Google Cloud Armor

このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Overview

Google Cloud Armor helps protect Google Cloud deployments from multiple types of threats, including distributed denial-of-service (DDoS) attacks and application attacks like cross-site scripting (XSS) and SQL injection (SQLi).

Armor’s Managed Protection is the managed application protection service that helps protect web applications and services from distributed DDoS attacks and other threats from the internet. Managed Protection features always-on protections for load balancers, and gives access to WAF rules.

Google Cloud Armor is integrated automatically with Security Command Center and exports two findings to the Security Command Center dashboard: Allowed Traffic Spike and Increasing Deny Ratio.

Enable this integration along with the Google Cloud Security Command Center Integration to visualize DDoS threats to your Google Cloud environment in Datadog. With this integration, Datadog collects important security events from your Google Cloud network security configurations and metrics from Google Cloud Armor.

This integration delivers insight into the user activity of changes to cloud resources and every request evaluated by a security policy - from audit logs to request logs.

Setup

Installation

Before you start, ensure the following APIs are enabled for the projects you want to collect Google Cloud Armor events for:

Since Google Cloud Armor events are streamlined as findings to Google Security Command Center, make sure Google Cloud Armor is enabled in the Security Command Center at your Google Cloud console. For more information, see Configuring Security Command Center.
Next, enable the collection of security findings on the main Google Cloud Platform integration.

Configuration

To collect Google Cloud Armor metrics, configure the main Google Cloud integration.

To collect Google Cloud Armor events, you need to add the Security Center Findings Viewer role to the service account. Install the Google Cloud Security Command Center integration, and enable collection of security findings on the main Google Cloud integration.

To set up logs forwarding from your Google Cloud environment to Datadog, see the Log Collection section.

Audit logs can be forwarded through standard log forwarding. These audit logs use the Google Cloud resource types gce_backend_service and network_security_policy. To include only audit logs, use filters such as protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog" while creating the log sink.

Request logs can be forwarded through standard log forwarding. These logs are automatically collected in Google Cloud Load Balancing logs. Use filters such as jsonPayload.enforcedSecurityPolicy.outcome="DENY" while creating the log sink to view requests denied by a security policy.

Data Collected

Metrics

gcp.networksecurity.dos.ingress_bytes_count (count)	The total number of bytes received, broken down by drop status (allowed or dropped). Shown as byte
gcp.networksecurity.dos.ingress_packets_count (count)	The total number of packets received, broken down by drop status (allowed or dropped). Shown as packet
gcp.networksecurity.firewall_endpoint.received_bytes_count (count)	Total firewall endpoint received bytes. Shown as byte
gcp.networksecurity.firewall_endpoint.received_packets_count (count)	Total firewall endpoint received packets. Shown as packet
gcp.networksecurity.firewall_endpoint.sent_bytes_count (count)	Total firewall endpoint sent bytes. Shown as byte
gcp.networksecurity.firewall_endpoint.sent_packets_count (count)	Total firewall endpoint sent packets. Shown as packet
gcp.networksecurity.firewall_endpoint.threats_count (count)	Total firewall endpoint detected threats.
gcp.networksecurity.https.previewed_request_count (count)	Queries that would be affected by rules currently in the 'preview' mode, if those rules were to be made non-preview. Shown as request
gcp.networksecurity.https.request_count (count)	Actual number of queries affected by policy enforcement on queries. Shown as request
gcp.networksecurity.l3.external.packet_count (count)	Estimated number of packets by matching rule and enforcement action. Shown as packet
gcp.networksecurity.l3.external.preview_packet_count (count)	Estimated number of packets that would be affected by rule currently in preview mode, if that rule were to be made non-preview. Shown as packet
gcp.networksecurity.tcp_ssl_proxy.new_connection_count (count)	New connections affected by policy enforcement. Shown as connection
gcp.networksecurity.tcp_ssl_proxy.previewed_new_connection_count (count)	New connections that would be affected by rules currently in the 'preview' mode, if those rules were to be made non-preview. Shown as connection

Service Checks

The Google Cloud Armor integration does not include any service checks.

Events

The Google Cloud Armor integration does not include any events.

Troubleshooting

Need help? Contact Datadog support.