Exporting Alerts to Google Cloud Pub/Sub

Introduction

Pub/Sub is an asynchronous messaging service that decouples services that produce events from services that process events.

You can use Pub/Sub as messaging-oriented middleware or event ingestion and delivery for streaming analytics pipelines.

Setting up pub/sub to receive alerts

Login to the pub/sub project and create a topic to send the alerts following the below steps

1. Click on CREATE TOPIC and add the topic id. This id will be used in the sensor set up later.

2. The checkboxes can be left unchecked while creating a topic.

Setting up sensor to send the alerts to pub/sub

The following output require an existing pubsub project and topic. It also requires that the a service account with pubsub.topics.publish 

# Send alerts to alert topic in the pubsub in capsule8 project with credentials
alert_output:
  outputs:
    - type: pubsub
      enabled: true
      project_name: capsule8
      topic_id: alert
      credentials_json: /home/ubuntu/.gcp/credentials.json

Alternatively GOOGLE_APPLICATION_CREDENTIALS can be set to point to the credentials.json and then credentials_json can be omitted:

# Send alerts to alert topic in the pubsub in capsule8 project with credentials
alert_output:
  outputs:
    - type: pubsub
      enabled: true
      project_name: capsule8
      topic_id: alert

Optionally with some additional permissions you may also enable the option to check that the topic and project are valid at start-up.

alert_output:
  outputs:
    - type: pubsub
      enabled: true
      project_name: capsule8
      topic_id: alert
      validate_topic: true

The additional permissions are:

• pubsub.schemas.get
• pubsub.schemas.list
• pubsub.snapshots.get
• pubsub.snapshots.list
• pubsub.subscriptions.get
• pubsub.subscriptions.list
• pubsub.topics.get
• pubsub.topics.list
• resourcemanager.projects.get
• serviceusage.quotas.get
• serviceusage.services.get
• serviceusage.services.list