WIP: feature(#16369): Add chronicle udm events sink #22155
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Add a new Google Chronicle log sink for UDM events. The log sink acts as a client for the Google Chronicle udmevents ingestion API. Forwarding udm data in a Json format. it is assumed that the events will already be compliant with the Google Chronicles UDM format
Change Type
Is this a breaking change?
How did you test this PR?
Added new integration tests
Tested manually against a live Google Chronicle deployment
Does this PR include user facing changes?
Checklist
Cargo.lock
), pleaserun
dd-rust-license-tool write
to regenerate the license inventory and commit the changes (if any). More details here.References
#16369