Google CloudOverview
Detection without alerting delays incident response. High-risk events should always trigger notifications.
Remediation guidance
Google Cloud Remediation
Service-Wide (Recommended)
Define a minimum alerting baseline for IAM, audit logging, key changes, and network exposure events.
Google Cloud Console (Asset-Level)
- Create required log-based metrics.
- Create alert policies tied to those metrics.
- Configure notification channels and incident routing.
Google Cloud CLI (Asset-Level)
gcloud logging metrics create <metric-name> --description="<desc>" --log-filter="<filter>"
# Use gcloud monitoring policies create with a policy JSON/YAML definition
References
- https://cloud.google.com/monitoring/alerts
- https://cloud.google.com/logging/docs/logs-based-metrics
Query logic
These are the stored checks tied to this control.
Missing required high-risk alert policies
Connectors
Google Cloud
Covered asset types
AlertPolicy
Expected check: eq []
{ alertPolicies(where: { OR: [ { enabled: false }, { notificationChannels: "" } ] }) { ...AssetFragment } }
