Wazuh integrates with Google Cloud through Pub/Sub. You configure Cloud Logging to export the logs you care about to a Pub/Sub topic, create a subscription, then point the gcp-pubsub wodle at it.
1. Create a Pub/Sub topic and subscription
gcloud pubsub topics create wazuh-logs
gcloud pubsub subscriptions create wazuh-sub --topic=wazuh-logs2. Create a logging sink
gcloud logging sinks create wazuh-sink pubsub.googleapis.com/projects/<PROJECT>/topics/wazuh-logs --log-filter='logName:"cloudaudit.googleapis.com"'3. Service account + JSON key
Create a service account with roles/pubsub.subscriber, download the JSON key and place it at /var/ossec/wodles/gcp/credentials.json (mode 600).
4. Configure the wodle
<wodle name="gcp-pubsub">
<disabled>no</disabled>
<interval>10m</interval>
<project_id>my-project</project_id>
<subscription_name>wazuh-sub</subscription_name>
<credentials_file>/var/ossec/wodles/gcp/credentials.json</credentials_file>
</wodle>5. Restart the manager
systemctl restart wazuh-managerNote: Built-in rules in the gcp group decode Cloud Audit Logs and surface IAM changes, firewall changes and SA key creation.
We build GCP detection content (privilege escalation, service-account abuse) in Wazuh, contact us.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
WazuhGCPPub/SubCloud