Google Cloud monitoring alert events

​

Cloud Monitoring: webhook notification channel

​

Step 1: Configure alert channel

1. Log in to the Google Cloud Console, search for the Monitoring product, and enter its console
2. Find Alerting in the left menu and click EDIT NOTIFICATION CHANNELS to create a channel
3. Find Webhooks on the Notification channels page and click ADD NEW
4. Enter the integration push URL in the Endpoint URL field (the URL will be generated after saving the integration name on the current page)
5. Enter Flashduty in the Display Name field
6. Click TEST CONNECTION and then SAVE to complete

​

Step 2: Use Flashduty alert channel in alert policy

1. Return to the Alerting page
2. Create or edit an existing policy
3. Skip other policy configurations (configure alert conditions according to business requirements)
4. On the Notifications and name page, keep Use notification channel enabled
5. Select the Flashduty channel created in Step 1 from the Notification channels dropdown, and check Notify on incident closure
6. Complete other configurations and save the policy

​

Cloud Monitoring: Pub/Sub notification channel

1. Create the topic and push subscription as described in Create a Pub/Sub push subscription.
2. In Alerting → EDIT NOTIFICATION CHANNELS, click ADD NEW in the Pub/Sub section and enter the topic name.
3. As prompted, grant service-<project number>@gcp-sa-monitoring-notification.iam.gserviceaccount.com the Pub/Sub Publisher role on the topic.
4. Select this Pub/Sub channel in the alerting policy’s Notification channels and check Notify on incident closure.

​

Error reporting

1. Create a webhook notification channel as in step 1 of Cloud Monitoring: webhook notification channel (you can reuse the same Flashduty channel).
2. Open the Error Reporting page and click Configure notifications.
3. Select the Flashduty channel under Notification channels and save.

• One error group (same project, same error details link) maps to one alert. A notification for the same group merges into the alert while it is still open.
• Error Reporting sends no “resolved” notification, so the alert never recovers by itself. Close it in Flashduty.
• Alerts have Warning severity. To use another severity, append &severity=Critical (or Info) to the push URL.

​

Security Command Center

1. Create the topic and push subscription as described in Create a Pub/Sub push subscription.
2. Grant the SCC service account the Pub/Sub Publisher role on the topic, then create a continuous export (NotificationConfig), for example:

gcloud scc notifications create flashduty-findings \
    --organization=<organization ID> \
    --location=global \
    --pubsub-topic=projects/<project ID>/topics/<topic name> \
    --filter='severity="HIGH" OR severity="CRITICAL"'

• The finding’s resource name, finding.name, is the Alert Key, so every update to one finding merges into one alert.
• The alert recovers when the finding’s state becomes INACTIVE (remediated, resource deleted, or set by hand) or its mute becomes MUTED. It triggers again when the finding becomes ACTIVE or UNMUTED.
• Threat findings (for example, from Event Threat Detection) never become INACTIVE automatically. Change their state or mute them in SCC.

​

Cloud Billing budgets

1. Create the topic and push subscription as described in Create a Pub/Sub push subscription.
2. Go to Billing → Budgets & alerts, create or edit a budget, and set threshold rules (actual and/or forecasted cost).
3. Under Manage notifications, check Connect a Pub/Sub topic to this budget, select the topic above, and save.

• A message that exceeds no threshold creates no alert.
• Actual cost (alertThresholdExceeded) and forecasted cost (forecastThresholdExceeded) create separate alerts.
• The Alert Key combines the billing account, budget, budget period, cost type, and the highest threshold exceeded. Repeated messages for the same threshold merge into one alert. Crossing a higher threshold creates a new alert.
• Budget alerts never recover automatically. When a new budget period starts, alerts are tracked for the new period. Close alerts from the previous period by hand.

​

Create a Pub/Sub push subscription

1. Go to Pub/Sub → Topics and click CREATE TOPIC (or use an existing topic).
2. In the topic, click CREATE SUBSCRIPTION:
   • Delivery type: select Push.
   • Endpoint URL: enter the integration push URL.
   • Enable authentication: leave unchecked. The integration_key in the push URL authenticates the request; Flashduty does not check Pub/Sub identity tokens.
   • Enable payload unwrapping: leave unchecked. Flashduty needs the message attributes (such as a budget’s budgetId), which unwrapping drops.
3. Save the subscription.