ingest-vpc-flow-logs-gcp-ocsf

Use when

• You have GCP VPC Flow Logs from Cloud Logging exports
• You need OCSF Network Activity for downstream detection or storage
• You want a parity path alongside AWS VPC Flow Logs and Azure NSG Flow Logs

Do NOT use

• On non-GCP network telemetry
• On raw pcap or packet mirroring captures
• As a detection skill; this only normalizes telemetry

Input

JSONL or a top-level JSON array of GCP VPC Flow Logs entries. Supports both: