9.5 Security Monitoring
Protection is not enough: we also need to notice when something goes wrong. Security monitoring collects the signals of every project in one place, looks for what should not happen, and tells a person.
We run no virtual machines, so there is no network traffic of our own to inspect. Detection therefore works on logs, at the edge, at ai-gateway and on our own data.
9.5.1 From Signal to Alert¶
flowchart LR
subgraph signals [Signals, every project]
admin[Admin Activity logs]
access[Data Access logs<br/>raw, datasets, secrets]
iap[IAP sign-ins]
armor[Cloud Armor<br/>WAF, rate limits]
scan[Artifact Analysis<br/>image vulnerabilities]
pam[PAM grants]
pgaudit[Cloud SQL pgAudit]
own[Our audit data<br/>PlatformAuditEvent, FeatureUsage]
end
archive[(moonitoring-logging<br/>locked 400 days)]
detect[Detection<br/>alert policies, Security Command Center,<br/>our detection rules]
gateway[ai-gateway<br/>Model Armor]
topic[security.alerts]
people([On-call engineer<br/>security auditors])
signals --> archive --> detect --> topic
gateway --> topic
topic -- Google Chat, e-mail --> people
| What detects | Looks for |
|---|---|
| Log-based alert policies | IAM changes, new access grants, changes to the log sink, prod access through Privileged Access Manager |
| Security Command Center | Misconfigurations everywhere; Event Threat Detection on prod |
| IAM Recommender | Roles granted but never used, to be removed |
| Our detection rules, a scheduled job in the platform project | Patterns only our data shows: unusual Console writes, metering anomalies, unexpected client updates |
Model Armor, at ai-gateway |
Prompt injection and personal data in every prompt and answer |
Every finding is published to the security.alerts topic, which notifies the on-call engineer and the security auditors in Google Chat and by e-mail.
9.5.2 Not Yet, and When¶
These controls are deliberately left out today. Each comes in when the reason appears, and that moment is recorded as a decision:
| Control | Added when |
|---|---|
| VPC Service Controls, a perimeter around farm data | Scale or a customer's compliance asks for it |
| A SIEM (Google SecOps, or Wazuh) | The volume of signals outgrows log queries |
| Cloud Armor Enterprise | Denial-of-service attacks become real |
| Cloud IDS, Falco, Suricata | Virtual machines or Kubernetes appear |