gcp.chronicle.Feed

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

// This is a basic example for Terraform support in Chronicle feeds APIs.
const exampleFeed = new gcp.chronicle.Feed("example_feed", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    displayName: "test-feeds",
    details: {
        feedSourceType: "HTTPS_PUSH_GOOGLE_CLOUD_PUBSUB",
        logType: "projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT",
        httpsPushGoogleCloudPubsubSettings: {
            splitDelimiter: "\n",
        },
    },
});

import pulumi
import pulumi_gcp as gcp

# This is a basic example for Terraform support in Chronicle feeds APIs.
example_feed = gcp.chronicle.Feed("example_feed",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    display_name="test-feeds",
    details={
        "feed_source_type": "HTTPS_PUSH_GOOGLE_CLOUD_PUBSUB",
        "log_type": "projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT",
        "https_push_google_cloud_pubsub_settings": {
            "split_delimiter": "\n",
        },
    })

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// This is a basic example for Terraform support in Chronicle feeds APIs.
		_, err := chronicle.NewFeed(ctx, "example_feed", &chronicle.FeedArgs{
			Location:    pulumi.String("us"),
			Instance:    pulumi.String("00000000-0000-0000-0000-000000000000"),
			DisplayName: pulumi.String("test-feeds"),
			Details: &chronicle.FeedDetailsArgs{
				FeedSourceType: pulumi.String("HTTPS_PUSH_GOOGLE_CLOUD_PUBSUB"),
				LogType:        pulumi.String("projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT"),
				HttpsPushGoogleCloudPubsubSettings: &chronicle.FeedDetailsHttpsPushGoogleCloudPubsubSettingsArgs{
					SplitDelimiter: pulumi.String("\n"),
				},
			},
		})
		if err != nil {
			return err
		}
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    // This is a basic example for Terraform support in Chronicle feeds APIs.
    var exampleFeed = new Gcp.Chronicle.Feed("example_feed", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        DisplayName = "test-feeds",
        Details = new Gcp.Chronicle.Inputs.FeedDetailsArgs
        {
            FeedSourceType = "HTTPS_PUSH_GOOGLE_CLOUD_PUBSUB",
            LogType = "projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT",
            HttpsPushGoogleCloudPubsubSettings = new Gcp.Chronicle.Inputs.FeedDetailsHttpsPushGoogleCloudPubsubSettingsArgs
            {
                SplitDelimiter = @"
",
            },
        },
    });

});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.chronicle.Feed;
import com.pulumi.gcp.chronicle.FeedArgs;
import com.pulumi.gcp.chronicle.inputs.FeedDetailsArgs;
import com.pulumi.gcp.chronicle.inputs.FeedDetailsHttpsPushGoogleCloudPubsubSettingsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // This is a basic example for Terraform support in Chronicle feeds APIs.
        var exampleFeed = new Feed("exampleFeed", FeedArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .displayName("test-feeds")
            .details(FeedDetailsArgs.builder()
                .feedSourceType("HTTPS_PUSH_GOOGLE_CLOUD_PUBSUB")
                .logType("projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT")
                .httpsPushGoogleCloudPubsubSettings(FeedDetailsHttpsPushGoogleCloudPubsubSettingsArgs.builder()
                    .splitDelimiter("""

                    """)
                    .build())
                .build())
            .build());

    }
}

resources:
  # This is a basic example for Terraform support in Chronicle feeds APIs.
  exampleFeed:
    type: gcp:chronicle:Feed
    name: example_feed
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      displayName: test-feeds
      details:
        feedSourceType: HTTPS_PUSH_GOOGLE_CLOUD_PUBSUB
        logType: projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT
        httpsPushGoogleCloudPubsubSettings:
          splitDelimiter: |2+

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

// This is an example of a Chronicle feed using the pre_create hook to fetch the service account.
// Valid for source type: GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN and GOOGLE_CLOUD_STORAGE.
// 0. Get the project's GCS service account (for Storage Notifications)
const gcsAccount = gcp.storage.getProjectServiceAccount({
    project: "my-project-name",
});
// 1. Create the Pub/Sub Topic
const testTopic = new gcp.pubsub.Topic("test_topic", {
    name: "chronicle-test-topic-my-project-name-_85840",
    project: "my-project-name",
});
// 2. Grant GCS permission to publish to the topic
// This must remain so GCS can send file notifications to Pub/Sub
const gcsPublisher = new gcp.pubsub.TopicIAMMember("gcs_publisher", {
    topic: testTopic.name,
    role: "roles/pubsub.publisher",
    member: gcsAccount.then(gcsAccount => `serviceAccount:${gcsAccount.emailAddress}`),
});
// 3. Create the Pub/Sub Subscription
const testSubscription = new gcp.pubsub.Subscription("test_subscription", {
    name: "chronicle-test-sub-my-project-name-_60302",
    project: "my-project-name",
    topic: testTopic.name,
    messageRetentionDuration: "1200s",
});
// 4. Define the GCS Bucket
const testBucket = new gcp.storage.Bucket("test_bucket", {
    name: "chronicle-test-bucket-my-project-name-_22811",
    project: "my-project-name",
    location: "US",
    forceDestroy: true,
});
// 5. Link GCS bucket to Pub/Sub Topic
const notification = new gcp.storage.Notification("notification", {
    bucket: testBucket.name,
    payloadFormat: "JSON_API_V1",
    topic: testTopic.id,
    eventTypes: ["OBJECT_FINALIZE"],
}, {
    dependsOn: [gcsPublisher],
});
// 6. The Chronicle Feed Resource
// The required permissions (Storage Admin and Pub/Sub Subscriber) are assumed to be
// granted manually at the project level prior to running this test.
const exampleFeed = new gcp.chronicle.Feed("example_feed", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    displayName: "test-feeds",
    details: {
        feedSourceType: "GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN",
        logType: "projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT",
        googleCloudStorageEventDrivenSettings: {
            bucketUri: pulumi.interpolate`gs://${testBucket.name}`,
            pubsubSubscription: pulumi.interpolate`projects/my-project-name/subscriptions/${testSubscription.name}`,
            maxLookbackDays: 90,
        },
    },
}, {
    dependsOn: [notification],
});
export const fetchedFeedServiceAccount = exampleFeed.feedServiceAccount;

