Managed LZ: Provide diff of alerts/logs/metrics on GKE autopilot vs standard CC deployments - with triaged priority for Tier1-4 ticket generation use cases

[fmichaelobrien]

Raised by SSC team and @lucstjean-ssc today Managed LZ: Provide alerts/logs/metrics on GKE autopilot vs standard CC deployments - with triaged priority for Tier1-4 ticket generation use cases Also discussed was from the perspective of current GCP users of GKE autopilot clusters - Thinking consumers of GKE threat analysis - Mandiant team?

Deliverables is both a diff list of metrics/alerts/logs on GKE autopilot/standard and a prioritized list of alerts based on temporary/critical levels - to drive Tier1-4 ticket support

[cartyc]

@lucstjean-ssc would GKE Security Posture help with this at all? Happy to sync offline to get more details of what you need.

There is also our hardening Guide's https://cloud.google.com/kubernetes-engine/docs/how-to/hardening-your-cluster

[lucstjean-ssc]

@cartyc Thanks I'm not sure I ever came across this. I will have a look. Our main concern is what alerts should we create and fire off via notification channels.

[cartyc]

It's pretty handy but doesn't cover alerting like you're looking for. I'll look into if we have any recommendations for what alerts should enabled for GKE (std/ap) clusters.

[KingBain]

Note sure if this has moved further in terms of alerting, but this is what we were looking to implement

https://github.com/gschaeffer/scc-findings-to-pubsub

I assume from Cloud monitoring it could be easier to trigger alerts for things like SIEM or SRE bots ?

[cartyc]

Alerts from Cloud Monitoring would likely be easier, lots of integrations are available in the notifcation channels that Alerts use.

[cartyc]

@KingBain are there specific metrics you are looking to extract from Security Command Center?

[KingBain]

"Just the good ones"

honeslty unsure right now, we're just at the phase now to start investigating org level alerts and project level alerts

[lucstjean-ssc]

@KingBain We should start looking deeper into alerting during our next sprint. I did find this link to be a good point of reference: https://cloud.google.com/monitoring/api/metrics_gcp

[fmichaelobrien]

Good discussion guys, I am also looking at alerts - starting with routers and bgp sessions up/down via VPNs or interconnects we are deploying. Will sync

448

Around https://cloud.google.com/network-connectivity/docs/interconnect/how-to/monitoring