# GCP VPC Flows in SIEM

**URL:** <https://discuss.elastic.co/t/gcp-vpc-flows-in-siem/208259>\
**Category:** SIEM\
**Created:** [November 18, 2019, 6:13am UTC](https://discuss.elastic.co/t/gcp-vpc-flows-in-siem/208259 "2019-11-18T06:13:02Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![numbersix](https://avatars.discourse-cdn.com/v4/letter/n/dec6dc/32.png) [@numbersix](https://discuss.elastic.co/u/numbersix)\
**Post date:** [November 18, 2019, 6:13am UTC](https://discuss.elastic.co/t/gcp-vpc-flows-in-siem/208259/1 "2019-11-18T06:13:02Z")

</div>

I have GCP VPC Flows in Elasticsearch but what is the easiest way to integrate them into the SIEM? I see net flow integrations available for other sources but not GCP. I'm using the Google Cloud Module for Filebeat currently. My cluster is self-managed.  
Even if someone could steer me in a direction that would be helpful.  
Thanks!

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [November 19, 2019, 1:00am UTC](https://discuss.elastic.co/t/gcp-vpc-flows-in-siem/208259/2 "2019-11-19T01:00:31Z")

</div>

The flows from the googlecloud/vpcflow module in Filebeat will show up in the SIEM app on the Network tab. If you want to filter it down so that it's only showing flows data from the module then add in `event.dataset:googlecloud.vpcflow` to the KQL filter bar.

---

<div class="post-metadata">

**Author:** ![numbersix](https://avatars.discourse-cdn.com/v4/letter/n/dec6dc/32.png) [@numbersix](https://discuss.elastic.co/u/numbersix)\
**Post date:** [November 19, 2019, 2:16pm UTC](https://discuss.elastic.co/t/gcp-vpc-flows-in-siem/208259/3 "2019-11-19T14:16:08Z")

</div>

Ahh! That makes sense. I was confused because Filebeat shows zero in the Overview, but you are right. It is there.

Thanks Andrew. By the way, your webinar demonstration of setting up SIEM is very helpful.

Eric

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 17, 2019, 2:16pm UTC](https://discuss.elastic.co/t/gcp-vpc-flows-in-siem/208259/4 "2019-12-17T14:16:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.