import pulumi
import pulumi_gcp as gcp

# This is an example of a Chronicle feed using the pre_create hook to fetch the service account.
# Valid for source type: GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN and GOOGLE_CLOUD_STORAGE.
# 0. Get the project's GCS service account (for Storage Notifications)
gcs_account = gcp.storage.get_project_service_account(project="my-project-name")
# 1. Create the Pub/Sub Topic
test_topic = gcp.pubsub.Topic("test_topic",
    name="chronicle-test-topic-my-project-name-_85840",
    project="my-project-name")
# 2. Grant GCS permission to publish to the topic
# This must remain so GCS can send file notifications to Pub/Sub
gcs_publisher = gcp.pubsub.TopicIAMMember("gcs_publisher",
    topic=test_topic.name,
    role="roles/pubsub.publisher",
    member=f"serviceAccount:{gcs_account.email_address}")
# 3. Create the Pub/Sub Subscription
test_subscription = gcp.pubsub.Subscription("test_subscription",
    name="chronicle-test-sub-my-project-name-_60302",
    project="my-project-name",
    topic=test_topic.name,
    message_retention_duration="1200s")
# 4. Define the GCS Bucket
test_bucket = gcp.storage.Bucket("test_bucket",
    name="chronicle-test-bucket-my-project-name-_22811",
    project="my-project-name",
    location="US",
    force_destroy=True)
# 5. Link GCS bucket to Pub/Sub Topic
notification = gcp.storage.Notification("notification",
    bucket=test_bucket.name,
    payload_format="JSON_API_V1",
    topic=test_topic.id,
    event_types=["OBJECT_FINALIZE"],
    opts = pulumi.ResourceOptions(depends_on=[gcs_publisher]))
# 6. The Chronicle Feed Resource
# The required permissions (Storage Admin and Pub/Sub Subscriber) are assumed to be
# granted manually at the project level prior to running this test.
example_feed = gcp.chronicle.Feed("example_feed",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    display_name="test-feeds",
    details={
        "feed_source_type": "GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN",
        "log_type": "projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT",
        "google_cloud_storage_event_driven_settings": {
            "bucket_uri": test_bucket.name.apply(lambda name: f"gs://{name}"),
            "pubsub_subscription": test_subscription.name.apply(lambda name: f"projects/my-project-name/subscriptions/{name}"),
            "max_lookback_days": 90,
        },
    },
    opts = pulumi.ResourceOptions(depends_on=[notification]))
pulumi.export("fetchedFeedServiceAccount", example_feed.feed_service_account)

package main

import (
	"fmt"

	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/pubsub"
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/storage"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// This is an example of a Chronicle feed using the pre_create hook to fetch the service account.
		// Valid for source type: GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN and GOOGLE_CLOUD_STORAGE.
		// 0. Get the project's GCS service account (for Storage Notifications)
		gcsAccount, err := storage.GetProjectServiceAccount(ctx, &storage.GetProjectServiceAccountArgs{
			Project: pulumi.StringRef("my-project-name"),
		}, nil)
		if err != nil {
			return err
		}
		// 1. Create the Pub/Sub Topic
		testTopic, err := pubsub.NewTopic(ctx, "test_topic", &pubsub.TopicArgs{
			Name:    pulumi.String("chronicle-test-topic-my-project-name-_85840"),
			Project: pulumi.String("my-project-name"),
		})
		if err != nil {
			return err
		}
		// 2. Grant GCS permission to publish to the topic
		// This must remain so GCS can send file notifications to Pub/Sub
		gcsPublisher, err := pubsub.NewTopicIAMMember(ctx, "gcs_publisher", &pubsub.TopicIAMMemberArgs{
			Topic:  testTopic.Name,
			Role:   pulumi.String("roles/pubsub.publisher"),
			Member: pulumi.Sprintf("serviceAccount:%v", gcsAccount.EmailAddress),
		})
		if err != nil {
			return err
		}
		// 3. Create the Pub/Sub Subscription
		testSubscription, err := pubsub.NewSubscription(ctx, "test_subscription", &pubsub.SubscriptionArgs{
			Name:                     pulumi.String("chronicle-test-sub-my-project-name-_60302"),
			Project:                  pulumi.String("my-project-name"),
			Topic:                    testTopic.Name,
			MessageRetentionDuration: pulumi.String("1200s"),
		})
		if err != nil {
			return err
		}
		// 4. Define the GCS Bucket
		testBucket, err := storage.NewBucket(ctx, "test_bucket", &storage.BucketArgs{
			Name:         pulumi.String("chronicle-test-bucket-my-project-name-_22811"),
			Project:      pulumi.String("my-project-name"),
			Location:     pulumi.String("US"),
			ForceDestroy: pulumi.Bool(true),
		})
		if err != nil {
			return err
		}
		// 5. Link GCS bucket to Pub/Sub Topic
		notification, err := storage.NewNotification(ctx, "notification", &storage.NotificationArgs{
			Bucket:        testBucket.Name,
			PayloadFormat: pulumi.String("JSON_API_V1"),
			Topic:         testTopic.ID(),
			EventTypes: pulumi.StringArray{
				pulumi.String("OBJECT_FINALIZE"),
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			gcsPublisher,
		}))
		if err != nil {
			return err
		}
		// 6. The Chronicle Feed Resource
		// The required permissions (Storage Admin and Pub/Sub Subscriber) are assumed to be
		// granted manually at the project level prior to running this test.
		exampleFeed, err := chronicle.NewFeed(ctx, "example_feed", &chronicle.FeedArgs{
			Location:    pulumi.String("us"),
			Instance:    pulumi.String("00000000-0000-0000-0000-000000000000"),
			DisplayName: pulumi.String("test-feeds"),
			Details: &chronicle.FeedDetailsArgs{
				FeedSourceType: pulumi.String("GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN"),
				LogType:        pulumi.String("projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT"),
				GoogleCloudStorageEventDrivenSettings: &chronicle.FeedDetailsGoogleCloudStorageEventDrivenSettingsArgs{
					BucketUri: testBucket.Name.ApplyT(func(name string) (string, error) {
						return fmt.Sprintf("gs://%v", name), nil
					}).(pulumi.StringOutput),
					PubsubSubscription: testSubscription.Name.ApplyT(func(name string) (string, error) {
						return fmt.Sprintf("projects/my-project-name/subscriptions/%v", name), nil
					}).(pulumi.StringOutput),
					MaxLookbackDays: pulumi.Int(90),
				},
			},
		}, pulumi.DependsOn([]pulumi.Resource{
			notification,
		}))
		if err != nil {
			return err
		}
		ctx.Export("fetchedFeedServiceAccount", exampleFeed.FeedServiceAccount)
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    // This is an example of a Chronicle feed using the pre_create hook to fetch the service account.
    // Valid for source type: GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN and GOOGLE_CLOUD_STORAGE.
    // 0. Get the project's GCS service account (for Storage Notifications)
    var gcsAccount = Gcp.Storage.GetProjectServiceAccount.Invoke(new()
    {
        Project = "my-project-name",
    });

    // 1. Create the Pub/Sub Topic
    var testTopic = new Gcp.PubSub.Topic("test_topic", new()
    {
        Name = "chronicle-test-topic-my-project-name-_85840",
        Project = "my-project-name",
    });

