Detection: Monitoring Metric Descriptor Deleted

Overview

Detect when a monitoring metric descriptor was deleted in GCP. Metric descriptors define the structure of metrics, and their deletion can disrupt monitoring workflows and impact the visibility of system performance and operations. Monitoring these events ensures proper tracking of metrics and prevents unauthorized or accidental removal of critical metric definitions.

References:

Usage

Run the detection in your terminal:

powerpipe detection run gcp_audit_log_detections.detection.monitoring_metric_descriptor_deleted

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe detection run gcp_audit_log_detections.detection.monitoring_metric_descriptor_deleted --share

SQL

This detection uses a named query:

select
  tp_timestamp as timestamp,
method_name as operation,
resource_name as resource,
authentication_info.principal_email as actor,
tp_source_ip as source_ip,
tp_index as project,
tp_id as source_id,
-- Create new aliases to preserve original row data
*

from
  gcp_audit_log
where
  method_name ilike 'google.monitoring.v%.metricservice.deletemetricdescriptor'
  and severity != 'Error'
-- TODO: Do we need to check operation?
-- and (operation_src is null or operation_src.last = true)

order by
  timestamp desc;

Detection: Monitoring Metric Descriptor Deleted

Overview

Usage

SQL

Tags