IT Glue

# Adapter Documentation: https://docs.limacharlie.io/docs/adapter-types

sensor_type: "itglue"
itglue:
  token: "YOUR_ITGLUE_API_KEY_OR_TOKEN_HERE" # (required) your API key/token for IT Glue. Store securely.
  client_options:
    identity:
      oid: "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" # (required) Organization ID from LimaCharlie.
      installation_key: "YOUR_LC_INSTALLATION_KEY_ITGLUE" # (required) Installation key associated with the OID.
    # Option 1: Static hostname for this sensor
    hostname: "itglue-adapter-prod-01.example.com" # (required if not using sensor_hostname_path) A unique, static hostname for this sensor instance.
    # Option 2: Dynamic hostname (see client_options.mapping.sensor_hostname_path below)
    platform: "saas_api" # (required) Indicates the source is a SaaS API.
    architecture: null # (optional) Not typically applicable for SaaS API integrations.
    mapping:
      # IT Glue API likely returns structured JSON, so parsing_re is often null.
      # Adjust if specific text parsing is needed from a field within the JSON.
      parsing_re: null
      # (optional) JSON path from IT Glue event data to uniquely ID the original configuration item, audit log, etc.
      sensor_key_path: "data.id" # Example: if events have a unique 'id' in a 'data' object.
      # (optional) If client_options.hostname is NOT set, use this to dynamically extract hostname from event.
      sensor_hostname_path: null # Example: "data.attributes.device_name" (if IT Glue events contain such a field).
      # (optional) Example: "ITGLUE_AUDIT_CONFIG_UPDATE", "ITGLUE_USER_LOGIN" based on a field in the event.
      event_type_path: "ITGLUE_{{ .data.type | token | upper | default \"GENERIC_EVENT\" }}"
      # (optional) JSON path to the field representing the event's occurrence time.
      event_time_path: "data.attributes.created_at" # Example: common timestamp field name.
      # (optional) JSON path for a field to populate LimaCharlie's investigation_id.
      investigation_id_path: "meta.request_id" # Example: if IT Glue API responses include a request ID.
      # (optional) Use +/- syntax for transforms: +new_field: 'template', -old_field: null
      transform:
        "+data_source_name": "ITGlue_Audit" # Add a static field for easier identification
        "+itglue_organization_id": "{{ .data.relationships.organization.data.id }}" # Example: extract related org ID
        "-meta.internal_notes": null # Remove a field not needed for telemetry
        # "+user_performing_action_email": "{{ .included[?(@.type=='users' && @.id==.data.relationships.user.data.id)].attributes.email }}" # Example of complex lookup if data is structured with 'included' resources
        # (optional) A list of field paths to drop from the event before sending to LimaCharlie.
      drop_fields:
      - "data.attributes.verbose_description"
      - "relationships.temporary_tokens"
      sid_replication_path: null # (optional) Not typically relevant for IT Glue events.
    # mappings: null # Deprecated or less common for field manipulation than client_options.mapping.transform
    indexing:
      enabled: true
      default_index: "itglue-audit-{{ .identity.oid | substr 0 8 }}" # Example: index by org prefix
    is_compressed: false # (optional) API responses are typically not compressed at this layer.
    sensor_seed_key: "SEED_KEY_ITGLUE_ADAPTER_001" # (required) A unique key for this sensor to register with LimaCharlie.
    dest_url: "https://input.limacharlie.io" # (optional) The destination URL. Usually defaults correctly.