🔷CIS GCP 2.2Rule: GCP-LOG-002medium

Ensure log metric filters and alerts exist for critical changes

Description

Create log-based metrics and alerts for project ownership changes, audit config changes, and custom role modifications.

⚠️ Risk Impact

Without alerting, an attacker who gains access can modify permissions, disable logging, and cover their tracks undetected.

🔍 How EchelonGraph Detects This

GCP-LOG-002Automated scanner rule

EchelonGraph's Tier 1 Cloud Scanner automatically checks for this condition across all connected Google Cloud accounts. Violations are flagged as medium-severity findings with remediation guidance.

🔧 Remediation

Create log-based metrics using Cloud Monitoring for IAM policy changes, firewall rule changes, and route changes.

💀 Real-World Attack Scenario

An attacker compromised an admin account and immediately modified the IAM policy to add a backdoor service account. Without log metric alerts, the change went unnoticed for 4 months. The attacker used the backdoor to access the project from a different IP range, making the original compromise harder to trace.

💰 Cost of Non-Compliance

Average dwell time without security alerting: 277 days. With real-time alerting: 23 days. Cost differential: $2.7M. SOC 2 CC7.2 requires monitoring and alerting capabilities.

📋 Audit Questions

  • 1.What log-based metrics are configured for security events?
  • 2.Who receives alerts for IAM policy changes?
  • 3.What is the response SLA for critical security alerts?
  • 4.When was the last time an alert was triggered and investigated?

🎯 MITRE ATT&CK Mapping

T1098 — Account ManipulationT1562 — Impair Defenses

🏗️ Infrastructure as Code Fix

main.tf
resource "google_logging_metric" "iam_changes" {
  name   = "iam-policy-changes"
  filter = "protoPayload.methodName=\"SetIamPolicy\" OR protoPayload.methodName=\"SetOrgPolicy\""
  metric_descriptor {
    metric_kind = "DELTA"
    value_type  = "INT64"
  }
}
resource "google_monitoring_alert_policy" "iam_alert" {
  display_name = "IAM Policy Change Alert"
  conditions {
    display_name = "IAM changes detected"
    condition_threshold {
      filter          = "metric.type=\"logging.googleapis.com/user/iam-policy-changes\""
      comparison      = "COMPARISON_GT"
      threshold_value = 0
      duration        = "0s"
    }
  }
}

⚡ Common Pitfalls

  • ⛔Creating metrics but not configuring notification channels
  • ⛔Setting alert thresholds too high, missing single unauthorized changes
  • ⛔Alert fatigue from overly broad filters that generate too many notifications

📈 Business Value

Real-time security alerting reduces dwell time by 91% and breach cost by 60%. It transforms security from reactive to proactive and demonstrates due diligence to auditors and regulators.

⏱️ Effort Estimate

Manual

4-8 hours to create all recommended metrics and alerts

With EchelonGraph

EchelonGraph monitors for missing log metric configurations automatically

🔗 Cross-Framework References

SOC2-CC7.2ISO27001-A.12.4.3

Automate CIS GCP 2.2 compliance

EchelonGraph continuously monitors this control across all your cloud accounts.

Start Free →