    // 2. Grant GCS permission to publish to the topic
    // This must remain so GCS can send file notifications to Pub/Sub
    var gcsPublisher = new Gcp.PubSub.TopicIAMMember("gcs_publisher", new()
    {
        Topic = testTopic.Name,
        Role = "roles/pubsub.publisher",
        Member = $"serviceAccount:{gcsAccount.Apply(getProjectServiceAccountResult => getProjectServiceAccountResult.EmailAddress)}",
    });

    // 3. Create the Pub/Sub Subscription
    var testSubscription = new Gcp.PubSub.Subscription("test_subscription", new()
    {
        Name = "chronicle-test-sub-my-project-name-_60302",
        Project = "my-project-name",
        Topic = testTopic.Name,
        MessageRetentionDuration = "1200s",
    });

    // 4. Define the GCS Bucket
    var testBucket = new Gcp.Storage.Bucket("test_bucket", new()
    {
        Name = "chronicle-test-bucket-my-project-name-_22811",
        Project = "my-project-name",
        Location = "US",
        ForceDestroy = true,
    });

    // 5. Link GCS bucket to Pub/Sub Topic
    var notification = new Gcp.Storage.Notification("notification", new()
    {
        Bucket = testBucket.Name,
        PayloadFormat = "JSON_API_V1",
        Topic = testTopic.Id,
        EventTypes = new[]
        {
            "OBJECT_FINALIZE",
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            gcsPublisher,
        },
    });

    // 6. The Chronicle Feed Resource
    // The required permissions (Storage Admin and Pub/Sub Subscriber) are assumed to be
    // granted manually at the project level prior to running this test.
    var exampleFeed = new Gcp.Chronicle.Feed("example_feed", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        DisplayName = "test-feeds",
        Details = new Gcp.Chronicle.Inputs.FeedDetailsArgs
        {
            FeedSourceType = "GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN",
            LogType = "projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT",
            GoogleCloudStorageEventDrivenSettings = new Gcp.Chronicle.Inputs.FeedDetailsGoogleCloudStorageEventDrivenSettingsArgs
            {
                BucketUri = testBucket.Name.Apply(name => $"gs://{name}"),
                PubsubSubscription = testSubscription.Name.Apply(name => $"projects/my-project-name/subscriptions/{name}"),
                MaxLookbackDays = 90,
            },
        },
    }, new CustomResourceOptions
    {
        DependsOn =
        {
            notification,
        },
    });

    return new Dictionary<string, object?>
    {
        ["fetchedFeedServiceAccount"] = exampleFeed.FeedServiceAccount,
    };
});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.storage.StorageFunctions;
import com.pulumi.gcp.storage.inputs.GetProjectServiceAccountArgs;
import com.pulumi.gcp.pubsub.Topic;
import com.pulumi.gcp.pubsub.TopicArgs;
import com.pulumi.gcp.pubsub.TopicIAMMember;
import com.pulumi.gcp.pubsub.TopicIAMMemberArgs;
import com.pulumi.gcp.pubsub.Subscription;
import com.pulumi.gcp.pubsub.SubscriptionArgs;
import com.pulumi.gcp.storage.Bucket;
import com.pulumi.gcp.storage.BucketArgs;
import com.pulumi.gcp.storage.Notification;
import com.pulumi.gcp.storage.NotificationArgs;
import com.pulumi.gcp.chronicle.Feed;
import com.pulumi.gcp.chronicle.FeedArgs;
import com.pulumi.gcp.chronicle.inputs.FeedDetailsArgs;
import com.pulumi.gcp.chronicle.inputs.FeedDetailsGoogleCloudStorageEventDrivenSettingsArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // This is an example of a Chronicle feed using the pre_create hook to fetch the service account.
        // Valid for source type: GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN and GOOGLE_CLOUD_STORAGE.
        // 0. Get the project's GCS service account (for Storage Notifications)
        final var gcsAccount = StorageFunctions.getProjectServiceAccount(GetProjectServiceAccountArgs.builder()
            .project("my-project-name")
            .build());

        // 1. Create the Pub/Sub Topic
        var testTopic = new Topic("testTopic", TopicArgs.builder()
            .name("chronicle-test-topic-my-project-name-_85840")
            .project("my-project-name")
            .build());

        // 2. Grant GCS permission to publish to the topic
        // This must remain so GCS can send file notifications to Pub/Sub
        var gcsPublisher = new TopicIAMMember("gcsPublisher", TopicIAMMemberArgs.builder()
            .topic(testTopic.name())
            .role("roles/pubsub.publisher")
            .member(String.format("serviceAccount:%s", gcsAccount.emailAddress()))
            .build());

        // 3. Create the Pub/Sub Subscription
        var testSubscription = new Subscription("testSubscription", SubscriptionArgs.builder()
            .name("chronicle-test-sub-my-project-name-_60302")
            .project("my-project-name")
            .topic(testTopic.name())
            .messageRetentionDuration("1200s")
            .build());

        // 4. Define the GCS Bucket
        var testBucket = new Bucket("testBucket", BucketArgs.builder()
            .name("chronicle-test-bucket-my-project-name-_22811")
            .project("my-project-name")
            .location("US")
            .forceDestroy(true)
            .build());

        // 5. Link GCS bucket to Pub/Sub Topic
        var notification = new Notification("notification", NotificationArgs.builder()
            .bucket(testBucket.name())
            .payloadFormat("JSON_API_V1")
            .topic(testTopic.id())
            .eventTypes("OBJECT_FINALIZE")
            .build(), CustomResourceOptions.builder()
                .dependsOn(gcsPublisher)
                .build());

        // 6. The Chronicle Feed Resource
        // The required permissions (Storage Admin and Pub/Sub Subscriber) are assumed to be
        // granted manually at the project level prior to running this test.
        var exampleFeed = new Feed("exampleFeed", FeedArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .displayName("test-feeds")
            .details(FeedDetailsArgs.builder()
                .feedSourceType("GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN")
                .logType("projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT")
                .googleCloudStorageEventDrivenSettings(FeedDetailsGoogleCloudStorageEventDrivenSettingsArgs.builder()
                    .bucketUri(testBucket.name().applyValue(_name -> String.format("gs://%s", _name)))
                    .pubsubSubscription(testSubscription.name().applyValue(_name -> String.format("projects/my-project-name/subscriptions/%s", _name)))
                    .maxLookbackDays(90)
                    .build())
                .build())
            .build(), CustomResourceOptions.builder()
                .dependsOn(notification)
                .build());

        ctx.export("fetchedFeedServiceAccount", exampleFeed.feedServiceAccount());
    }
}

