​
More Info:

Ensures that logging and log alerts exist for VPC network changes.

​
Risk Level

Medium

​
Address

Security

​
Compliance Standards

SOC2, NIST, CISGCP, CBP, HIPAA, ISO27001, HITRUST, GDPR, NISTCSF, PCIDSS, FedRAMP

​
Triage and Remediation

Remediation

To remediate the misconfiguration “Network Change Log Alerts Should Be Enabled” in GCP using GCP console, you can follow these steps:

  1. Open the GCP console and navigate to the Cloud Logging page.

  2. Click on “Logs-based Metrics” in the left-hand menu.

  3. Click on the “Create Metric” button.

  4. In the “Create a Metric” dialog box, select “Counter” as the metric type.

  5. Enter a name for the metric, such as “Network Change Log Alerts Enabled”.

  6. In the “Filter” field, enter the following filter to capture network changes:

    resource.type="gce_network" AND protoPayload.methodName="v1.compute.networks.patch"

  7. Click “Create”.

  8. Navigate to the “Alerting” page in the left-hand menu.

  9. Click on “Create Policy” to create a new alerting policy.

  10. In the “Create a Policy” dialog box, enter a name and description for the policy.

  11. In the “Conditions” section, click on the “Add Condition” button and select “Metric Threshold”.

  12. Select the metric you created earlier, “Network Change Log Alerts Enabled”, from the drop-down menu.

  13. Set the threshold to “1” and select a duration for the threshold to be met, such as “5 minutes”.

  14. In the “Notifications” section, add the email addresses of the individuals who should receive the alerts.

  15. Click “Save” to create the alerting policy.

After completing these steps, the GCP console will send an alert to the specified email addresses when a network change occurs in the GCP environment.

​
Additional Reading: