# 2.8 Ensure Log Metric Filter and Alerts Exist for VPC Network Route Changes (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232965-2-8-ensure-log-metric-filter-and-alerts-exist-for-vpc-network-route-changes-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability: Level 2 ### Description: To monitor changes to Virtual Private Cloud (VPC) network routes, it is recommended to configure log metric filters and alerts. This ensures that any modifications to the network routes are detected promptly, helping maintain the integrity and expected behavior of network traffic paths. ### Rationale: Routes in GCP define how network traffic flows between resources within and outside a VPC. Monitoring changes to these routes helps detect unauthorized or unexpected modifications, reducing the risk of security incidents or misconfigurations that might disrupt traffic or expose resources to external threats. ### Impact: Enabling logging and alerting may incur additional costs due to log data storage and processing, especially in larger organizations with frequent network changes. ### Default Value: By default, VPC route changes are not monitored or alerted. ### Audit Steps: #### **Using Google Cloud Console:** 1. **Verify Log Metric Configuration:** - **Navigate to [Logs-based Metrics](https://console.cloud.google.com/logs/metrics).**                                        **![](https://support.icompaas.com/assets/kb/fb3ea2c245e407ea.png)** - In the User-defined Metrics section, ensure there is a metric with the following filter: resource.type="gce\_route" AND (protoPayload.methodName:"compute.routes.delete" OR protoPayload.methodName:"compute.routes.insert") 2. **Verify Alert Policy Configuration:** - **Go to [Alerting](https://console.cloud.google.com/monitoring/alerting).**                                           **![](https://support.icompaas.com/assets/kb/24a397659ed77672.png)** - **Confirm the presence of an alert policy linked to the above metric.** - **Ensure the alert policy is configured to trigger when:** - **Condition: Any route changes occur.** - **Threshold: 0 (triggers an alert for any change).**                             **![](https://support.icompaas.com/assets/kb/fc0cebd7928218c6.png)** - **Verify that appropriate notification channels are set up.**                              **![](https://support.icompaas.com/assets/kb/041d89520dc56b5c.png)** #### **Using Google Cloud CLI:** 1. **Verify Log Metric Configuration:** - List log metrics: gcloud logging metrics list --format json - Check for a metric with the following filter: resource.type="gce\_route" AND (protoPayload.methodName:"compute.routes.delete" OR protoPayload.methodName:"compute.routes.insert") 2. Verify Alert Policy Configuration: - List alerting policies: gcloud alpha monitoring policies list --format json - **Ensure there is a policy with:** - Condition Filter: Matches the above metric. - Enabled: true. ### **Remediation Steps:** #### **Using Google Cloud Console:** 1. **Create a Log Metric:** - **Navigate to [Logs-based Metrics](https://console.cloud.google.com/logs/metrics).**                                **![](https://support.icompaas.com/assets/kb/f848ecf04f3b1513.png)** - Click CREATE METRIC and set the following:                                 **![](https://support.icompaas.com/assets/kb/a0eee32145495676.png)** Filter: resource.type="gce\_route" AND (protoPayload.methodName:"compute.routes.delete" OR protoPayload.methodName:"compute.routes.insert") - Metric Type: Counter.                                      **![](https://support.icompaas.com/assets/kb/3aea524adbaff4b5.png)** - Units: 1 (default). - Click Create Metric.                                   **![](https://support.icompaas.com/assets/kb/d68a349ae0c8d6cc.png)** 2. Create an Alert Policy: - Locate the newly created metric in User-defined Metrics.                                   **![](https://support.icompaas.com/assets/kb/22a050b1a587ab5e.png)** - Click the three-dot menu and select Create alert from Metric.                     **![](https://support.icompaas.com/assets/kb/5dfc1e529e65b58c.png)** - **Configure the alert policy:** - Aggregator: Count. - Threshold: Above 0. - Condition: Trigger alerts on any route changes. - **Configure notification channels and save the policy.**                                   **![](https://support.icompaas.com/assets/kb/73e4cd9bdd34f026.png)** #### **Using Google Cloud CLI:** Create a Log Metric: gcloud logging metrics create \\ --description="Monitor VPC route changes" \\ --log-filter="resource.type='gce\_route' AND \\ (protoPayload.methodName:'compute.routes.delete' OR \\ protoPayload.methodName:'compute.routes.insert')" Create an Alert Policy: gcloud alpha monitoring policies create \\ --display-name="" \\ --conditions="" \\ --notification-channels="" ### **References:** 1. **[Logs-Based Metrics](https://cloud.google.com/logging/docs/logs-based-metrics)** 2. **[Custom Metrics in Monitoring](https://cloud.google.com/monitoring/custom-metrics/)** 3. **[Alerts in Monitoring](https://cloud.google.com/monitoring/alerts/)** 4. **[Logging CLI Reference](https://cloud.google.com/logging/docs/reference/tools/gcloud-logging)** ### ### **CIS Controls:**

Control

Description

IG 1

IG 2

IG 3

8.2 Collect Audit Logs

Enable audit logging across enterprise assets.

✅

✅

✅

8.5 Collect Detailed Audit Logs

Configure detailed logging to capture sensitive data-related activities for forensics.

✅

✅


6.2 Activate Audit Logging

Ensure local logging is enabled on systems and devices.

✅

✅

✅

6.3 Enable Detailed Logging

Include event source, timestamps, and relevant details in logs.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.