gcp-bucket

Prerequisite: the Google Cloud integration runs on a Wazuh agent and needs Python 3 and the Python packages listed in Installing dependencies.

This configuration section is used to configure the Google Cloud Storage bucket module.

Options

Main options

enabled
bucket
logging (deprecated)

Scheduling options

run_on_start
interval
day
wday
time

Main options

enabled

Enables or disables the module.

Default value	yes
Allowed values	yes, no

bucket

Defines a bucket to process. It must have its type attribute defined. It supports multiple instances of this option.

<bucket type="access_logs">
</bucket>

Bucket attributes

Attributes	Allowed values	Mandatory/Optional
type (attribute)	access_logs	Mandatory

Bucket options

Options	Allowed values	Mandatory/Optional
name	Any valid bucket name	Mandatory
credentials_file	Path to a credentials file. It can be absolute or relative to WAZUH_HOME	Mandatory
path	Any valid path	Optional
only_logs_after	Valid date in YYYY-MMM-DD format	Optional
remove_from_bucket	A value to determine if each log file is deleted once it has been collected by the module	Optional

type (attribute)

Specifies the type of bucket.

Default value	n/a
Allowed values	access_logs

name

Name of the Google Cloud Storage bucket from which logs are read.

Default value	n/a
Allowed values	Any valid bucket name

credentials_file

Path to the Google Cloud credentials file. It can be an absolute path or relative to WAZUH_HOME.

Default value	n/a
Allowed values	Any path to a credentials file

For example <credentials_file>wodles/gcp-bucket/credentials.json</credentials_file>.

path

Bucket path or prefix.

Default value	n/a
Allowed values	Valid path

only_logs_after

Parse logs from a specific date onwards. It must follow the YYYY-MMM-DD format (for example, 2021-Jun-01); a numeric month is not accepted.

Default value	Date of execution at `00:00:00`
Allowed values	Valid date [YYYY-MMM-DD]

remove_from_bucket

Remove the logs from the Google Cloud Storage bucket once the module reads them.

Default value	no
Allowed values	yes, no

logging

Deprecated since version 5.0.0: The module still accepts the <logging> tag inside <gcp-bucket> for backward compatibility, but ignores it and logs a debug message saying the setting is skipped. Remove it from the configuration.

Scheduling options

run_on_start

Run the module on Wazuh service start or restart.

Default value	yes
Allowed values	yes, no

interval

Time interval between module executions.

Default value	1h
Allowed values	A positive number that should contain a suffix character indicating a time unit, such as s (seconds), m (minutes), h (hours), d (days), w (weeks), M (months)

day

Day of the month to retrieve logs from GCP.

Default value	n/a
Allowed values	Day of the month [1..31]

Note

When the day option is set, the interval value must be a multiple of months. By default, the interval is set to a month.

wday

Day of the week to retrieve logs from GCP. This option is not compatible with the day option.

Default value	n/a
Allowed values	Day of the week: - sunday/sun - monday/mon - tuesday/tue - wednesday/wed - thursday/thu - friday/fri - saturday/sat

Note

When the wday option is set, the interval value must be a multiple of weeks. By default, the interval is set to a week.

time

Time of the day to retrieve logs from GCP. It has to be represented in the format hh:mm. This option is compatible with day or wday options.

Default value	n/a
Allowed values	Time of day [hh:mm]

Note

When only the time option is set, the interval value must be a multiple of days or weeks. By default, the interval is set to a day.

Configuration example

Linux configuration:

<gcp-bucket>
  <run_on_start>yes</run_on_start>
  <interval>1m</interval>
  <bucket type="access_logs">
    <name>wazuh-test-bucket</name>
    <credentials_file>/var/ossec/wodles/gcloud/credentials.json</credentials_file>
    <only_logs_after>2021-JUN-01</only_logs_after>
    <path>access_logs/</path>
    <remove_from_bucket>no</remove_from_bucket>
  </bucket>
</gcp-bucket>