resources:
  # 1. Create the Pub/Sub Topic
  testTopic:
    type: gcp:pubsub:Topic
    name: test_topic
    properties:
      name: chronicle-test-topic-my-project-name-_85840
      project: my-project-name
  # 2. Grant GCS permission to publish to the topic
  # This must remain so GCS can send file notifications to Pub/Sub
  gcsPublisher:
    type: gcp:pubsub:TopicIAMMember
    name: gcs_publisher
    properties:
      topic: ${testTopic.name}
      role: roles/pubsub.publisher
      member: serviceAccount:${gcsAccount.emailAddress}
  # 3. Create the Pub/Sub Subscription
  testSubscription:
    type: gcp:pubsub:Subscription
    name: test_subscription
    properties:
      name: chronicle-test-sub-my-project-name-_60302
      project: my-project-name
      topic: ${testTopic.name}
      messageRetentionDuration: 1200s
  # 4. Define the GCS Bucket
  testBucket:
    type: gcp:storage:Bucket
    name: test_bucket
    properties:
      name: chronicle-test-bucket-my-project-name-_22811
      project: my-project-name
      location: US
      forceDestroy: true
  # 5. Link GCS bucket to Pub/Sub Topic
  notification:
    type: gcp:storage:Notification
    properties:
      bucket: ${testBucket.name}
      payloadFormat: JSON_API_V1
      topic: ${testTopic.id}
      eventTypes:
        - OBJECT_FINALIZE
    options:
      dependsOn:
        - ${gcsPublisher}
  # 6. The Chronicle Feed Resource
  # The required permissions (Storage Admin and Pub/Sub Subscriber) are assumed to be
  # granted manually at the project level prior to running this test.
  exampleFeed:
    type: gcp:chronicle:Feed
    name: example_feed
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      displayName: test-feeds
      details:
        feedSourceType: GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN
        logType: projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT
        googleCloudStorageEventDrivenSettings:
          bucketUri: gs://${testBucket.name}
          pubsubSubscription: projects/my-project-name/subscriptions/${testSubscription.name}
          maxLookbackDays: 90
    options:
      dependsOn:
        - ${notification}
variables:
  # This is an example of a Chronicle feed using the pre_create hook to fetch the service account.
  # Valid for source type: GOOGLE_CLOUD_STORAGE_EVENT_DRIVEN and GOOGLE_CLOUD_STORAGE.

  # 0. Get the project's GCS service account (for Storage Notifications)
  gcsAccount:
    fn::invoke:
      function: gcp:storage:getProjectServiceAccount
      arguments:
        project: my-project-name
outputs:
  # 7. Output the dynamically fetched service account to prove the pre_create hook worked
  fetchedFeedServiceAccount: ${exampleFeed.feedServiceAccount}

import * as pulumi from "@pulumi/pulumi";
import * as gcp from "@pulumi/gcp";

// This is an example of a Chronicle feed using the post_create hook to fetch the secret.
// Valid for source type: HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE.
const exampleFeed = new gcp.chronicle.Feed("example_feed", {
    location: "us",
    instance: "00000000-0000-0000-0000-000000000000",
    displayName: "test-feeds",
    details: {
        feedSourceType: "HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE",
        logType: "projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT",
        httpsPushAmazonKinesisFirehoseSettings: {
            splitDelimiter: "\n",
        },
    },
});
export const feedSecret = exampleFeed.secret;

import pulumi
import pulumi_gcp as gcp

# This is an example of a Chronicle feed using the post_create hook to fetch the secret.
# Valid for source type: HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE.
example_feed = gcp.chronicle.Feed("example_feed",
    location="us",
    instance="00000000-0000-0000-0000-000000000000",
    display_name="test-feeds",
    details={
        "feed_source_type": "HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE",
        "log_type": "projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT",
        "https_push_amazon_kinesis_firehose_settings": {
            "split_delimiter": "\n",
        },
    })
pulumi.export("feedSecret", example_feed.secret)

package main

import (
	"github.com/pulumi/pulumi-gcp/sdk/v9/go/gcp/chronicle"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		// This is an example of a Chronicle feed using the post_create hook to fetch the secret.
		// Valid for source type: HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE.
		exampleFeed, err := chronicle.NewFeed(ctx, "example_feed", &chronicle.FeedArgs{
			Location:    pulumi.String("us"),
			Instance:    pulumi.String("00000000-0000-0000-0000-000000000000"),
			DisplayName: pulumi.String("test-feeds"),
			Details: &chronicle.FeedDetailsArgs{
				FeedSourceType: pulumi.String("HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE"),
				LogType:        pulumi.String("projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT"),
				HttpsPushAmazonKinesisFirehoseSettings: &chronicle.FeedDetailsHttpsPushAmazonKinesisFirehoseSettingsArgs{
					SplitDelimiter: pulumi.String("\n"),
				},
			},
		})
		if err != nil {
			return err
		}
		ctx.Export("feedSecret", exampleFeed.Secret)
		return nil
	})
}

using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Gcp = Pulumi.Gcp;

return await Deployment.RunAsync(() => 
{
    // This is an example of a Chronicle feed using the post_create hook to fetch the secret.
    // Valid for source type: HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE.
    var exampleFeed = new Gcp.Chronicle.Feed("example_feed", new()
    {
        Location = "us",
        Instance = "00000000-0000-0000-0000-000000000000",
        DisplayName = "test-feeds",
        Details = new Gcp.Chronicle.Inputs.FeedDetailsArgs
        {
            FeedSourceType = "HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE",
            LogType = "projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT",
            HttpsPushAmazonKinesisFirehoseSettings = new Gcp.Chronicle.Inputs.FeedDetailsHttpsPushAmazonKinesisFirehoseSettingsArgs
            {
                SplitDelimiter = @"
",
            },
        },
    });

    return new Dictionary<string, object?>
    {
        ["feedSecret"] = exampleFeed.Secret,
    };
});

package generated_program;

import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.gcp.chronicle.Feed;
import com.pulumi.gcp.chronicle.FeedArgs;
import com.pulumi.gcp.chronicle.inputs.FeedDetailsArgs;
import com.pulumi.gcp.chronicle.inputs.FeedDetailsHttpsPushAmazonKinesisFirehoseSettingsArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;

public class App {
    public static void main(String[] args) {
        Pulumi.run(App::stack);
    }

    public static void stack(Context ctx) {
        // This is an example of a Chronicle feed using the post_create hook to fetch the secret.
        // Valid for source type: HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE.
        var exampleFeed = new Feed("exampleFeed", FeedArgs.builder()
            .location("us")
            .instance("00000000-0000-0000-0000-000000000000")
            .displayName("test-feeds")
            .details(FeedDetailsArgs.builder()
                .feedSourceType("HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE")
                .logType("projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT")
                .httpsPushAmazonKinesisFirehoseSettings(FeedDetailsHttpsPushAmazonKinesisFirehoseSettingsArgs.builder()
                    .splitDelimiter("""

