Skip to content

Commit

Permalink
Apply suggestions from code review
Browse files Browse the repository at this point in the history
Co-authored-by: Sandra Ocando <[email protected]>
  • Loading branch information
javimed and s-ocando authored Jul 19, 2023
1 parent 5b9a1b9 commit ffa69a4
Show file tree
Hide file tree
Showing 3 changed files with 5 additions and 5 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ Usage logs & storage logs

Google Cloud Storage offers `usage logs and storage logs <https://cloud.google.com/storage/docs/access-logs>`__, also known as access logs, in the form of CSV files that can be downloaded. Usage logs provide information for all of the requests made on a specified bucket and are created hourly. Storage logs provide information about the storage consumption of that bucket for the last day and are created daily. Once set up, usage logs and storage logs are automatically created as new objects in the specified bucket.

To process Storage and Access logs, Wazuh makes use of the **gcp-bucket** module. To configure manager and agent, check the :doc:`/user-manual/reference/ossec-conf/index` documentation. You can find information regarding the configuration of this module in the :ref:`gcp-bucket configuration reference <gcp-bucket>`.
To process Storage and Access logs, Wazuh makes use of the ``gcp-bucket`` module. Configure the ``gcp-bucket`` module either in the Wazuh manager or the Wazuh agent. To do so, modify the :doc:`ossec.conf </user-manual/reference/ossec-conf/index>` configuration file. Check the :ref:`gcp-bucket configuration reference <gcp-bucket>` to learn more.


Setting up log delivery to a Google Cloud Storage bucket
Expand Down
4 changes: 2 additions & 2 deletions source/cloud-security/github/monitoring-github-activity.rst
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ Wazuh configuration

Next, we will see the options we have to configure for the Wazuh integration.

Proceed to configure the ``github`` module in the Wazuh manager or in the Wazuh agent. To configure manager and agent, check the :doc:`/user-manual/reference/ossec-conf/index` documentation. We will use the data that we took previously as the **organization name** and the **PATs**. Through the following configuration, Wazuh is ready to search for logs created by GitHub audit-log. In this case, we will search only the type of ``git`` events within an interval of ``1m``. Those logs will be only those that were created after the module was started:
Configure the ``github`` module either in the Wazuh manager or the Wazuh agent. To do so, modify the :doc:`ossec.conf </user-manual/reference/ossec-conf/index>` configuration file. We will use the data that we took previously as the **organization name** and the **PATs**. Through the following configuration, Wazuh is ready to search for logs created by GitHub audit-log. In this case, we will search only the type of ``git`` events within an interval of ``1m``. Those logs will be only those that were created after the module was started:

.. code-block:: xml
Expand All @@ -57,7 +57,7 @@ Proceed to configure the ``github`` module in the Wazuh manager or in the Wazuh
</api_parameters>
</github>
Check :ref:`github-module` reference documentation for the module references.
To learn more, check the :ref:`github-module` module reference.

Using the configuration mentioned above, we will see an example of monitoring GitHub activity.

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ Wazuh configuration

Next, we will see the options we have to configure for the Wazuh integration.

Proceed to configure the ``office365`` module in the Wazuh manager or in the Wazuh agent. To configure manager and agent, check the :doc:`/user-manual/reference/ossec-conf/index` documentation. Through the following configuration, Wazuh is ready to search for logs created by Office 365 audit-log. In this case, we will only search for the ``Audit.SharePoint`` type events within an interval of ``1m``. Those logs will be only those that were created after the module was started:
Configure the ``office365`` module either in the Wazuh manager or the Wazuh agent. To do so, modify the :doc:`ossec.conf </user-manual/reference/ossec-conf/index>` configuration file. Through the following configuration, Wazuh is ready to search for logs created by Office 365 audit-log. In this case, we will only search for the ``Audit.SharePoint`` type events within an interval of ``1m``. Those logs will be only those that were created after the module was started:

.. code-block:: xml
Expand All @@ -125,7 +125,7 @@ Proceed to configure the ``office365`` module in the Wazuh manager or in the Waz
</subscriptions>
</office365>
Check :ref:`office365-module` reference documentation for the module references.
To learn more, check the :ref:`office365-module` module reference.

Using the configuration mentioned above, we will see an example of monitoring Office 365 activity.

Expand Down

0 comments on commit ffa69a4

Please sign in to comment.