monitoring.organization_cis_log_alerts_central — version 1.7

Source: presets/monitoring/organization-cis-log-alerts-central.satz

Purpose

Centralized log-based alerting for CIS 2.5-2.12 in 5.0 numbering, 2.4-2.11 in 4.0.

One logging bucket + second org sink + 8 bucket-scoped metrics + 8 alert policies + email channel. Estate wiring: nothing to set when the audit logsink pack is used — the alert project defaults to ITS project. Without that pack, set cis_central_bucket_project.

Filters are verbatim CIS/Prowler strings; alert filters reference metric names (dependency edge) and pin resource.type= "logging_bucket" (bucket-scoped metrics report against it — verified live).

Use it

params {
  // the pack's own defaults — copy only the lines you change
  cis_central_bucket_project = logsink_project_id
  cis_central_bucket_id = "{customer_shortname}-organization-log-alerts"
  cis_central_bucket_location = default_region
  cis_central_bucket_retention_days = 30
  cis_central_sink_name = "cis-central-metrics-sink"
  cis_central_email = "gcp-security@{customer_domain}"
  cis_central_channel_name = "CIS Security Alerts (org)"
  cis_central_alert_window = "300s"
}

use "presets/monitoring/organization-cis-log-alerts-central.satz"

Needs from outside the pack:

• customer_domain — declared by estate_core; use one of them alongside, or declare it in the estate.
• customer_organization_id — declared by estate_core; use one of them alongside, or declare it in the estate.
• customer_shortname — declared by estate_core; use one of them alongside, or declare it in the estate.
• default_region — declared by estate_core; use one of them alongside, or declare it in the estate.
• logsink_project_id — declared by monitoring.organization_audit_logsink; use one of them alongside, or declare it in the estate.

Params

Questions

What to ask before this pack is configured, and what changing the answer costs.

cis_central_email — Monitoring sends from alerting-noreply@google.com, so the mailbox must exist and accept external mail; a group whose members have no mailboxes drops every alert silently, and nothing in the estate can detect that. People leave; groups have owners.

cis_central_bucket_project — Every metric and policy is created in this project; moving them is a recreate and loses alert history. The default is the audit-logsink pack's project, by reference — one logging project for the archive and the alerting — and needs no answer beyond accepting it when that pack is used.

Contributes

Claims

What the controls ask (this project's paraphrase from the catalog — never the framework's own text):

• Audit configuration change alerts (cis-gcp 4.0 §2.5, cis-gcp 5.0 §2.6) — Log metric filter and alert on changes to audit logging configuration.
• Custom role change alerts (cis-gcp 4.0 §2.6, cis-gcp 5.0 §2.7) — Log metric filter and alert on IAM custom role creation, modification, deletion.
• Project ownership change alerts (cis-gcp 4.0 §2.4, cis-gcp 5.0 §2.5) — Log metric filter and alert on project ownership assignments/changes across the organization.
• SQL instance change alerts (cis-gcp 4.0 §2.11, cis-gcp 5.0 §2.12) — Log metric filter and alert on Cloud SQL instance configuration changes.
• Storage IAM change alerts (cis-gcp 4.0 §2.10, cis-gcp 5.0 §2.11) — Log metric filter and alert on Cloud Storage bucket IAM permission changes.
• VPC firewall rule change alerts (cis-gcp 4.0 §2.7, cis-gcp 5.0 §2.8) — Log metric filter and alert on firewall rule create/modify/delete.
• VPC network change alerts (cis-gcp 4.0 §2.9, cis-gcp 5.0 §2.10) — Log metric filter and alert on VPC network create/modify/delete.
• VPC route change alerts (cis-gcp 4.0 §2.8, cis-gcp 5.0 §2.9) — Log metric filter and alert on VPC network route changes.

Not every resource this pack contributes is a witness:

• google_logging_project_bucket_config.cis_central_metrics — contributed, but no claim names it.
• google_project_iam_member.cis_central_sink_writer — contributed, but no claim names it.

History

The whole library's history: the changelog in presets/CHANGELOG.md.

Notes

Pairs with monitoring.organization_audit_logsink: one logging project holds both the archive and this alerting bucket, and cis_central_bucket_project defaults to that pack's project by reference. Without that pack the estate must set it — the pack stops rather than guess a project nothing creates.

The metrics are bucket-scoped, so every alert filter pins resource.type="logging_bucket". For a project outside the organisation sweep there is project_cis_log_alerts; the two cover the same controls, so an estate uses one of them per project.