                    """)
                    .build())
                .build())
            .build());

        ctx.export("feedSecret", exampleFeed.secret());
    }
}

resources:
  # This is an example of a Chronicle feed using the post_create hook to fetch the secret.
  # Valid for source type: HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE.
  exampleFeed:
    type: gcp:chronicle:Feed
    name: example_feed
    properties:
      location: us
      instance: 00000000-0000-0000-0000-000000000000
      displayName: test-feeds
      details:
        feedSourceType: HTTPS_PUSH_AMAZON_KINESIS_FIREHOSE
        logType: projects/my-project-name/locations/us/instances/00000000-0000-0000-0000-000000000000/logTypes/GCP_CLOUDAUDIT
        httpsPushAmazonKinesisFirehoseSettings:
          splitDelimiter: |2+
outputs:
  feedSecret: ${exampleFeed.secret}

var feedResource = new Gcp.Chronicle.Feed("feedResource", new()
{
    Instance = "string",
    Location = "string",
    Details = new Gcp.Chronicle.Inputs.FeedDetailsArgs
    {
        LogType = "string",
        AmazonKinesisFirehoseSettings = null,
        AmazonS3Settings = new Gcp.Chronicle.Inputs.FeedDetailsAmazonS3SettingsArgs
        {
            S3Uri = "string",
            SourceDeletionOption = "string",
            SourceType = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAmazonS3SettingsAuthenticationArgs
            {
                Region = "string",
                AccessKeyId = "string",
                ClientId = "string",
                ClientSecret = "string",
                RefreshUri = "string",
                SecretAccessKey = "string",
            },
        },
        AmazonS3V2Settings = new Gcp.Chronicle.Inputs.FeedDetailsAmazonS3V2SettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAmazonS3V2SettingsAuthenticationArgs
            {
                AccessKeySecretAuth = new Gcp.Chronicle.Inputs.FeedDetailsAmazonS3V2SettingsAuthenticationAccessKeySecretAuthArgs
                {
                    AccessKeyId = "string",
                    SecretAccessKey = "string",
                },
                AwsIamRoleAuth = new Gcp.Chronicle.Inputs.FeedDetailsAmazonS3V2SettingsAuthenticationAwsIamRoleAuthArgs
                {
                    AwsIamRoleArn = "string",
                    SubjectId = "string",
                },
            },
            S3Uri = "string",
            ChronicleServiceAccount = "string",
            MaxLookbackDays = 0,
            SourceDeletionOption = "string",
        },
        AmazonSqsSettings = new Gcp.Chronicle.Inputs.FeedDetailsAmazonSqsSettingsArgs
        {
            AccountNumber = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAmazonSqsSettingsAuthenticationArgs
            {
                AdditionalS3AccessKeySecretAuth = new Gcp.Chronicle.Inputs.FeedDetailsAmazonSqsSettingsAuthenticationAdditionalS3AccessKeySecretAuthArgs
                {
                    AccessKeyId = "string",
                    SecretAccessKey = "string",
                },
                SqsAccessKeySecretAuth = new Gcp.Chronicle.Inputs.FeedDetailsAmazonSqsSettingsAuthenticationSqsAccessKeySecretAuthArgs
                {
                    AccessKeyId = "string",
                    SecretAccessKey = "string",
                },
            },
            Queue = "string",
            Region = "string",
            SourceDeletionOption = "string",
        },
        AmazonSqsV2Settings = new Gcp.Chronicle.Inputs.FeedDetailsAmazonSqsV2SettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAmazonSqsV2SettingsAuthenticationArgs
            {
                AwsIamRoleAuth = new Gcp.Chronicle.Inputs.FeedDetailsAmazonSqsV2SettingsAuthenticationAwsIamRoleAuthArgs
                {
                    AwsIamRoleArn = "string",
                    SubjectId = "string",
                },
                SqsV2AccessKeySecretAuth = new Gcp.Chronicle.Inputs.FeedDetailsAmazonSqsV2SettingsAuthenticationSqsV2AccessKeySecretAuthArgs
                {
                    AccessKeyId = "string",
                    SecretAccessKey = "string",
                },
            },
            Queue = "string",
            S3Uri = "string",
            ChronicleServiceAccount = "string",
            MaxLookbackDays = 0,
            SourceDeletionOption = "string",
        },
        AnomaliSettings = new Gcp.Chronicle.Inputs.FeedDetailsAnomaliSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAnomaliSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
        },
        AssetNamespace = "string",
        AwsEc2HostsSettings = new Gcp.Chronicle.Inputs.FeedDetailsAwsEc2HostsSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAwsEc2HostsSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
        },
        AwsEc2InstancesSettings = new Gcp.Chronicle.Inputs.FeedDetailsAwsEc2InstancesSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAwsEc2InstancesSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
        },
        AwsEc2VpcsSettings = new Gcp.Chronicle.Inputs.FeedDetailsAwsEc2VpcsSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAwsEc2VpcsSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
        },
        AwsIamSettings = new Gcp.Chronicle.Inputs.FeedDetailsAwsIamSettingsArgs
        {
            ApiType = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAwsIamSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
        },
        AzureAdAuditSettings = new Gcp.Chronicle.Inputs.FeedDetailsAzureAdAuditSettingsArgs
        {
            AuthEndpoint = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAzureAdAuditSettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
            },
            Hostname = "string",
            TenantId = "string",
        },
        AzureAdContextSettings = new Gcp.Chronicle.Inputs.FeedDetailsAzureAdContextSettingsArgs
        {
            AuthEndpoint = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAzureAdContextSettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
            },
            Hostname = "string",
            RetrieveDevices = false,
            RetrieveGroups = false,
            TenantId = "string",
        },
        AzureAdSettings = new Gcp.Chronicle.Inputs.FeedDetailsAzureAdSettingsArgs
        {
            AuthEndpoint = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAzureAdSettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
            },
            Hostname = "string",
            TenantId = "string",
        },
        AzureBlobStoreSettings = new Gcp.Chronicle.Inputs.FeedDetailsAzureBlobStoreSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAzureBlobStoreSettingsAuthenticationArgs
            {
                SasToken = "string",
                SharedKey = "string",
            },
            AzureUri = "string",
            SourceDeletionOption = "string",
            SourceType = "string",
        },
        AzureBlobStoreV2Settings = new Gcp.Chronicle.Inputs.FeedDetailsAzureBlobStoreV2SettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAzureBlobStoreV2SettingsAuthenticationArgs
            {
                AccessKey = "string",
                AzureV2WorkloadIdentityFederation = new Gcp.Chronicle.Inputs.FeedDetailsAzureBlobStoreV2SettingsAuthenticationAzureV2WorkloadIdentityFederationArgs
                {
                    ClientId = "string",
                    SubjectId = "string",
                    TenantId = "string",
                },
                SasToken = "string",
            },
            AzureUri = "string",
            ChronicleServiceAccount = "string",
            MaxLookbackDays = 0,
            SourceDeletionOption = "string",
        },
        AzureEventHubSettings = new Gcp.Chronicle.Inputs.FeedDetailsAzureEventHubSettingsArgs
        {
            ConsumerGroup = "string",
            EventHubConnectionString = "string",
            Name = "string",
            AzureSasToken = "string",
            AzureStorageConnectionString = "string",
            AzureStorageContainer = "string",
            EventHubNamespace = "string",
        },
        AzureMdmIntuneSettings = new Gcp.Chronicle.Inputs.FeedDetailsAzureMdmIntuneSettingsArgs
        {
            AuthEndpoint = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsAzureMdmIntuneSettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
            },
            Hostname = "string",
            TenantId = "string",
        },
