Skip to content

Commit 2f3d9eb

Browse files
esmerelesmerel
committed
Pipeline: outputs: chronicle: style
Signed-off-by: Lynette Miles <[email protected]>
1 parent 86ebfa4 commit 2f3d9eb

File tree

1 file changed

+24
-28
lines changed

1 file changed

+24
-28
lines changed

‎pipeline/outputs/chronicle.md

Lines changed: 24 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,46 +1,42 @@
11
# Chronicle
22

3-
The Chronicle output plugin allows ingesting security logs into [Google Chronicle](https://chronicle.security/) service. This connector is designed to send unstructured security logs.
3+
The _Chronicle_ output plugin lets you ingest security logs into the [Google Chronicle](https://chronicle.security/) service. This connector is designed to send unstructured security logs.
44

5-
## Google Cloud Configuration
5+
## Google Cloud configuration
66

7-
Fluent Bit streams data into an existing Google Chronicle tenant using a service account that you specify. Therefore, before using the Chronicle output plugin, you must create a service account, create a Google Chronicle tenant, authorize the service account to write to the tenant, and provide the service account credentials to Fluent Bit.
7+
Fluent Bit streams data into an existing Google Chronicle tenant using a service account that you specify. Before using the Chronicle output plugin, you must:
88

9-
### Creating a Service Account
9+
1. Create a service account.
1010

11-
To stream security logs into Google Chronicle, the first step is to create a Google Cloud service account for Fluent Bit:
11+
To stream security logs into Google Chronicle, create a [Google Cloud service account](https://cloud.google.com/iam/docs/creating-managing-service-accounts) for Fluent Bit:
1212

13-
* [Creating a Google Cloud Service Account](https://cloud.google.com/iam/docs/creating-managing-service-accounts)
13+
1. Create a tenant of Google Chronicle
1414

15-
### Creating a Tenant of Google Chronicle
15+
Fluent Bit doesn't create a tenant of Google Chronicle for your security logs, so you must create this ahead of time.
1616

17-
Fluent Bit does not create a tenant of Google Chronicle for your security logs, so you must create this ahead of time.
17+
1. Retrieve service account credentials
1818

19-
### Retrieving Service Account Credentials
19+
The Fluent Bit Chronicle output plugin uses a JSON credentials file for authentication credentials. Download the credentials file by following the instructions for [Creating and Managing Service Account Keys](https://cloud.google.com/iam/docs/creating-managing-service-account-keys).
2020

21-
Fluent Bit's Chronicle output plugin uses a JSON credentials file for authentication credentials. Download the credentials file by following these instructions:
21+
## Configurations parameters
2222

23-
* [Creating and Managing Service Account Keys](https://cloud.google.com/iam/docs/creating-managing-service-account-keys)
24-
25-
## Configurations Parameters
26-
27-
| Key | Description | default |
23+
| Key | Description | Default |
2824
| :--- | :--- | :--- |
29-
| google\_service\_credentials | Absolute path to a Google Cloud credentials JSON file. | Value of the environment variable _$GOOGLE\_SERVICE\_CREDENTIALS_ |
30-
| service\_account\_email | Account email associated with the service. Only available if **no credentials file** has been provided. | Value of environment variable _$SERVICE\_ACCOUNT\_EMAIL_ |
31-
| service\_account\_secret | Private key content associated with the service account. Only available if **no credentials file** has been provided. | Value of environment variable _$SERVICE\_ACCOUNT\_SECRET_ |
32-
| project\_id | The project id containing the tenant of Google Chronicle to stream into. | The value of the `project_id` in the credentials file |
33-
| customer\_id | The customer id to identify the tenant of Google Chronicle to stream into. The value of the `customer_id` should be specified in the configuration file. | |
34-
| log\_type | The log type to parse logs as. Google Chronicle supports parsing for [specific log types only](https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers). | |
35-
| region | The GCP region in which to store security logs. Currently, there are several supported regions: `US`, `EU`, `UK`, `ASIA`. Blank is handled as `US`. | |
36-
| log\_key | By default, the whole log record will be sent to Google Chronicle. If you specify a key name with this option, then only the value of that key will be sent to Google Chronicle. | |
37-
| workers | The number of [workers](../../administration/multithreading.md#outputs) to perform flush operations for this output. | `0` |
25+
| `google_service_credentials` | Absolute path to a Google Cloud credentials JSON file. | Value of the environment variable `$GOOGLE_SERVICE_CREDENTIALS`. |
26+
| `service_account_email` | Account email associated with the service. Only available if no credentials file has been provided. | Value of environment variable `$SERVICE_ACCOUNT_EMAIL`. |
27+
| `service_account_secret` | Private key content associated with the service account. Only available if no credentials file has been provided. | Value of environment variable `$SERVICE_ACCOUNT_SECRET`. |
28+
| `project_id` | The project id containing the tenant of Google Chronicle to stream into. | The value of the `project_id` in the credentials file |
29+
| `customer_id` | The customer id to identify the tenant of Google Chronicle to stream into. The value of the `customer_id` should be specified in the configuration file. | _none_ |
30+
| `log_type` | The log type to parse logs as. Google Chronicle supports parsing for [specific log types only](https://cloud.google.com/chronicle/docs/ingestion/parser-list/supported-default-parsers). | _none_ |
31+
| `region` | The GCP region in which to store security logs. Supported regions: `US`, `EU`, `UK`, `ASIA`. Blank is handled as `US`. | _none_ |
32+
| `log_key` | By default, the whole log record will be sent to Google Chronicle. If you specify a key name with this option, then only the value of that key will be sent to Google Chronicle. | _none_ |
33+
| `workers` | The number of [workers](../../administration/multithreading.md#outputs) to perform flush operations for this output. | `0` |
3834

3935
See Google's [official documentation](https://cloud.google.com/chronicle/docs/reference/ingestion-api) for further details.
4036

41-
## Configuration File
37+
## Configuration file
4238

43-
If you are using a _Google Cloud Credentials File_, the following configuration is enough to get you started:
39+
If you are using a Google Cloud credentials file, the following configuration will get you started:
4440

4541
{% tabs %}
4642
{% tab title="fluent-bit.yaml" %}
@@ -50,7 +46,7 @@ pipeline:
5046
inputs:
5147
- name: dummy
5248
tag: dummy
53-
49+
5450
outputs:
5551
- name: chronicle
5652
match: '*'
@@ -74,4 +70,4 @@ pipeline:
7470
```
7571

7672
{% endtab %}
77-
{% endtabs %}
73+
{% endtabs %}

0 commit comments

Comments
 (0)