pci-gke-blueprint icon indicating copy to clipboard operation
pci-gke-blueprint copied to clipboard

Investigate adding Stackdriver IRM to the demo

Open jmound opened this issue 5 years ago • 1 comments

jmound avatar Apr 23 '19 20:04 jmound

Update: We can create Stackdriver IRM alerts on any metric in Stackdriver. For example, if avg(cpu_load) across a certain set of instances goes above a threshold, trigger alert.

There aren't any security-focused metrics available in Stackdriver and it doesn't look like there's a built in way to get Forseti or Cloud SCC info into Stackdriver as a metric.

I'm currently exploring creating a log-based Metric off of Forseti findings (not sure if this is even possible yet), and using that to create a metric for an alert. Something like "f number of findings within day over threshold X, trigger alert"

chroto avatar May 28 '19 12:05 chroto