        CloudPassageSettings = new Gcp.Chronicle.Inputs.FeedDetailsCloudPassageSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsCloudPassageSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
            EventTypes = new[]
            {
                "string",
            },
        },
        CortexXdrSettings = new Gcp.Chronicle.Inputs.FeedDetailsCortexXdrSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsCortexXdrSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsCortexXdrSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            Endpoint = "string",
            Hostname = "string",
        },
        CrowdstrikeAlertsSettings = new Gcp.Chronicle.Inputs.FeedDetailsCrowdstrikeAlertsSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsCrowdstrikeAlertsSettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
                TokenEndpoint = "string",
            },
            Hostname = "string",
            IngestionType = "string",
        },
        CrowdstrikeDetectsSettings = new Gcp.Chronicle.Inputs.FeedDetailsCrowdstrikeDetectsSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsCrowdstrikeDetectsSettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
                TokenEndpoint = "string",
            },
            Hostname = "string",
            IngestionType = "string",
        },
        DummyLogTypeSettings = new Gcp.Chronicle.Inputs.FeedDetailsDummyLogTypeSettingsArgs
        {
            ApiEndpoint = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsDummyLogTypeSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsDummyLogTypeSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
        },
        DuoAuthSettings = new Gcp.Chronicle.Inputs.FeedDetailsDuoAuthSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsDuoAuthSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
            Hostname = "string",
        },
        DuoUserContextSettings = new Gcp.Chronicle.Inputs.FeedDetailsDuoUserContextSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsDuoUserContextSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
            Hostname = "string",
        },
        FeedSourceType = "string",
        FoxItStixSettings = new Gcp.Chronicle.Inputs.FeedDetailsFoxItStixSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsFoxItStixSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
            Collection = "string",
            PollServiceUri = "string",
            Ssl = new Gcp.Chronicle.Inputs.FeedDetailsFoxItStixSettingsSslArgs
            {
                EncodedPrivateKey = "string",
                SslCertificate = "string",
            },
        },
        GcsSettings = new Gcp.Chronicle.Inputs.FeedDetailsGcsSettingsArgs
        {
            BucketUri = "string",
            ChronicleServiceAccount = "string",
            SourceDeletionOption = "string",
            SourceType = "string",
        },
        GcsV2Settings = new Gcp.Chronicle.Inputs.FeedDetailsGcsV2SettingsArgs
        {
            BucketUri = "string",
            ChronicleServiceAccount = "string",
            MaxLookbackDays = 0,
            SourceDeletionOption = "string",
        },
        GoogleCloudIdentityDeviceUsersSettings = new Gcp.Chronicle.Inputs.FeedDetailsGoogleCloudIdentityDeviceUsersSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsGoogleCloudIdentityDeviceUsersSettingsAuthenticationArgs
            {
                Claims = new Gcp.Chronicle.Inputs.FeedDetailsGoogleCloudIdentityDeviceUsersSettingsAuthenticationClaimsArgs
                {
                    Audience = "string",
                    Issuer = "string",
                    Subject = "string",
                },
                RsCredentials = new Gcp.Chronicle.Inputs.FeedDetailsGoogleCloudIdentityDeviceUsersSettingsAuthenticationRsCredentialsArgs
                {
                    PrivateKey = "string",
                },
                TokenEndpoint = "string",
            },
        },
        GoogleCloudIdentityDevicesSettings = new Gcp.Chronicle.Inputs.FeedDetailsGoogleCloudIdentityDevicesSettingsArgs
        {
            ApiVersion = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsGoogleCloudIdentityDevicesSettingsAuthenticationArgs
            {
                Claims = new Gcp.Chronicle.Inputs.FeedDetailsGoogleCloudIdentityDevicesSettingsAuthenticationClaimsArgs
                {
                    Audience = "string",
                    Issuer = "string",
                    Subject = "string",
                },
                RsCredentials = new Gcp.Chronicle.Inputs.FeedDetailsGoogleCloudIdentityDevicesSettingsAuthenticationRsCredentialsArgs
                {
                    PrivateKey = "string",
                },
                TokenEndpoint = "string",
            },
        },
        GoogleCloudStorageEventDrivenSettings = new Gcp.Chronicle.Inputs.FeedDetailsGoogleCloudStorageEventDrivenSettingsArgs
        {
            BucketUri = "string",
            PubsubSubscription = "string",
            ChronicleServiceAccount = "string",
            MaxLookbackDays = 0,
            SourceDeletionOption = "string",
        },
        HttpSettings = new Gcp.Chronicle.Inputs.FeedDetailsHttpSettingsArgs
        {
            SourceDeletionOption = "string",
            SourceType = "string",
            Uri = "string",
        },
        HttpsPushAmazonKinesisFirehoseSettings = new Gcp.Chronicle.Inputs.FeedDetailsHttpsPushAmazonKinesisFirehoseSettingsArgs
        {
            SplitDelimiter = "string",
        },
        HttpsPushGoogleCloudPubsubSettings = new Gcp.Chronicle.Inputs.FeedDetailsHttpsPushGoogleCloudPubsubSettingsArgs
        {
            SplitDelimiter = "string",
        },
        HttpsPushWebhookSettings = new Gcp.Chronicle.Inputs.FeedDetailsHttpsPushWebhookSettingsArgs
        {
            SplitDelimiter = "string",
        },
        ImpervaWafSettings = new Gcp.Chronicle.Inputs.FeedDetailsImpervaWafSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsImpervaWafSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsImpervaWafSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
        },
        Labels = 
        {
            { "string", "string" },
        },
        MandiantIocSettings = new Gcp.Chronicle.Inputs.FeedDetailsMandiantIocSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsMandiantIocSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsMandiantIocSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            StartTime = "string",
        },
        MicrosoftGraphAlertSettings = new Gcp.Chronicle.Inputs.FeedDetailsMicrosoftGraphAlertSettingsArgs
        {
            AuthEndpoint = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsMicrosoftGraphAlertSettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
            },
            Hostname = "string",
            TenantId = "string",
        },
        MicrosoftSecurityCenterAlertSettings = new Gcp.Chronicle.Inputs.FeedDetailsMicrosoftSecurityCenterAlertSettingsArgs
        {
            AuthEndpoint = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsMicrosoftSecurityCenterAlertSettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
            },
            Hostname = "string",
            SubscriptionId = "string",
            TenantId = "string",
        },
        MimecastMailSettings = new Gcp.Chronicle.Inputs.FeedDetailsMimecastMailSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsMimecastMailSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsMimecastMailSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            Hostname = "string",
        },
        MimecastMailV2Settings = new Gcp.Chronicle.Inputs.FeedDetailsMimecastMailV2SettingsArgs
        {
            AuthCredentials = new Gcp.Chronicle.Inputs.FeedDetailsMimecastMailV2SettingsAuthCredentialsArgs
            {
                ClientId = "string",
                ClientSecret = "string",
            },
        },
        NetskopeAlertSettings = new Gcp.Chronicle.Inputs.FeedDetailsNetskopeAlertSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsNetskopeAlertSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsNetskopeAlertSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            ContentType = "string",
            Feedname = "string",
            Hostname = "string",
        },
        NetskopeAlertV2Settings = new Gcp.Chronicle.Inputs.FeedDetailsNetskopeAlertV2SettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsNetskopeAlertV2SettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsNetskopeAlertV2SettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            ContentCategory = "string",
