ingest-vpc-flow-logs-gcp-ocsf
>-
Works with
--- name: ingest-vpc-flow-logs-gcp-ocsf description: >- license: Apache-2.0 --- # ingest-vpc-flow-logs-gcp-ocsf ## Use when - You have GCP VPC Flow Logs from Cloud Logging exports - You need OCSF Network Activity for downstream detection or storage - You want a parity path alongside AWS VPC Flow Logs and Azure NSG Flow Logs ## Do NOT use - On non-GCP network telemetry - On raw pcap or packet mirroring captures - As a detection skill; this only normalizes telemetry ## Input JSONL or a top-level JSON array of GCP VPC Flow Logs entries. Supports both: - full Cloud Logging `LogEntry` envelopes with `jsonPayload` - bare `jsonPayload`-style objects containing `connection`, `src_*`, `dest_*`, and counter fields ## Output By default, the skill emits OCSF 1.8 Network Activity (class `4001`) JSONL with: - `src_endpoint` / `dst_endpoint` - `traffic.bytes` and `traffic.packets` - `connection_info.protocol_*`, `direction`, and `boundary` - `cloud.provider = GCP` - `cloud.account.uid` from the project ## Native output format With `--output-format native`, the skill emits repo-native enriched JSONL with: - `schema_mode: "native"` - `canonical_schema_version` - `record_type: "network_activity"` - `event_uid` - `provider`, `account_uid`, `region` - `time_ms`, `start_time_ms`, `end_time_ms` - `activity_id`, `activity_name`, `status_id`, `status` - `src`, `dst`, `traffic`, `connection`, `cloud` - `disposition` - `source.kind = "gcp.vpc-flow-logs"` plus reporter and VPC context Native output is not raw GCP JSON and not a stripped OCSF envelope. It is the repo's stable network-activity schema rendered from the same canonical internal record as the OCSF path. ## Usage ```bash python skills/ingestion/ingest-vpc-flow-logs-gcp-ocsf/src/ingest.py --output-format native sample.jsonl ``` ## Notes - `disposition` maps to OCSF activity IDs where present; when absent, records default to accepted traffic - byte and packet counters are aggregated across both directions when both are present - timestamps preserve flow `start_time` / `end_time` when the source provides them
More DevOps & Infrastructure skills
azure-ai
microsoft/azure-skills
Use for Azure AI: Search, Speech, OpenAI, Document Intelligence. Helps with search, vector/hybrid search, speech-to-text, text-to-speech, transcription, OCR. WHEN: AI Search, query search, vector search, hybrid search, semantic search, speech-to-text, text-to-speech, transcribe, OCR, convert text to speech.
appinsights-instrumentation
microsoft/azure-skills
Guidance for instrumenting webapps with Azure Application Insights. Provides telemetry patterns, SDK setup, and configuration references. WHEN: how to instrument app, App Insights SDK, telemetry patterns, what is App Insights, Application Insights guidance, instrumentation examples, APM best practices.
azure-storage
microsoft/azure-skills
Azure Storage Services including Blob Storage, File Shares, Queue Storage, Table Storage, and Data Lake. Answers questions about storage access tiers (hot, cool, cold, archive), when to use each tier, and tier comparison. Provides object storage, SMB file shares, async messaging, NoSQL key-value, and big data analytics. Includes lifecycle management. USE FOR: blob storage, file shares, queue storage, table storage, data lake, upload files, download blobs, storage accounts, access tiers, storage tiers, hot cool cold archive, storage tier comparison, when to use storage tiers, lifecycle management, Azure Storage concepts. DO NOT USE FOR: SQL databases, Cosmos DB (use azure-prepare), messaging with Event Hubs or Service Bus (use azure-messaging).
