# 2.7 Ensure Log Metric Filter and Alerts Exist for VPC Network Firewall Rule Changes (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232961-2-7-ensure-log-metric-filter-and-alerts-exist-for-vpc-network-firewall-rule-changes-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) # Profile Applicability: # Level 2 # Description: It is recommended to configure log metric filters and alerts to monitor changes to Virtual Private Cloud (VPC) network firewall rules. These rules govern network access to resources in a project, and monitoring their changes helps detect unauthorized or unintended access adjustments. # Rationale: Monitoring the creation, update, or deletion of firewall rules provides insight into network access changes and can reduce the time it takes to detect potential suspicious activity or configuration errors. # Impact: Enabling logging for firewall rule changes may increase costs due to the additional log data storage and processing. # Default Value: By default, VPC firewall rule changes are not monitored. # Audit Steps: ## Using Google Cloud Console: 1. Verify Log Metric Configuration: - Navigate to [](https://console.cloud.google.com/logs/metrics)[Logs-based Metrics](https://console.cloud.google.com/logs/metrics).                         ![](https://support.icompaas.com/assets/kb/fdc6c2a31a708099.png) - In the User-defined Metrics section, ensure there is a metric with the following filter: resource.type="gce\_firewall\_rule" AND (protoPayload.methodName:"compute.firewalls.patch" OR protoPayload.methodName:"compute.firewalls.insert" OR protoPayload.methodName:"compute.firewalls.delete") 2. Verify Alert Policy Configuration: - Go to [Alerting](https://console.cloud.google.com/monitoring/alerting).                       ![](https://support.icompaas.com/assets/kb/d77a3f32f4346968.png) - Confirm the presence of an alert policy linked to the metric above. - Check the condition is set to trigger for: - Condition: Any changes to the metric. - Threshold: 0 (alerts on any firewall rule change). - Ensure notification channels are configured for alerts. ## Using Google Cloud CLI: 1. Verify Log Metric Configuration: - List the log metrics: gcloud logging metrics list --format json - Check for a metric with the following filter: resource.type="gce\_firewall\_rule" AND (protoPayload.methodName:"compute.firewalls.patch" OR protoPayload.methodName:"compute.firewalls.insert" OR protoPayload.methodName:"compute.firewalls.delete") 2. Verify Alert Policy Configuration: - List the alerting policies: gcloud alpha monitoring policies list --format json - Confirm the output contains a policy where: - Condition Filter: Matches the above metric. - Enabled: true. # Remediation Steps: ## Using Google Cloud Console: 1. Create a Log Metric: - Navigate to [Logs-based Metrics](https://console.cloud.google.com/logs/metrics).                      ![](https://support.icompaas.com/assets/kb/4c575f4c342e7664.png) - Click CREATE METRIC and set the following: Filter: resource.type="gce\_firewall\_rule" AND (protoPayload.methodName:"compute.firewalls.patch" OR protoPayload.methodName:"compute.firewalls.insert" OR protoPayload.methodName:"compute.firewalls.delete") - Metric Type: Counter. - Units: 1 (default). - Click Create Metric. 2. Create an Alert Policy: - Find the newly created metric under User-defined Metrics. - Click the three-dot menu and select Create alert from Metric. - Configure the alert policy: - Aggregator: Count. - Threshold: Above 0. - Condition: Any change to firewall rules triggers the alert. - Configure notification channels and save the policy. ## Using Google Cloud CLI: Create a Log Metric: gcloud logging metrics create \\ --description="Monitor VPC firewall rule changes" \\ --log-filter="resource.type='gce\_firewall\_rule' AND \\ (protoPayload.methodName:'compute.firewalls.patch' OR \\ protoPayload.methodName:'compute.firewalls.insert' OR \\ protoPayload.methodName:'compute.firewalls.delete')" Create an Alert Policy: gcloud alpha monitoring policies create \\ --display-name="" \\ --conditions="" \\ --notification-channels="" # References: 1. [Logs-Based Metrics](https://cloud.google.com/logging/docs/logs-based-metrics) 2. [Custom Metrics in Monitoring](https://cloud.google.com/monitoring/custom-metrics/) 3. [Alerts in Monitoring](https://cloud.google.com/monitoring/alerts/) 4. [Firewall Rules Documentation](https://cloud.google.com/vpc/docs/firewalls) # CIS Controls:

Control

Description

IG 1

IG 2

IG 3

8.2 Collect Audit Logs

Enable audit logging across enterprise assets.

✅

✅

✅

8.5 Collect Detailed Audit Logs

Configure detailed logging to capture sensitive data-related activities for forensics.

✅

✅


6.2 Activate Audit Logging

Ensure local logging is enabled on systems and devices.

✅

✅

✅

6.3 Enable Detailed Logging

Include event source, timestamps, and relevant details in logs.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.