📝 Google Logging Log Metric Filter and Alerts for VPC Network Firewall Rule Changes do not exist 🟢

• Contextual name: 📝 Log Metric Filter and Alerts for VPC Network Firewall Rule Changes do not exist 🟢
• ID: /ce/ca/google/logging/vpc-network-firewall-rule-changes-monitoring
• Located in: 📁 Google Logging

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Enable Monitoring for Firewall Rule Changes

Logic

• 🧠 prod.logic.yaml 🟢
  • 📗 Google Project
  • 🔌 Google Logging Log Metric - object.extracts.yaml
  • 🔌 Google Monitoring Alert Policy - object.extracts.yaml
  • 🔌 Google Project - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

It is recommended that a metric filter and alarm be established for Virtual Private Cloud (VPC) Network Firewall rule changes.

Rationale

Monitoring for Create or Update Firewall rule events gives insight to network access changes and may reduce the time it takes to detect suspicious activity.

Impact

Enabling of logging may result in your project being charged for the additional logs usage. These charges could be significant depending on the size of the organization.

Audit

From Google Cloud Console

Ensure that the prescribed log metric is present:

1. Go to Logging/Logs-based Metrics by visiting https://console.cloud.google.com/logs/metrics.

2. In the User-defined Metrics section, ensure at least one metric <Log_Metric_Name> is present with this filter text:

    resource.type="gce_firewall_rule" 
    AND (protoPayload.methodName:"compute.firewalls.patch" 
    OR protoPayload.methodName:"compute.firewalls.insert" 
    OR protoPayload.methodName:"compute.firewalls.delete")

Ensure that the prescribed alerting policy is present:

... see more

Remediation

Open File

Remediation

From Google Cloud Console

Create the prescribed log metric:

1. Go to Logging/Logs-based Metrics by visiting https://console.cloud.google.com/logs/metrics and click "CREATE METRIC".

2. Click the down arrow symbol on the Filter Bar at the rightmost corner and select Convert to Advanced Filter.

3. Clear any text and add:

    resource.type="gce_firewall_rule" 
    AND (protoPayload.methodName:"compute.firewalls.patch" 
    OR protoPayload.methodName:"compute.firewalls.insert" 
    OR protoPayload.methodName:"compute.firewalls.delete")

4. Click Submit Filter. Display logs appear based on the filter text entered by the user.

5. In the Metric Editor menu on the right, fill out the name field. Set Units to 1 (default) and Type to Counter. This ensures that the log metric counts the number of log entries matching the advanced logs query.

6. Click Create Metric.

Create the prescribed Alert Policy:

1. Identify the newly created metric under the section User-defined Metrics at https://console.cloud.google.com/logs/metrics.

