.ingested
+ value: '{{_ingest.timestamp}}'
+on_failure:
+- set:
+ field: error.message
+ value: '{{ _ingest.on_failure_message }}'

packages/cloud_defend/data_stream/alerts/fields/base-fields.yml

@@ -0,0 +1,12 @@
+- name: data_stream.type
+ type: constant_keyword
+ description: Data stream type.
+- name: data_stream.dataset
+ type: constant_keyword
+ description: Data stream dataset.
+- name: data_stream.namespace
+ type: constant_keyword
+ description: Data stream namespace.
+- name: '@timestamp'
+ type: date
+ description: Event timestamp.

packages/cloud_defend/data_stream/alerts/fields/ecs.yml

@@ -0,0 +1,209 @@
+- name: message
+ external: ecs
+ type: match_only_text
+- name: ecs.version
+ external: ecs
+ type: keyword
+# agent
+- name: agent.id
+ external: ecs
+ type: keyword
+- name: agent.name
+ external: ecs
+ type: keyword
+- name: agent.type
+ external: ecs
+ type: keyword
+- name: agent.version
+ external: ecs
+ type: keyword
+# cloud
+- name: cloud.provider
+ external: ecs
+ type: keyword
+- name: cloud.region
+ external: ecs
+ type: keyword
+- name: cloud.availability_zone
+ external: ecs
+ type: keyword
+- name: cloud.account.id
+ external: ecs
+ type: keyword
+- name: cloud.account.name
+ external: ecs
+ type: keyword
+- name: cloud.project.id
+ external: ecs
+ type: keyword
+- name: cloud.project.name
+ external: ecs
+ type: keyword
+# container
+- name: container.id
+ external: ecs
+ type: keyword
+- name: container.image.name
+ external: ecs
+ type: keyword
+- name: container.image.tag
+ external: ecs
+ type: keyword
+# event
+- name: event.category
+ external: ecs
+ type: keyword
+- name: event.created
+ external: ecs
+ type: date
+- name: event.ingested
+ external: ecs
+ type: date
+- name: event.id
+ external: ecs
+ type: keyword
+- name: event.kind
+ external: ecs
+ type: keyword
+- name: event.type
+ external: ecs
+ type: keyword
+# file
+- name: file.mode
+ external: ecs
+ type: keyword
+- name: file.name
+ external: ecs
+ type: keyword
+- name: file.path
+ external: ecs
+ type: keyword
+# host
+- name: host.architecture
+ external: ecs
+ type: keyword
+- name: host.hostname
+ external: ecs
+ type: keyword
+- name: host.ip
+ external: ecs
+ type: ip
+- name: host.mac
+ external: ecs
+ type: keyword
+- name: host.name
+ external: ecs
+ type: keyword
+- name: host.os.codename
+ external: ecs
+ type: keyword
+- name: host.os.family
+ external: ecs
+ type: keyword
+- name: host.os.full
+ external: ecs
+ type: keyword
+- name: host.os.kernel
+ external: ecs
+ type: keyword
+- name: host.os.name
+ external: ecs
+ type: keyword
+- name: host.os.platform
+ external: ecs
+ type: keyword
+- name: host.os.type
+ external: ecs
+ type: keyword
+- name: host.os.version
+ external: ecs
+ type: keyword
+- name: host.boot.id
+ external: ecs
+ type: keyword
+- name: host.pid_ns_ino
+ external: ecs
+ type: keyword
+# orchestrator
+- name: orchestrator.cluster.id
+ external: ecs
+ type: keyword
+- name: orchestrator.cluster.name
+ external: ecs
+ type: keyword
+- name: orchestrator.resource.ip
+ external: ecs
+ type: keyword
+- name: orchestrator.resource.name
+ external: ecs
+ type: keyword
+- name: orchestrator.resource.type
+ external: ecs
+ type: keyword
+- name: orchestrator.resource.parent.type
+ external: ecs
+ type: keyword
+- name: orchestrator.namespace
+ external: ecs
+ type: keyword
+# process
+- name: process.entity_id
+ external: ecs
+ type: keyword
+- name: process.executable
+ external: ecs
+ type: keyword
+- name: process.name
+ external: ecs
+ type: keyword
+- name: process.parent.entity_id
+ external: ecs
+ type: keyword
+- name: process.parent.pid
+ external: ecs
+ type: long
+- name: process.parent.start
+ external: ecs
+ type: date
+- name: process.pid
+ external: ecs
+ type: long
+- name: process.entry_leader.entity_id
+ external: ecs
+ type: keyword
+- name: process.entry_leader.pid
+ external: ecs
+ type: long
+- name: process.entry_leader.same_as_process
+ external: ecs
+ type: boolean
+- name: process.entry_leader.start
+ external: ecs
+ type: date
+- name: process.session_leader.entity_id
+ external: ecs
+ type: keyword
+- name: process.session_leader.pid
+ external: ecs
+ type: long
+- name: process.session_leader.same_as_process
+ external: ecs
+ type: boolean
+- name: process.session_leader.start
+ external: ecs
+ type: date
+- name: process.start
+ external: ecs
+ type: date
+- name: process.user.id
+ external: ecs
+ type: keyword
+- name: process.user.name
+ external: ecs
+ type: keyword
+- name: process.group.id
+ external: ecs
+ type: keyword
+- name: process.group.name
+ external: ecs
+ type: keyword

packages/cloud_defend/data_stream/alerts/manifest.yml

@@ -0,0 +1,12 @@
+title: "alerts"
+type: logs
+#ilm_policy: logs-cloud_defend.alerts-default_policy TODO retention policy
+elasticsearch:
+ index_template:
+ mappings:
+ dynamic: false
+streams:
+ - input: cloud_defend/control
+ template_path: stream.yml.hbs
+ title: BPF/LSM controls
+ description: Enables BPF/LSM control mechanisms, for use with FIM and container drift prevention.