Cloud Collection Recipes

Cloud Collection Recipes

Added in v0.20.0

These recipes show how common log shippers, such as Vector, OpenTelemetry (OTel), and Grafana Alloy, deliver CloudTrail, Azure, GCP, M365, GitHub, Okta, OneLogin, Kubernetes audit, Docker, and osquery events in a structured JSON shape that schema classification recognizes automatically, and which routing binding to use when a schema needs a field-mapping pipeline.

All examples target rsigma engine daemon with --schema-routing. Each recipe maps to one of the built-in schemas defined in Schema Signatures; no user-defined schemas: block is needed because every source ships as a built-in. Use --schema-config when you need a routing: section (per-schema pipeline bindings, on_unknown, or default_pipelines).

Vector examples POST JSON to /api/v1/events (--input http). OpenTelemetry Collector and Grafana Alloy examples use OTLP HTTP (/v1/logs); build or install the daemon with daemon-otlp (release archives already include it). OTLP is active whenever that feature is compiled in, regardless of --input. See OTLP Integration for the LogRecord mapping and TLS variants.

Built-in schemas (quick reference)

Schema Signature name Implied logsource Recipe
AWS CloudTrail aws_cloudtrail aws / cloudtrail Recipe
AWS VPC Flow Logs (JSON) aws_vpcflow aws + custom {source: vpcflow}
Azure Activity Logs azure_activitylogs azure / activitylogs Recipe
Azure Audit Logs azure_auditlogs azure / auditlogs Recipe
Azure SignIn Logs azure_signinlogs azure / signinlogs Recipe
GCP Cloud Audit gcp_audit gcp / gcp.audit Recipe
Microsoft 365 unified audit log m365_audit m365 / audit Recipe
GitHub Audit github_audit github / audit Recipe
Okta System Log okta_system_log okta / okta Recipe
OneLogin onelogin_events onelogin / onelogin.events Recipe
Kubernetes Audit k8s_audit custom {platform: kubernetes, source: k8s.audit} Recipe
Docker Events docker_events custom {platform: docker, source: docker.events} Recipe
osquery Result osquery_result custom {platform: osquery, source: osquery.result} Recipe

The recipes are grouped by source type:

A combined example

One daemon that accepts Vector on /api/v1/events and OTLP agents on /v1/logs, with schema routing and the GCP pipeline binding:

# /etc/rsigma/rsigma.yaml
version: 1

daemon:
  rules: /etc/rsigma/rules
  api:
    addr: "0.0.0.0:8952"
    tls:
      allow_plaintext: true   # or cert/key; a non-loopback bind needs one of the two
  input:
    source: http
  output:
    sinks: [stdout]
  schema:
    routing: true
    config: /etc/rsigma/schema-routing.yml

rsigma engine daemon --config /etc/rsigma/rsigma.yaml

schema-routing.yml:

routing:
  on_unknown: warn
  default_pipelines: []
  bindings:
    # GCP AuditLog needs the field-mapping pipeline; other cloud schemas match native fields with an empty pipeline-set.
    - schema: gcp_audit
      pipelines: [gcp_audit]

No schemas: entries are needed. Every Cloud, SaaS, and Container source in this guide ships as a built-in. The only binding required is the gcp_audit pipeline mapping (since SigmaHQ rules expect data.* field names, not native protoPayload.*). Built-in implied logsources already supply the SigmaHQ product/service tokens for pruning when logsource routing is also enabled.

See also

Previous Observability Next Cloud Platforms