Checks

Cloud Logging contains a log-based metric targeting project ownership changes in Cloud Resource Manager events, and Cloud Monitoring has an alerting policy tied to that metric. It detects metrics matching roles/owner additions/removals or ownership invites, and whether an alert references that metric.

Cloud Logging has a log-based metric matching Cloud SQL instance updates (protoPayload.methodName="cloudsql.instances.update") and a Cloud Monitoring alert policy references that metric to notify on configuration changes.

Cloud Logging has a log-based metric for VPC firewall rule changes, matching resource.type="gce_firewall_rule" and protoPayload.methodName of compute.firewalls.insert, compute.firewalls.patch, or compute.firewalls.delete, and Cloud Monitoring includes an alerting policy that references this metric.

Cloud projects are evaluated for a log-based metric with a linked Cloud Monitoring alert that targets VPC network changes on gce_network audit events: compute.networks.insert, patch, delete, addPeering, removePeering.

It checks that these changes are captured and generate notifications.

Cloud Logging includes a log-based metric for VPC route modifications and a linked Cloud Monitoring alert.

It targets gce_route entries for compute.routes.insert and compute.routes.delete so route creations or deletions generate alertable signals.

Cloud Logging project contains at least one sink that exports a copy of all log entries to a destination for centralized retention or processing

Amazon Macie administrator account has automated sensitive data discovery enabled for S3 data. The evaluation confirms the feature's status for the account in each Region.

Amazon Macie status is assessed per region with S3 presence to determine if sensitive data discovery is operational. The outcome reflects whether Macie is active or in a PAUSED/not enabled state for the account and region.

The domain-wide Google Workspace Marketplace configuration restricts which apps users can install. Only admin-approved apps from the Marketplace allowlist are permitted, preventing users from installing unvetted third-party applications.

MemoryDB clusters are evaluated for the auto_minor_version_upgrade setting that automatically applies new minor engine versions.

MemoryDB clusters are evaluated for in-transit encryption (TLS) on client and inter-node traffic (TLSEnabled=true).

Azure Monitor Activity Log alert configurations are assessed for an activity log alert on Microsoft.Authorization/policyAssignments/write, indicating monitoring of newly created Azure Policy assignments

Azure Monitor Activity Log alert monitors Network Security Group changes via the Microsoft.Network/networkSecurityGroups/write operation to capture create/update events across the subscription

Azure Monitor activity log alert for Public IP addresses tracks Microsoft.Network/publicIPAddresses/write events at the subscription level, covering any creation or update of public IP resources.

Azure Monitor activity log alert is configured to capture Security Solutions create/update operations (Microsoft.Security/securitySolutions/write) at subscription scope.

Azure Monitor activity log alerts are configured for Azure SQL Server firewall rule changes, targeting the Microsoft.Sql/servers/firewallRules/write operation.

This evaluates whether notifications or automated actions are set when firewall rules are created or updated.

Azure Monitor activity log alerts include the NSG deletion signal (Microsoft.Network/networkSecurityGroups/delete or Microsoft.ClassicNetwork/networkSecurityGroups/delete). The finding indicates whether a subscription has an alert rule configured to trigger when a Network Security Group is deleted.

Azure Monitor Activity log alerts for policy assignment deletions using the Microsoft.Authorization/policyAssignments/delete operation at subscription scope

Azure Monitor activity log alert exists for the Delete Public IP Address operation (Microsoft.Network/publicIPAddresses/delete), capturing subscription-wide events when Public IP resources are removed.

Azure activity log alerts monitor deletions of Security Solutions by targeting the operation Microsoft.Security/securitySolutions/delete at subscription scope.

Identifies whether notifications are configured for security solution removal events.

Azure Monitor Activity log alerts watch the admin operation Microsoft.Sql/servers/firewallRules/delete, indicating when an Azure SQL firewall rule is removed across a subscription.

Azure Monitor Activity Log alert is configured for Service Health notifications where category is ServiceHealth and properties.incidentType is Incident, with the rule enabled.

Azure Monitor Diagnostic Settings are configured to export the Activity Log to an external destination (Log Analytics, Storage, Event Hub, or partner).

Azure Monitor Diagnostic Settings capture control-plane events at the subscription level. This evaluates whether at least one setting collects the categories: Administrative, Security, Policy, and Alert.