mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2025-12-27 19:33:14 +01:00
59 lines
2.0 KiB
Plaintext
59 lines
2.0 KiB
Plaintext
# Module: googlecloud
|
|
# Docs: https://www.elastic.co/guide/en/beats/filebeat/7.x/filebeat-module-googlecloud.html
|
|
|
|
# googlecloud module is deprecated, please use gcp instead
|
|
- module: gcp
|
|
vpcflow:
|
|
enabled: true
|
|
|
|
# Google Cloud project ID.
|
|
var.project_id: my-gcp-project-id
|
|
|
|
# Google Pub/Sub topic containing VPC flow logs. Stackdriver must be
|
|
# configured to use this topic as a sink for VPC flow logs.
|
|
var.topic: gcp-vpc-flowlogs
|
|
|
|
# Google Pub/Sub subscription for the topic. Filebeat will create this
|
|
# subscription if it does not exist.
|
|
var.subscription_name: filebeat-gcp-vpc-flowlogs-sub
|
|
|
|
# Credentials file for the service account with authorization to read from
|
|
# the subscription.
|
|
var.credentials_file: ${path.config}/gcp-service-account-xyz.json
|
|
|
|
firewall:
|
|
enabled: true
|
|
|
|
# Google Cloud project ID.
|
|
var.project_id: my-gcp-project-id
|
|
|
|
# Google Pub/Sub topic containing firewall logs. Stackdriver must be
|
|
# configured to use this topic as a sink for firewall logs.
|
|
var.topic: gcp-vpc-firewall
|
|
|
|
# Google Pub/Sub subscription for the topic. Filebeat will create this
|
|
# subscription if it does not exist.
|
|
var.subscription_name: filebeat-gcp-firewall-sub
|
|
|
|
# Credentials file for the service account with authorization to read from
|
|
# the subscription.
|
|
var.credentials_file: ${path.config}/gcp-service-account-xyz.json
|
|
|
|
audit:
|
|
enabled: true
|
|
|
|
# Google Cloud project ID.
|
|
var.project_id: my-gcp-project-id
|
|
|
|
# Google Pub/Sub topic containing firewall logs. Stackdriver must be
|
|
# configured to use this topic as a sink for firewall logs.
|
|
var.topic: gcp-vpc-audit
|
|
|
|
# Google Pub/Sub subscription for the topic. Filebeat will create this
|
|
# subscription if it does not exist.
|
|
var.subscription_name: filebeat-gcp-audit
|
|
|
|
# Credentials file for the service account with authorization to read from
|
|
# the subscription.
|
|
var.credentials_file: ${path.config}/gcp-service-account-xyz.json
|