xdr-terraform-modules/base/splunk_servers/alsi/config.tf

locals {

  instance_types_default = {
    "alsi-master" = "t3a.small",
    "alsi-worker" = "t3a.small",
  }
  instance_types_exceptions = {
  }
  instance_types = lookup(local.instance_types_exceptions, var.account_name, local.instance_types_default)

  # If cribl is being used for log ingestion, remember to turn on splunk_private_hec
  # in `splunk_servers/indexer_cluster/config.tf`, too.
  # Alternatively, enable the Splunk Load Balanced destination and use indexer discovery.
  alsi_workers_default = 0 # how many cribl workers
  alsi_workers_exceptions = {
    afs-mdr-test-c2-gov = 2,
    mdr-prod-bas        = 2,
  }
  alsi_workers = lookup(local.alsi_workers_exceptions, var.account_name, local.alsi_workers_default)

  alsi_splunk_nlb_default = false # splunk://moose-alsi-splunk.xdr{,test}.accenturefederalcyber.com:9997 and 9998
  alsi_splunk_nlb_exceptions = {
    afs-mdr-test-c2-gov = true,
    mdr-prod-bas        = true,
  }
  alsi_splunk_nlb = lookup(local.alsi_splunk_nlb_exceptions, var.account_name, local.alsi_splunk_nlb_default)

  alsi_elastic_alb_default = false # https://moose-alsi-elastic.xdr{,test}.accenturefederalcyber.com -> 9200
  alsi_elastic_alb_exceptions = {
    afs-mdr-test-c2-gov = true,
  }
  alsi_elastic_alb = lookup(local.alsi_elastic_alb_exceptions, var.account_name, local.alsi_elastic_alb_default)

  alsi_hec_alb_default = false # https://moose-alsi-hec.xdr{,test}.accenturefederalcyber.com -> 8088
  alsi_hec_alb_exceptions = {
    afs-mdr-test-c2-gov = true,
    mdr-prod-bas        = true,
  }
  alsi_hec_alb = lookup(local.alsi_hec_alb_exceptions, var.account_name, local.alsi_hec_alb_default)

}