Google Cloud Armor exports monitoring data from security policies to Cloud Monitoring. You can use monitoring metrics to check whether your policies are working as intended or to troubleshoot problems. For example, you can view the traffic that was blocked or allowed for each backend service. You can monitor the metrics of a single security policy (which can be applied to multiple backend services) or a single backend service.
In addition to the predefined dashboards in Monitoring, you can create custom dashboards, set up alert policies, and query the metrics through the Cloud Monitoring API.
On the Monitoring dashboard, Open incidents are driven by the alerting policies that you configure. Alerts appear as incidents on the dashboard when the alert is triggered. These are general functions of Monitoring.
There are no Monitoring logs for Security Command Center.
For complete information about Monitoring, see the Cloud Monitoring documentation.
Viewing the monitoring dashboard
You can monitor the status and request traffic volumes (allowed, denied, or previewed) on a per-policy and per-backend-service basis by using the preconfigured Cloud Armor policies overview resource dashboard in Cloud Monitoring.
To view the dashboard, follow these steps:
In the Google Cloud console, go to Monitoring.
In the navigation pane on the left, select Dashboards.
Under Name, select Cloud Armor policies overview.
Click the name of your policy.
When you access the dashboard, you see overall metrics on the right. These include request volume metrics for requests evaluated by a security policy broken down by outcome: allowed, denied, previewed allowed, previewed denied. Metrics can be observed at varying levels of granularity, including per-project, per-policy, and per-backend-service.
When you click a policy name, you see details about the policy.
Defining custom dashboards
To create custom Monitoring dashboards over Network Security Policy metrics, follow these steps:
Console
In the Google Cloud console, go to Monitoring.
Click Dashboards, and then click Create dashboard.
Create a name for your dashboard, and then click Confirm.
Click Add chart.
Give the chart a title.
Select metrics and filters. For metrics, the resource type is Network Security Policy.