> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Network Route Change Log Alerts Should Be Enabled ### More Info: Ensures that logging and log alerts exist for VPC network route changes. ### Risk Level Medium ### Address Security ### Compliance Standards SOC2, NIST, ISO27001, HIPAA, CISGCP, CBP, HITRUST ### Triage and Remediation ### Remediation To remediate the misconfiguration "Network Route Change Log Alerts Should Be Enabled" for GCP using GCP console, follow these steps: 1. Open the GCP console and navigate to the Logging section. 2. Click on "Logs Explorer" in the left-hand menu. 3. In the search bar at the top of the page, type "route" and press enter. 4. Select the "GCE\_NETWORK\_ROUTE" log type from the dropdown menu. 5. Click on the "Create Metric" button. 6. Name the metric "route-change" and set the aggregation to "Count". 7. Click on the "Create" button to create the metric. 8. In the left-hand menu, click on "Alerting". 9. Click on the "Create Policy" button. 10. Name the policy "route-change-alert" and set the "Resource Type" to "GCE Instance". 11. Under "Conditions", click on "Add Condition". 12. Select "Metric Threshold" as the condition type. 13. Set the "Metric" to "route-change" and set the "Aggregation" to "Count". 14. Set the "Threshold" to "1" and the "For" duration to "1 minute". 15. Click on "Add" to add the condition. 16. Under "Notifications", click on "Add Notification". 17. Select the notification method you want to use (e.g. email, SMS, etc.) and enter the appropriate information. 18. Click on "Save" to save the policy. By following these steps, you will have successfully enabled network route change log alerts for GCP using GCP console. # To remediate the misconfiguration "Network Route Change Log Alerts Should Be Enabled" for GCP using GCP CLI, please follow the below steps: 1. Open the Cloud Shell in the GCP Console. 2. Run the following command to enable route change log alerts for your project: ``` gcloud beta logging sinks create ROUTE_CHANGE_LOGS_STORAGE_BUCKET_NAME \ storage.googleapis.com/ROUTE_CHANGE_LOGS_STORAGE_BUCKET_NAME \ --log-filter="resource.type=\"gce_route\" AND protoPayload.methodName=\"beta.compute.routes.patch\"" \ --project=PROJECT_ID ``` Note: Replace ROUTE\_CHANGE\_LOGS\_STORAGE\_BUCKET\_NAME and PROJECT\_ID with your own values. 3. Run the following command to grant the logs writer role to the sink service account: ``` gcloud projects add-iam-policy-binding PROJECT_ID \ --member="serviceAccount:SINK_SERVICE_ACCOUNT" \ --role="roles/logging.logWriter" ``` Note: Replace PROJECT\_ID and SINK\_SERVICE\_ACCOUNT with your own values. 4. Run the following command to create a log metric for the route change logs: ``` gcloud logging metrics create ROUTE_CHANGE_LOGS_METRIC_NAME \ --description="Metric for route change logs" \ --filter="resource.type=\"gce_route\" AND protoPayload.methodName=\"beta.compute.routes.patch\"" \ --project=PROJECT_ID ``` Note: Replace ROUTE\_CHANGE\_LOGS\_METRIC\_NAME and PROJECT\_ID with your own values. 5. Run the following command to create an alert policy for the route change logs: ``` gcloud alpha monitoring policies create-route-change-alert-policy \ --display-name="Route Change Log Alerts" \ --condition-filter="metric.type=\"logging.googleapis.com/user/ROUTE_CHANGE_LOGS_METRIC_NAME\" AND resource.type=\"gce_route\"" \ --destination-channel-name="CHANNEL_NAME" \ --project=PROJECT_ID ``` Note: Replace ROUTE\_CHANGE\_LOGS\_METRIC\_NAME, CHANNEL\_NAME, and PROJECT\_ID with your own values. 6. Verify that the alert policy is created successfully by running the following command: ``` gcloud alpha monitoring policies list --filter="displayName=\"Route Change Log Alerts\"" --project=PROJECT_ID ``` Note: Replace PROJECT\_ID with your own value. By following the above steps, you will be able to remediate the misconfiguration "Network Route Change Log Alerts Should Be Enabled" for GCP using GCP CLI. To remediate the misconfiguration "Network Route Change Log Alerts Should Be Enabled" for GCP using Python, follow the below steps: 1. Import the required libraries: ```python theme={null} from google.cloud import logging_v2 from google.cloud.logging_v2 import enums from google.protobuf import field_mask_pb2 ``` 2. Set the project ID for which you want to enable the Network Route Change Log Alerts: ```python theme={null} project_id = 'your-project-id' ``` 3. Initialize the Logging client: ```python theme={null} client = logging_v2.LoggingServiceV2Client() ``` 4. Create a request to get the existing sink for the project: ```python theme={null} parent = f"projects/{project_id}" response = client.list_sinks(parent) ``` 5. Check if the sink already exists. If it exists, update it with the required configuration. If it doesn't exist, create a new sink with the required configuration: ```python theme={null} # Check if the sink already exists for sink in response.sinks: if sink.name == f"{parent}/sinks/your-sink-name": # Update the existing sink with the required configuration sink.filter = "resource.type=gce_route AND protoPayload.methodName=beta.compute.routes.patch" sink.destination = "pubsub.googleapis.com/projects/your-project-id/topics/your-topic-name" sink.output_version_format = enums.LogSinkVersionFormat.V2 update_mask = field_mask_pb2.FieldMask(paths=["filter", "destination", "output_version_format"]) client.update_sink(sink=sink, update_mask=update_mask) break else: # Create a new sink with the required configuration sink = logging_v2.types.LogSink() sink.name = f"{parent}/sinks/your-sink-name" sink.filter = "resource.type=gce_route AND protoPayload.methodName=beta.compute.routes.patch" sink.destination = "pubsub.googleapis.com/projects/your-project-id/topics/your-topic-name" sink.output_version_format = enums.LogSinkVersionFormat.V2 client.create_sink(parent, sink) ``` Note: Replace `your-sink-name` and `your-topic-name` with the desired names for your sink and topic. 6. Confirm that the sink is created or updated successfully by checking the Stackdriver Logging console. With these steps, you can remediate the misconfiguration "Network Route Change Log Alerts Should Be Enabled" for GCP using Python. ### Additional Reading: * [https://cloud.google.com/logging/docs/logs-based-metrics](https://cloud.google.com/logging/docs/logs-based-metrics)