# 2.9 Ensure Log Metric Filter and Alerts Exist for VPC Network Changes (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232975-2-9-ensure-log-metric-filter-and-alerts-exist-for-vpc-network-changes-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability: Level  ### Description: To monitor changes to Virtual Private Cloud (VPC) networks, it is recommended to set up log metric filters and alerts. These changes include network creation, updates, deletion, and changes to VPC peering connections. ### Rationale: VPCs in Google Cloud allow segmentation and control of network traffic between resources. Monitoring modifications to VPC configurations ensures the integrity of traffic flow and helps identify unauthorized changes. This is particularly important for maintaining the security and reliability of inter-VPC communication. ### Impact: Enabling logging and alerting can result in additional charges for log storage and processing, especially in organizations with frequent VPC changes. ### Default Value: By default, VPC network changes are not monitored or alerted. ### Audit Steps: #### Using Google Cloud Console: 1. Verify Log Metric Configuration: - Navigate to [Logs-based Metrics](https://console.cloud.google.com/logs/metrics).                                                             ![](https://support.icompaas.com/assets/kb/289a9cacce461478.png) Under User-defined Metrics, ensure a metric exists with the following filter: resource.type="gce\_network" AND (protoPayload.methodName:"compute.networks.insert" OR protoPayload.methodName:"compute.networks.patch" OR protoPayload.methodName:"compute.networks.delete" OR protoPayload.methodName:"compute.networks.removePeering" OR protoPayload.methodName:"compute.networks.addPeering") 2. Verify Alert Policy Configuration: - Go to [Alerting](https://console.cloud.google.com/monitoring/alerting).                                                                  ![](https://support.icompaas.com/assets/kb/e791d04eed640442.png) - Confirm an alert policy is linked to the above metric and is configured to trigger when: - Condition: Any network changes occur. - Threshold: 0 (trigger an alert for every change).                                   ![](https://support.icompaas.com/assets/kb/4eb485f45ed0c11b.png) - Ensure appropriate notification channels are set up.                               ![](https://support.icompaas.com/assets/kb/1580a05aa65160bb.png) #### Using Google Cloud CLI: 1. Verify Log Metric Configuration: List the log metrics: gcloud logging metrics list --format json Check for a metric with the following filter: resource.type="gce\_network" AND (protoPayload.methodName:"compute.networks.insert" OR protoPayload.methodName:"compute.networks.patch" OR protoPayload.methodName:"compute.networks.delete" OR protoPayload.methodName:"compute.networks.removePeering" OR protoPayload.methodName:"compute.networks.addPeering") 2. Verify Alert Policy Configuration: List alerting policies: gcloud alpha monitoring policies list --format json - Ensure there is an alert policy where: - Condition Filter: Matches the above metric. - Enabled: true. ### Remediation Steps: #### Using Google Cloud Console: 1. Create a Log Metric: - Navigate to [Logs-based Metrics](https://console.cloud.google.com/logs/metrics).                                  ![](https://support.icompaas.com/assets/kb/bd622748650ae0a1.png) - Click CREATE METRIC and configure:                                      ![](https://support.icompaas.com/assets/kb/f22571b8442bfe9b.png) Filter: resource.type="gce\_network" AND (protoPayload.methodName:"compute.networks.insert" OR protoPayload.methodName:"compute.networks.patch" OR protoPayload.methodName:"compute.networks.delete" OR protoPayload.methodName:"compute.networks.removePeering" OR protoPayload.methodName:"compute.networks.addPeering") - Type: Counter. - Units: 1 (default).                                     ![](https://support.icompaas.com/assets/kb/9fde7ec3d5535946.png) - Click Create Metric.                                     ![](https://support.icompaas.com/assets/kb/ae69bf299a43ff17.png) 2. Create an Alert Policy: - Locate the metric under User-defined Metrics.                                   **![](https://support.icompaas.com/assets/kb/58823fae3a4b3a60.png)** - Click the three-dot menu and select Create alert from Metric. **![](https://support.icompaas.com/assets/kb/d5fd726407aed025.png)** - **Configure the alert:** - **Aggregator: Count.** - **Threshold: Above 0.** - **Condition: Trigger alerts for any VPC changes.** - **Configure notification channels and save the policy.**                                     **![](https://support.icompaas.com/assets/kb/b46833939fd24123.png)** #### **Using Google Cloud CLI:** - Create a Log Metric: gcloud logging metrics create \\ --description="Monitor VPC network changes" \\ --log-filter="resource.type='gce\_network' AND \\ (protoPayload.methodName='compute.networks.insert' OR \\ protoPayload.methodName='compute.networks.patch' OR \\ protoPayload.methodName='compute.networks.delete' OR \\ protoPayload.methodName='compute.networks.removePeering' OR \\ protoPayload.methodName='compute.networks.addPeering')" - Create an Alert Policy: gcloud alpha monitoring policies create \\ --display-name="" \\ --conditions="" \\ --notification-channels="" ### References: 1. [Logs-Based Metrics](https://cloud.google.com/logging/docs/logs-based-metrics) 2. [Custom Metrics in Monitoring](https://cloud.google.com/monitoring/custom-metrics/) 3. [Alerts in Monitoring](https://cloud.google.com/monitoring/alerts/) 4. [Logging CLI Reference](https://cloud.google.com/logging/docs/reference/tools/gcloud-logging) 5. [VPC Overview](https://cloud.google.com/vpc/docs/overview) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

8.2 Collect Audit Logs

Enable audit logging across enterprise assets.

✅

✅

✅

8.5 Collect Detailed Audit Logs

Configure detailed logging to capture sensitive data-related activities for forensics.

✅

✅


6.2 Activate Audit Logging

Ensure local logging is enabled on systems and devices.

✅

✅

✅

6.3 Enable Detailed Logging

Include event source, timestamps, and relevant details in logs.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.