Supported services

The ThreatLockDown GCP module is able to retrieve logs from Google Cloud Pub/Sub and from Google Cloud Storage buckets.

Supported services using Google Cloud Pub/Sub

The following GCP services are supported by the ThreatLockDown GCP module by pulling the data from Google Cloud Pub/Sub:

Audited resources
DNS queries
- Configure Google DNS logs collection
- ThreatLockDown dashboard visualization
VPC Flow logs
- Enabling VPC Flow Logs
- Exporting VPC Flow logs to Pub/Sub
Firewall Rules Logging
- Enabling Firewall Rules Logging
- Exporting Firewall Rules Logging logs to Pub/Sub
HTTP(S) Load Balancing Logging
- Enabling HTTP(S) Load Balancing Logging
- Exporting HTTP(S) Load Balancing Logging logs to Pub/Sub

To check the gcp-pubsub configuration used to pull data from Google Cloud Pub/Sub, see the gcp-pubsub section.

Supported services using Google Cloud Storage buckets

The following GCP services are supported by the ThreatLockDown GCP module by pulling the data from Google Cloud Storage buckets:

Usage logs & storage logs
- Setting up log delivery to a Google Cloud Storage bucket
- Example of configuration

To check the gcp-bucket configuration used to pull data from Google Cloud Storage buckets, see the gcp-bucket section.