Chronicle Forwarder Telemetry via Google Cloud Monitoring

The Cloud Monitoring integration preview in Chronicle SIEM can send alerts when a log source in Chronicle SIEM goes below a threshold or goes silent.

To create an alert, you need to use the Chronicle SIEM Bring Your Own Project (BYOP) feature and follow the instructions provided in the documentation. You can monitor Chronicle Forwarders with Cloud Monitoring and create alerting policies for them.

For example, you can create an alert for a Forwarder being offline for 5 minutes or 1 hour. You can also monitor specific high-value log sources that stop reporting in and receive notifications via email, mobile app, PagerDuty, SMS, Slack, Webhooks, or Pub/Sub. The Cloud Monitoring integration provides real-time interactive dashboard capabilities for proactive monitoring.