GCP/BigQuery を使用した調査データの取得

cloud_meta: auto

blob_storage_create_buckets_enabled: true
# blob_storage_create_buckets_enabled adds the ability for the sensor to create buckets
# if the bucket doesn't exist.By default this field is set to false.

investigations:

    enable_incremental_flush: true
    # enable_incremental_flush adds the ability to flush row groups rather than
    # writing files during each flush event.Enabling this will result in larger files
    # being created.By default this field is set to false.
    #
    # Minimum chunksizes for an incremental flush:
    # GCP: 256KB
    # AWS: 5MB
    # AZURE: 1MB

  reporting_interval: 10s
  # reporting_interval sets a time interval for forced flushes.
  # timeout set the amount of time allowed for investigations data to be written
  # to a sink.By default the timeout is 1/3 of the reporting_interval duration.
  # timeout: 90s
  # sinks are a list of destinations where investigations data should be sent.

  sinks:

    -   name: <investigations-metadata-bucket-name>

      backend: gcp
      # backend is the type of sink.
      # Supported backends:
      # "gcp": google cloud provider buckets
      # "aws": amazon S3 buckets
      # "azure": azure storage buckets

      automated: true

      type: parquet
            partition_format: "hostname_partition={{.Hostname}}/date_partition={{.Time.Format \"2006-01-02\"}}"
      # type is the file format.By default this field is set to parquet.
      # Supported types:
      # "parquet": writes data to the apache parquet format
      # "json": writes data to the json format

    flight_recorder:
        enabled: true
        tables:
        -   name: "shell_commands"
          enabled: true
        -   name: "tty_data"
          enabled: true
        -   name: "sensors"
          enabled: true
        -   name: "sensor_metadata"
          enabled: true
        -   name: "connections"
          enabled: true
        -   name: "process_events"
          enabled: true
        -   name: "container_events"
          enabled: true

resourcemanager.projects.get
storage.buckets.create
storage.hmacKeys.create
storage.objects.create