<!--
  Wazuh 5.0 Google Cloud collection, agent-side.

  Options and defaults from:
  https://documentation.wazuh.com/5.0-beta/user-manual/reference/ossec-conf/gcp-pubsub.html
  Pipeline setup from:
  https://documentation.wazuh.com/5.0-beta/cloud-security/gcp/pubsub.html

  HARD CONSTRAINT: the Wazuh GCP module supports only ONE gcp-pubsub section
  per configuration file. A second subscription needs a second agent.

  Before this works:
    1. Create a Pub/Sub topic and a subscription with Pull delivery.
    2. Create a log sink into that topic with an inclusion filter:
         Cloud Audit Logs   logName:"cloudaudit.googleapis.com"
         VPC Flow Logs      resource.type="gce_subnetwork"
         Firewall rule logs logName="projects/YOUR_PROJECT_ID/logs/compute.googleapis.com%2Ffirewall"
         DNS query logs     resource.type="dns_query"
       Combine with OR for several log types on one sink.
    3. Grant the sink's writer identity the Pub/Sub Publisher role on the
       topic. The identity is
         service-PROJECT_NUMBER@gcp-sa-logging.iam.gserviceaccount.com
       Missing this step is the most common cause of an empty subscription.
    4. Create a service account with Pub/Sub Publisher and Pub/Sub Subscriber,
       download a JSON key, copy it to the agent and set ownership:
         sudo chown root:wazuh /var/ossec/wodles/gcloud/AUTHENTICATION_FILE_NAME.json
    5. Enable the GCP ruleset integration on the dashboard:
       Security Analytics > Overview, search "gcp", Actions > Enable.
-->
<ossec_config>

  <gcp-pubsub>
    <pull_on_start>yes</pull_on_start>
    <!-- Default 1h. -->
    <interval>1m</interval>
    <project_id>YOUR_PROJECT_ID</project_id>
    <subscription_name>YOUR_SUBSCRIPTION_ID</subscription_name>
    <credentials_file>/var/ossec/wodles/gcloud/AUTHENTICATION_FILE_NAME.json</credentials_file>
    <!-- Defaults: max_messages 100, num_threads 1. The thread count is
         truncated to number_of_physical_cores * 5. Raise both on a busy
         project; watch Pub/Sub queue depth to size them. -->
    <max_messages>100</max_messages>
    <num_threads>1</num_threads>
  </gcp-pubsub>

</ossec_config>
