Deploy Network Sensor on GCP

#!/bin/bash
# Complete GCP Packet Mirroring setup

PROJECT_ID="my-project"
REGION="us-central1"
SUBNET="my-subnet"
NETWORK="my-vpc"
SENSOR_MIG="network-sensor-mig" # The Instance Group from your Terraform deployment

echo "1. Creating Health Check & Backend Service..."
gcloud compute health-checks create tcp network-sensor-hc --port=8080 --project="$PROJECT_ID"

gcloud compute backend-services create network-sensor-backend \
  --region="$REGION" \
  --health-checks=network-sensor-hc \
  --load-balancing-scheme=INTERNAL \
  --protocol=TCP \
  --project="$PROJECT_ID"

gcloud compute backend-services add-backend network-sensor-backend \
  --region="$REGION" \
  --instance-group="$SENSOR_MIG" \
  --project="$PROJECT_ID"

echo "2. Creating Forwarding Rule (Mirroring Target)..."
gcloud compute forwarding-rules create network-sensor-fr \
  --region="$REGION" \
  --network="$NETWORK" \
  --subnet="$SUBNET" \
  --load-balancing-scheme=INTERNAL \
  --backend-service=network-sensor-backend \
  --is-mirroring-collector \
  --project="$PROJECT_ID"

echo "3. Creating Packet Mirroring Policy..."
gcloud compute packet-mirrorings create prod-workload-mirror \
  --region="$REGION" \
  --network="$NETWORK" \
  --collector-ilb=network-sensor-fr \
  --mirrored-subnets="$SUBNET" \
  --project="$PROJECT_ID"

echo "Success! Packet mirroring policy active."

# 1. Configure Terraform Variables
cat > deploy/gcp-network-sensor/terraform.tfvars << EOF
gcp_project_id         = "my-project-id"
gcp_region             = "us-central1"
vpc_network_name       = "default"
api_key                = "sp_your_ingestion_key"
EOF

# 2. Deploy Infrastructure
cd deploy/gcp-network-sensor
terraform init
terraform apply -auto-approve

# GCP Terraform snippet for Network Sensor Deployment
resource "google_compute_instance" "network_sensor" {
  name         = "blackshield-network-sensor"
  machine_type = "e2-medium"
  zone         = "us-central1-a"

  boot_disk {
    initialize_params {
      image = "ubuntu-os-cloud/ubuntu-2204-lts"
    }
  }

  network_interface {
    network    = var.vpc_network_name
    subnetwork = var.monitoring_subnet_name
  }

  metadata = {
    startup-script = templatefile("${path.module}/startup.sh.tftpl", {
      api_url      = "https://api.blackshield.chaplau.com"
      sensor_type  = "suricata"
      min_severity = "high"
    })
  }

  service_account {
    scopes = ["cloud-platform"]
  }
}