... see more

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS GCP v1.2.0 → 💼 2.7 Ensure that the log metric filter and alerts exist for VPC Network Firewall rule changes - Level 1 (Automated)			1
💼 CIS GCP v1.3.0 → 💼 2.7 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes - Level 1 (Automated)			1
💼 CIS GCP v2.0.0 → 💼 2.7 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes - Level 2 (Automated)			1
💼 CIS GCP v3.0.0 → 💼 2.7 Ensure That the Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes - Level 2 (Automated)			1
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			59
💼 FedRAMP High Security Controls → 💼 AU-2 Event Logging (L)(M)(H)			17
💼 FedRAMP High Security Controls → 💼 AU-7 Audit Record Reduction and Report Generation (M)(H)	1		18
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)	2		65
💼 FedRAMP Low Security Controls → 💼 AU-2 Event Logging (L)(M)(H)			17
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			65
💼 FedRAMP Moderate Security Controls → 💼 AU-2 Event Logging (L)(M)(H)			17
💼 FedRAMP Moderate Security Controls → 💼 AU-7 Audit Record Reduction and Report Generation (M)(H)	1		18
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)			65
💼 ISO/IEC 27001:2022 → 💼 8.15 Logging		18	34
💼 ISO/IEC 27001:2022 → 💼 8.20 Networks security		5	14
💼 NIST CSF v1.1 → 💼 DE.AE-3: Event data are collected and correlated from multiple sources and sensors		18	37
💼 NIST CSF v1.1 → 💼 PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy		16	32
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources			46
💼 NIST CSF v2.0 → 💼 DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis			37
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events			115
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events			81
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events			134
💼 NIST CSF v2.0 → 💼 RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident			17
💼 NIST CSF v2.0 → 💼 RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved			18
💼 NIST CSF v2.0 → 💼 RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved			18
💼 NIST SP 800-53 Revision 5 → 💼 AU-2 Event Logging	4		17
💼 NIST SP 800-53 Revision 5 → 💼 AU-7 Audit Record Reduction and Report Generation	2	1	18
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation	4	47	65
💼 PCI DSS v3.2.1 → 💼 5.2 Ensure that all anti-virus mechanisms are maintained.			9
💼 PCI DSS v3.2.1 → 💼 6.6 For public-facing web applications, address new threats and vulnerabilities on an ongoing basis and ensure these applications are protected against known attacks.			11
💼 PCI DSS v3.2.1 → 💼 10.2 Implement automated audit trails for all system components.	7	6	25
💼 PCI DSS v3.2.1 → 💼 10.2.1 All individual user accesses to cardholder data.		4	14
💼 PCI DSS v3.2.1 → 💼 10.2.2 All actions taken by any individual with root or administrative privileges.			15
💼 PCI DSS v3.2.1 → 💼 10.2.3 Access to all audit trails.			9
💼 PCI DSS v3.2.1 → 💼 10.2.4 Invalid logical access attempts.		4	14
💼 PCI DSS v3.2.1 → 💼 10.2.5 Use of and changes to identification and authentication mechanisms.		1	16
💼 PCI DSS v3.2.1 → 💼 10.2.6 Initialization, stopping, or pausing of the audit logs.			9
💼 PCI DSS v3.2.1 → 💼 10.3 Record audit trail entries for all system components for each event.	6		10
💼 PCI DSS v4.0.1 → 💼 5.3.1 The anti-malware solution(s) is kept current via automatic updates.			9
💼 PCI DSS v4.0.1 → 💼 5.3.2 The anti-malware solution performs periodic scans and active or real-time scans or performs continuous behavioral analysis of systems or processes.	1		9
💼 PCI DSS v4.0.1 → 💼 5.3.4 Audit logs for the anti-malware solution(s) are enabled and retained.			9
💼 PCI DSS v4.0.1 → 💼 6.4.1 For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks.			11
💼 PCI DSS v4.0.1 → 💼 6.4.2 For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks.			9
💼 PCI DSS v4.0.1 → 💼 10.2.1 Audit logs are enabled and active for all system components and cardholder data.	7		24
💼 PCI DSS v4.0.1 → 💼 10.2.1.1 Audit logs capture all individual user access to cardholder data.			14
💼 PCI DSS v4.0.1 → 💼 10.2.1.2 Audit logs capture all actions taken by any individual with administrative access, including any interactive use of application or system accounts.			15
💼 PCI DSS v4.0.1 → 💼 10.2.1.3 Audit logs capture all access to audit logs.			9
💼 PCI DSS v4.0.1 → 💼 10.2.1.4 Audit logs capture all invalid logical access attempts.			14
💼 PCI DSS v4.0.1 → 💼 10.2.1.5 Audit logs capture all changes to identification and authentication credentials.			16
💼 PCI DSS v4.0.1 → 💼 10.2.1.6 Audit logs capture all initialization of new audit logs, starting, stopping, or pausing of the existing audit logs.			9
💼 PCI DSS v4.0.1 → 💼 10.2.1.7 Audit logs capture all creation and deletion of system-level objects.			9
💼 PCI DSS v4.0.1 → 💼 10.2.2 Audit logs record the described details for each auditable event.			9
💼 PCI DSS v4.0 → 💼 5.3.1 The anti-malware solution(s) is kept current via automatic updates.			9
💼 PCI DSS v4.0 → 💼 5.3.2 The anti-malware solution performs periodic scans and active or real-time scans or performs continuous behavioral analysis of systems or processes.	1		9
💼 PCI DSS v4.0 → 💼 5.3.4 Audit logs for the anti-malware solution(s) are enabled and retained.			9
💼 PCI DSS v4.0 → 💼 6.4.1 For public-facing web applications, new threats and vulnerabilities are addressed on an ongoing basis and these applications are protected against known attacks.			11
💼 PCI DSS v4.0 → 💼 6.4.2 For public-facing web applications, an automated technical solution is deployed that continually detects and prevents web-based attacks.			9
💼 PCI DSS v4.0 → 💼 10.2.1 Audit logs are enabled and active for all system components and cardholder data.	7	1	24
💼 PCI DSS v4.0 → 💼 10.2.1.1 Audit logs capture all individual user access to cardholder data.		1	14
💼 PCI DSS v4.0 → 💼 10.2.1.2 Audit logs capture all actions taken by any individual with administrative access, including any interactive use of application or system accounts.			15
💼 PCI DSS v4.0 → 💼 10.2.1.3 Audit logs capture all access to audit logs.			9
💼 PCI DSS v4.0 → 💼 10.2.1.4 Audit logs capture all invalid logical access attempts.		1	14
💼 PCI DSS v4.0 → 💼 10.2.1.5 Audit logs capture all changes to identification and authentication credentials.			16
💼 PCI DSS v4.0 → 💼 10.2.1.6 Audit logs capture all initialization of new audit logs, starting, stopping, or pausing of the existing audit logs.			9
💼 PCI DSS v4.0 → 💼 10.2.1.7 Audit logs capture all creation and deletion of system-level objects.			9
💼 PCI DSS v4.0 → 💼 10.2.2 Audit logs record the described details for each auditable event.			9