Firewall Change Log Alerts Should Be Enabled
More Info:
Ensures that logging and log alerts exist for firewall rule changes.Risk Level
LowAddress
SecurityCompliance Standards
CISGCP, CBP, HIPAA, ISO27001, HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Firewall Change Log Alerts Should Be Enabled” for GCP using GCP console, follow the below steps:
- Login to your GCP console.
- Navigate to the Security Command Center.
- Click on the “Security Health Analytics” option from the left-hand menu.
- Click on the “Firewall rules” option.
- Select the project for which you want to enable Firewall Change Log Alerts.
- Click on the “Edit” button.
- Scroll down to the “Logging” section and enable the “Firewall Change Log” option.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration “Firewall Change Log Alerts Should Be Enabled” for GCP using GCP CLI, follow these steps:Replace Replace Replace
- Open the Cloud Shell in the GCP Console.
- Run the following command to enable firewall log exports:
[BUCKET_NAME] with the name of the GCS bucket where you want to store the logs, [ORGANIZATION_ID] with the ID of your GCP organization, and [PROJECT_ID] with the ID of the GCP project where you want to enable the firewall log exports.- Run the following command to grant the
Logs Writerrole to the[email protected]service account:
[PROJECT_ID] with the ID of the GCP project where you enabled the firewall log exports.- Run the following command to create a firewall rule to allow traffic from the
[email protected]service account:
- Run the following command to add the
allow-cloud-logstag to the instances where you want to allow traffic from the[email protected]service account:
[INSTANCE_NAME] with the name of the instance where you want to allow traffic from the [email protected] service account, and [ZONE] with the zone where the instance is located.By following these steps, you will enable firewall log exports and allow the [email protected] service account to access the logs.Using Python
Using Python
To remediate the misconfiguration “Firewall Change Log Alerts Should Be Enabled” in GCP using Python, you can follow the below steps:Step 1: Install the necessary librariesStep 2: Authenticate with GCPStep 3: Create a log sinkStep 4: Verify the log sinkAfter running these steps, the log sink for Firewall Change Log Alerts will be created successfully in GCP using Python.