Skip to content

Wazuh GCP integration

Monitoring Google Cloud services

Wazuh provides modules that integrate with the Google Cloud Pub/Sub and Google Cloud Storage bucket services. Pub/Sub is a Google Cloud messaging service that allows communications between independent applications while Cloud Storage is a managed service that allows you to store and distribute your data in Google Cloud. The Wazuh modules for monitoring Google Cloud fetches different events such as data access, privileged activities, system events, and DNS queries from your Google Cloud infrastructure. These log collection and analysis capabilities allow organizations that rely on Google Cloud Platform for their infrastructure, providing them with the ability to proactively monitor activities and respond effectively to security incidents within their cloud environment.

  1. CREATE SERVICE ACCOUNT. Add roles to the service account:
      • Pub/Sub Publisher and Pub/Sub Subscriber.
    • For the Wazuh module for Google Cloud Storage buckets, add the following role with Google Cloud Storage bucket permissions: Storage Object User.
    • Depending on your requirement, the service account can have the roles for authenticating to both Google Cloud Pub/Sub and Storage services. 2. Create a pub/sub topic
    • This will create a pub/sub subscription.
    • copy that name.

Go to the wazuh manager server. 1. create service-acc.json with the key from service account you created. 2. move to /var/ossec/wodles/gcloud/service-acc.json 3. sudo chown root:wazuh /var/ossec/wodles/gcloud/service-acc.json check if gcloud is working /var/ossec/wodles/gcloud/gcloud --help

Follow the next steps to configure the Wazuh module for Google Cloud Pub/Sub on your Wazuh server or Wazuh agent to access the Pub/Sub services. 1. Append the following configuration to the /var/ossec/etc/ossec.conf configuration file of your preferred endpoint or you can use Wazuh gui from the web in setting edit configs:

<ossec_config>
  <gcp-pubsub>
    <pull_on_start>yes</pull_on_start>
    <interval>1m</interval>
    <project_id><YOUR_PROJECT_ID></project_id>
    <subscription_name><YOUR_SUBSCRIPTION_ID></subscription_name>
    <credentials_file>/var/ossec/wodles/gcloud/sercive-acc.json</credentials_file>
  </gcp-pubsub>
</ossec_config>

you can create multiple gcp-pubsub blocks for multiple project. after adding this block save and restart manager.

Google Cloud log activities appear under the Log Router section. Cloud audit logs can be published to a Cloud Pub/Sub topic through sinks. Create a sink and use the topic as a destination. 1. In the Google Cloud console pane, click on Logging or search for Log Router in the search bar and select it. 2. Select Log Router and click the Create Sink button. 3. Follow the steps below to complete the Create logs routing sink form. 1. Sink details: provide a name and description for the logs routing sink. 2. Sink destination: select the sink service type and destination. 1. 1. Choose logs to include in sink: create an inclusion filter to determine which logs are included. 2. Choose logs to filter out to sink: create exclusion filters to determine which logs are excluded. 3. Click the CREATE SINK button.

This will allow wazuh to access the logs. Because wazuh is subscribing to pub-sub topic- subscription, like this will get all logs from gcp, also while creating this sink we can create custom query for specific logs.

Subpages