# Copyright 2025 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# yaml-language-server: $schema=../../../schemas/observability.schema.json

alerts:
  firewallRuleChanges:
    combiner: OR
    conditions:
      - condition_threshold:
          aggregations:
            - alignment_period: 60s
              cross_series_reducer: REDUCE_SUM
              group_by_fields:
                - metric.label.principal
                - metric.label.method_name
                - metric.label.project_id
                - metric.label.firewall_rule_id
              per_series_aligner: ALIGN_SUM
          comparison: COMPARISON_GT
          duration: 0s
          filter: resource.type = "logging_bucket" AND metric.type = "logging.googleapis.com/user/firewallRuleChanges"
          threshold_value: 0
          trigger:
            count: 1
        display_name: "Log match condition: VPC Network Firewall Rule Changes"
    display_name: VPC Network Firewall Rule Changes
    documentation:
      content: |-
        Log-based alerting policy in project ${project} detected VPC Network Firewall rule changes.

        This alert helps ensure security by monitoring creation, modification, or deletion of firewall rules.
        ```
        resource.type="gce_firewall_rule" AND (
          protoPayload.methodName:"compute.firewalls.patch" OR
          protoPayload.methodName:"compute.firewalls.insert" OR
          protoPayload.methodName:"compute.firewalls.delete"
        )
        ```
      mime_type: text/markdown
logging_metrics:
  firewallRuleChanges:
    bucket_name: $log_buckets:log-0/audit-logs
    description: VPC Network Firewall Rule Changes
    filter:
      resource.type="gce_firewall_rule" AND (protoPayload.methodName:"compute.firewalls.patch" OR
      protoPayload.methodName:"compute.firewalls.insert" OR protoPayload.methodName:"compute.firewalls.delete")
    label_extractors:
      firewall_rule_id: EXTRACT(labels.firewall_rule_id)
      method_name: EXTRACT(protoPayload.methodName)
      principal: EXTRACT(protoPayload.authenticationInfo.principalEmail)
      project_id: EXTRACT(labels.project_id)
    metric_descriptor:
      labels:
        - description: principal
          key: principal
          value_type: STRING
        - description: method_name
          key: method_name
          value_type: STRING
        - description: project_id
          key: project_id
          value_type: STRING
        - description: firewall_rule_id
          key: firewall_rule_id
          value_type: STRING
      metric_kind: DELTA
      unit: "1"
      value_type: INT64