            ContentTypes = new[]
            {
                "string",
            },
            Hostname = "string",
        },
        Office365Settings = new Gcp.Chronicle.Inputs.FeedDetailsOffice365SettingsArgs
        {
            AuthEndpoint = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsOffice365SettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
            },
            ContentType = "string",
            Hostname = "string",
            TenantId = "string",
        },
        OktaSettings = new Gcp.Chronicle.Inputs.FeedDetailsOktaSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsOktaSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsOktaSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            Hostname = "string",
        },
        OktaUserContextSettings = new Gcp.Chronicle.Inputs.FeedDetailsOktaUserContextSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsOktaUserContextSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsOktaUserContextSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            Hostname = "string",
            ManagerIdReferenceField = "string",
        },
        PanIocSettings = new Gcp.Chronicle.Inputs.FeedDetailsPanIocSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsPanIocSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsPanIocSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            Feed = "string",
            FeedId = "string",
        },
        PanPrismaCloudSettings = new Gcp.Chronicle.Inputs.FeedDetailsPanPrismaCloudSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsPanPrismaCloudSettingsAuthenticationArgs
            {
                Password = "string",
                User = "string",
            },
            Hostname = "string",
        },
        ProofpointMailSettings = new Gcp.Chronicle.Inputs.FeedDetailsProofpointMailSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsProofpointMailSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
        },
        ProofpointOnDemandSettings = new Gcp.Chronicle.Inputs.FeedDetailsProofpointOnDemandSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsProofpointOnDemandSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsProofpointOnDemandSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            ClusterId = "string",
        },
        PubsubSettings = new Gcp.Chronicle.Inputs.FeedDetailsPubsubSettingsArgs
        {
            GoogleServiceAccountEmail = "string",
        },
        QualysScanSettings = new Gcp.Chronicle.Inputs.FeedDetailsQualysScanSettingsArgs
        {
            ApiType = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsQualysScanSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
            Hostname = "string",
        },
        QualysVmSettings = new Gcp.Chronicle.Inputs.FeedDetailsQualysVmSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsQualysVmSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
            Hostname = "string",
        },
        Rapid7InsightSettings = new Gcp.Chronicle.Inputs.FeedDetailsRapid7InsightSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsRapid7InsightSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsRapid7InsightSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            Endpoint = "string",
            Hostname = "string",
        },
        RecordedFutureIocSettings = new Gcp.Chronicle.Inputs.FeedDetailsRecordedFutureIocSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsRecordedFutureIocSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsRecordedFutureIocSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
        },
        RhIsacIocSettings = new Gcp.Chronicle.Inputs.FeedDetailsRhIsacIocSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsRhIsacIocSettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
                TokenEndpoint = "string",
            },
        },
        SalesforceSettings = new Gcp.Chronicle.Inputs.FeedDetailsSalesforceSettingsArgs
        {
            Hostname = "string",
            OauthJwtCredentials = new Gcp.Chronicle.Inputs.FeedDetailsSalesforceSettingsOauthJwtCredentialsArgs
            {
                Claims = new Gcp.Chronicle.Inputs.FeedDetailsSalesforceSettingsOauthJwtCredentialsClaimsArgs
                {
                    Audience = "string",
                    Issuer = "string",
                    Subject = "string",
                },
                RsCredentials = new Gcp.Chronicle.Inputs.FeedDetailsSalesforceSettingsOauthJwtCredentialsRsCredentialsArgs
                {
                    PrivateKey = "string",
                },
                TokenEndpoint = "string",
            },
            OauthPasswordGrantAuth = new Gcp.Chronicle.Inputs.FeedDetailsSalesforceSettingsOauthPasswordGrantAuthArgs
            {
                ClientId = "string",
                ClientSecret = "string",
                Password = "string",
                TokenEndpoint = "string",
                User = "string",
            },
        },
        SentineloneAlertSettings = new Gcp.Chronicle.Inputs.FeedDetailsSentineloneAlertSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsSentineloneAlertSettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsSentineloneAlertSettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            Hostname = "string",
            InitialStartTime = "string",
            IsAlertApiSubscribed = false,
        },
        ServiceNowCmdbSettings = new Gcp.Chronicle.Inputs.FeedDetailsServiceNowCmdbSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsServiceNowCmdbSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
            Feedname = "string",
            Hostname = "string",
        },
        SftpSettings = new Gcp.Chronicle.Inputs.FeedDetailsSftpSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsSftpSettingsAuthenticationArgs
            {
                Password = "string",
                PrivateKey = "string",
                PrivateKeyPassphrase = "string",
                Username = "string",
            },
            SourceDeletionOption = "string",
            SourceType = "string",
            Uri = "string",
        },
        StsMigrationReadiness = "string",
        SymantecEventExportSettings = new Gcp.Chronicle.Inputs.FeedDetailsSymantecEventExportSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsSymantecEventExportSettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
                RefreshToken = "string",
                TokenEndpoint = "string",
            },
        },
        ThinkstCanarySettings = new Gcp.Chronicle.Inputs.FeedDetailsThinkstCanarySettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsThinkstCanarySettingsAuthenticationArgs
            {
                HeaderKeyValues = new[]
                {
                    new Gcp.Chronicle.Inputs.FeedDetailsThinkstCanarySettingsAuthenticationHeaderKeyValueArgs
                    {
                        Key = "string",
                        Value = "string",
                    },
                },
            },
            Hostname = "string",
        },
        ThreatConnectIocSettings = new Gcp.Chronicle.Inputs.FeedDetailsThreatConnectIocSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsThreatConnectIocSettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
            Hostname = "string",
            Owners = new[]
            {
                "string",
            },
        },
        ThreatConnectIocV3Settings = new Gcp.Chronicle.Inputs.FeedDetailsThreatConnectIocV3SettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsThreatConnectIocV3SettingsAuthenticationArgs
            {
                Secret = "string",
                User = "string",
            },
            Fields = new[]
            {
                "string",
            },
            Hostname = "string",
            Owners = new[]
            {
                "string",
            },
            Schedule = 0,
            TqlQuery = "string",
        },
        TrellixHxAlertsSettings = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxAlertsSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxAlertsSettingsAuthenticationArgs
            {
                Msso = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxAlertsSettingsAuthenticationMssoArgs
                {
                    ApiEndpoint = "string",
                    Password = "string",
                    Username = "string",
                },
