# 2.5 Ensure Log Metric Filters and Alerts Exist for Audit Configuration Changes (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232959-2-5-ensure-log-metric-filters-and-alerts-exist-for-audit-configuration-changes-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability: Level 1 ### Description: Google Cloud Platform (GCP) generates audit logs to record important events like "who did what, where, and when?" within projects. Configuring log metric filters and alerts for audit configuration changes ensures that any modifications to IAM policies are monitored, preserving accountability and compliance. ### Rationale: Audit logs for Admin Activity and Data Access provide critical details such as the identity of the API caller, the time of the API call, and the actions performed. Monitoring changes to audit configurations helps maintain the integrity of logging policies and ensures that activities within projects remain auditable. ### Impact: Enabling detailed logging might increase storage costs due to additional log usage. ### Audit Steps: #### Using Google Cloud Console: 1. Verify Log-Based Metric: - Navigate to [Logs-Based Metrics](https://console.cloud.google.com/logs/metrics). ![](https://support.icompaas.com/assets/kb/e67009ed4829d90a.png) - Ensure at least one metric is present with the following filter: protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.auditConfigDeltas:\* 2. Verify Alert Policy: - Navigate to [Alerting](https://console.cloud.google.com/monitoring/alerting). ![](https://support.icompaas.com/assets/kb/86e2d6fc86aa2f4c.png) - Confirm an alert policy exists for the metric with the following conditions: - Condition: Any value greater than 0 triggers an alert. - Threshold: Configured to detect any changes to IAM policy. ![](https://support.icompaas.com/assets/kb/ff0aefd73e1a8930.png) - Ensure appropriate notification channels (e.g., email, SMS) are configured. ![](https://support.icompaas.com/assets/kb/c52cb03982d1456a.png) #### Using Google Cloud CLI: 1. Verify Log-Based Metric: List all metrics: gcloud beta logging metrics list --format json - Ensure a metric exists with the filter: protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.auditConfigDeltas:\* 2. Verify Alert Policy: List all alerting policies: gcloud alpha monitoring policies list --format json - **Confirm an alert policy is present with:** - **Metric Type: logging.googleapis.com/user/** - **Enabled: true.** ### **Remediation Steps:** #### **Using Google Cloud Console:** 1. **Create a Log-Based Metric:** - **Go to [Logs-Based Metrics](https://console.cloud.google.com/logs/metrics).** **![](https://support.icompaas.com/assets/kb/aca17086e8a2b645.png)** - Click CREATE METRIC. **![](https://support.icompaas.com/assets/kb/6bdaecd365b5ec8f.png)** - **Enter the filter :** protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.auditConfigDeltas:\* - Set Units to 1 (default) and Type to Counter. **![](https://support.icompaas.com/assets/kb/cc218c88331aa629.png)** - Click Create Metric. **![](https://support.icompaas.com/assets/kb/9881c5e3e2156443.png)** 2. Create an Alert Policy: - Navigate to User-defined Metrics and locate the created metric. **![](https://support.icompaas.com/assets/kb/f42d726702c58c5d.png)** - Click the three-dot menu and select Create alert from Metric. **![](https://support.icompaas.com/assets/kb/cc4cecea757d9d8d.png)** - **Configure the alert policy:** - Aggregator: Count - Condition: Any value above 0 triggers the alert. - Notification Channels: Add appropriate channels (e.g., email, SMS). - **Save the policy.** #### **Using Google Cloud CLI:** **Create a Log-Based Metric:** gcloud beta logging metrics create \\ --description="" \\ --log-filter="protoPayload.methodName='SetIamPolicy' AND protoPayload.serviceData.policyDelta.auditConfigDeltas:\*" Create an Alert Policy: gcloud alpha monitoring policies create \\ --display-name="" \\ --conditions="" \\ --notification-channels="" ### ### References: 1. [Logs-Based Metrics](https://cloud.google.com/logging/docs/logs-based-metrics/) 2. [Custom Metrics in Cloud Monitoring](https://cloud.google.com/monitoring/custom-metrics/) 3. [Alert Policies Documentation](https://cloud.google.com/monitoring/alerts/) 4. [gcloud Logging Metrics](https://cloud.google.com/logging/docs/reference/tools/gcloud-logging) 5. [IAM Policy Configurations](https://cloud.google.com/logging/docs/audit/configure-data-access#getiampolicysetiampolicy) ### CIS Controls:

Control	Description	IG 1	IG 2	IG 3
8.2 Collect Audit Logs	Enable audit logging across enterprise assets.	✅	✅	✅
8.5 Collect Detailed Audit Logs	Enable detailed logs for sensitive data, including event source and timestamps.	✅	✅
6.2 Activate Audit Logging	Ensure audit logging is enabled on all systems and devices.	✅	✅	✅
6.3 Enable Detailed Logging	Enable logging with event sources, users, timestamps, and other details.	✅	✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.