[ESS] [8.16] Ingest Sysdig Falco data to Elasticsearch #6027
Conversation
|
A documentation preview will be available soon. Request a new doc build by commenting
If your PR continues to fail for an unknown reason, the doc build pipeline may be broken. Elastic employees can check the pipeline status here. |
There was a problem hiding this comment.
Overall this is an awesome start 🚀 , @benironside. Your efforts are much appreciated 🙏. .
| .. `ELASTICSEARCH_HOSTPORT`: your {es} endpoint URL, which can be found under **Connection details** on the upper right of the **Integrations** page in {kib}. | ||
| .. `ELASTICSEARCH_INDEX`: the {es} index where you want to store Falco logs. | ||
| .. `ELASTICSEARCH_SUFFIX`: The frequency with which you want the {es} index suffix to change. Either `daily`, `monthly`, `annually`, or `none`. | ||
| .. `ELASTICSEARCH_USERNAME` and `ELASTICSEARCH_PASSWORD`: the username and password for an account on your {es} instance, with at least the following permissions: Which permissions, Nick? |
There was a problem hiding this comment.
You can add the following env vars to this list:
ELASTICSEARCH_APIKEY : The preferred way to connect to ES over username and password. Note that support for this env var is added post falcosidekick v2.29, which is the current latest as of writing this. But you could use it with Falcosidekick docker container as docker images with changes are pushed to falcosidekick docker hub much faster.
ELASTICSEARCH_INDEX : The most important thing is to set the index to match logs-falco.alerts-* . This is what the Falco ingest pipeline will match on.
Also worth mentioning that ELASTICSEARCH_USERNAME and ELASTICSEARCH_PASSWORD are only supported in ECH/ESS and not in serverless Elastic Cloud.
I'm intentionally not commenting on ELASTICSEARCH_MUTUALTLS and ELASTICSEARCH_CHECKCERT as I'm not 💯 certain on reasons for using it. I'll check with the team and get back on this.
|
continuing this work in #6046 since it touched related pages |
|
closing this issue since the work was added to #6046 |
2 participants
Fixes #6004 by creating a new guide for ingesting third-party alert data from cloud security tool Sysdig Falco, and a new section that contains that guide.
Previews: Ingest Falco data; Ingest third-party cloud security data