                TrellixIam = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxAlertsSettingsAuthenticationTrellixIamArgs
                {
                    ClientId = "string",
                    ClientSecret = "string",
                    Scope = "string",
                },
            },
            Endpoint = "string",
        },
        TrellixHxBulkAcqsSettings = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxBulkAcqsSettingsArgs
        {
            Endpoint = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxBulkAcqsSettingsAuthenticationArgs
            {
                Msso = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxBulkAcqsSettingsAuthenticationMssoArgs
                {
                    ApiEndpoint = "string",
                    Password = "string",
                    Username = "string",
                },
                TrellixIam = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxBulkAcqsSettingsAuthenticationTrellixIamArgs
                {
                    ClientId = "string",
                    ClientSecret = "string",
                    Scope = "string",
                },
            },
        },
        TrellixHxHostsSettings = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxHostsSettingsArgs
        {
            Endpoint = "string",
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxHostsSettingsAuthenticationArgs
            {
                Msso = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxHostsSettingsAuthenticationMssoArgs
                {
                    ApiEndpoint = "string",
                    Password = "string",
                    Username = "string",
                },
                TrellixIam = new Gcp.Chronicle.Inputs.FeedDetailsTrellixHxHostsSettingsAuthenticationTrellixIamArgs
                {
                    ClientId = "string",
                    ClientSecret = "string",
                    Scope = "string",
                },
            },
        },
        WebhookSettings = null,
        WorkdaySettings = new Gcp.Chronicle.Inputs.FeedDetailsWorkdaySettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsWorkdaySettingsAuthenticationArgs
            {
                ClientId = "string",
                ClientSecret = "string",
                RefreshToken = "string",
                Secret = "string",
                TokenEndpoint = "string",
                User = "string",
            },
            Hostname = "string",
            TenantId = "string",
        },
        WorkspaceActivitySettings = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceActivitySettingsArgs
        {
            Applications = new[]
            {
                "string",
            },
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceActivitySettingsAuthenticationArgs
            {
                Claims = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceActivitySettingsAuthenticationClaimsArgs
                {
                    Audience = "string",
                    Issuer = "string",
                    Subject = "string",
                },
                RsCredentials = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceActivitySettingsAuthenticationRsCredentialsArgs
                {
                    PrivateKey = "string",
                },
                TokenEndpoint = "string",
            },
            WorkspaceCustomerId = "string",
        },
        WorkspaceAlertsSettings = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceAlertsSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceAlertsSettingsAuthenticationArgs
            {
                Claims = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceAlertsSettingsAuthenticationClaimsArgs
                {
                    Audience = "string",
                    Issuer = "string",
                    Subject = "string",
                },
                RsCredentials = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceAlertsSettingsAuthenticationRsCredentialsArgs
                {
                    PrivateKey = "string",
                },
                TokenEndpoint = "string",
            },
            WorkspaceCustomerId = "string",
        },
        WorkspaceChromeOsSettings = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceChromeOsSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceChromeOsSettingsAuthenticationArgs
            {
                Claims = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceChromeOsSettingsAuthenticationClaimsArgs
                {
                    Audience = "string",
                    Issuer = "string",
                    Subject = "string",
                },
                RsCredentials = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceChromeOsSettingsAuthenticationRsCredentialsArgs
                {
                    PrivateKey = "string",
                },
                TokenEndpoint = "string",
            },
            WorkspaceCustomerId = "string",
        },
        WorkspaceGroupsSettings = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceGroupsSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceGroupsSettingsAuthenticationArgs
            {
                Claims = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceGroupsSettingsAuthenticationClaimsArgs
                {
                    Audience = "string",
                    Issuer = "string",
                    Subject = "string",
                },
                RsCredentials = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceGroupsSettingsAuthenticationRsCredentialsArgs
                {
                    PrivateKey = "string",
                },
                TokenEndpoint = "string",
            },
            WorkspaceCustomerId = "string",
        },
        WorkspaceMobileSettings = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceMobileSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceMobileSettingsAuthenticationArgs
            {
                Claims = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceMobileSettingsAuthenticationClaimsArgs
                {
                    Audience = "string",
                    Issuer = "string",
                    Subject = "string",
                },
                RsCredentials = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceMobileSettingsAuthenticationRsCredentialsArgs
                {
                    PrivateKey = "string",
                },
                TokenEndpoint = "string",
            },
            WorkspaceCustomerId = "string",
        },
        WorkspacePrivilegesSettings = new Gcp.Chronicle.Inputs.FeedDetailsWorkspacePrivilegesSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsWorkspacePrivilegesSettingsAuthenticationArgs
            {
                Claims = new Gcp.Chronicle.Inputs.FeedDetailsWorkspacePrivilegesSettingsAuthenticationClaimsArgs
                {
                    Audience = "string",
                    Issuer = "string",
                    Subject = "string",
                },
                RsCredentials = new Gcp.Chronicle.Inputs.FeedDetailsWorkspacePrivilegesSettingsAuthenticationRsCredentialsArgs
                {
                    PrivateKey = "string",
                },
                TokenEndpoint = "string",
            },
            WorkspaceCustomerId = "string",
        },
        WorkspaceUsersSettings = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceUsersSettingsArgs
        {
            Authentication = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceUsersSettingsAuthenticationArgs
            {
                Claims = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceUsersSettingsAuthenticationClaimsArgs
                {
                    Audience = "string",
                    Issuer = "string",
                    Subject = "string",
                },
                RsCredentials = new Gcp.Chronicle.Inputs.FeedDetailsWorkspaceUsersSettingsAuthenticationRsCredentialsArgs
                {
                    PrivateKey = "string",
                },
                TokenEndpoint = "string",
            },
            ProjectionType = "string",
            WorkspaceCustomerId = "string",
        },
    },
    DisplayName = "string",
    Enabled = false,
    FailureDetails = new Gcp.Chronicle.Inputs.FeedFailureDetailsArgs
    {
        ErrorAction = "string",
        ErrorCause = "string",
        ErrorCode = "string",
        HttpErrorCode = 0,
    },
    FeedId = "string",
    Project = "string",
});