elastic / elastic/beats

[New Module] VirusTotal Intelligence Live Hunt Filebeat Module

Open
#21,541 3 comments 1 reaction 1 assignee Claimed by @peasead View on GitHub
Agent enhancement Filebeat module Team:Security-Service Integrations
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

# Description
## Objective
Using a Filebeat module, collect data from the VirusTotal Intelligence Live Hunt notification queue mapping the data to ECS (or associated field mappings), and write the data to Elasticsearch

## Approach
Create a Filebeat module using [HTTP JSON](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-httpjson.html) to pull down the Live Hunt notification queue; and

# Filebeat Module / Dataset release checklist

## Modules

For a metricset to go GA, the following criterias should be met:

* [ ] Supported versions are documented
* [ ] Supported operating systems are documented (if applicable)
* [ ] Integration tests exist
* [ ] System tests exist
* [ ] Automated checks that all fields are documented
* [ ] Documentation
* [ ] Fields follow [ECS](https://github.com/elastic/ecs) and [naming conventions](https://www.elastic.co/guide/en/beats/devguide/master/event-conventions.html)
* [ ] Dashboards exists (if applicable)
* [ ] Kibana Home Tutorial (if applicable)
* [ ] Open PR against Kibana repo with tutorial. Examples can be found [here](https://github.com/elastic/kibana/tree/master/src/legacy/core_plugins/kibana/server/tutorials).

## Filebeat module

* [ ] Test log files exist for the grok patterns
* [ ] Generated output for at least 1 log file exists

CC @dcode

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.