Hello , i want to know if there is any way to supervize and monitor log ingestion from FEEDs.
We have multiple log source ( FEED) and i want to get notified if one of the feed stopped sending logs .
Thanks
Feed Monitoring
- Silver 2
+4Hi Rached1996,
One method to monitor when an ingest source stops sending is the metric absence function of GCP Cloud Monitoring. I've linked the docs below and also here is a guide by Chris Martin on how to get things set up. He goes over forwarder monitoring but feed monitoring configuration as well.
https://cloud.google.com/monitoring/alerts/metric-absence
https://medium.com/@thatsiemguy/chronicle-forwarder-telemetry-via-google-cloud-monitoring-39ccb32b3853
Hope this helps.
Im also looking for a similar kind of Yara rule
Looking for any log source stop log feed that need an alert or shows detections. Its not working.
Suggestions are very helpful and also alternative solutions please!
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.