Skip to main content
Question

ingest gcp monitoring alerts to secops via pubsub push

  • January 21, 2026
  • 1 reply
  • 30 views

NASEEF
Forum|alt.badge.img+8

Hello team,

I’m trying to ingest GCP Monitoring alerts into SecOps using a Pub/Sub push subscription. To do this, I created an alert policy for “agent goes silent” and configured a notification channel using a Pub/Sub topic. That topic is attached to a push subscription that forwards events to the endpoint.

I am receiving email notifications (since email is also configured in the notification channel along with the pubsub topic), but the alerts are not being pushed to SecOps from the Pub/Sub topic.

I have given the pubsub publisher  permission to the topic 
My alerts are not getting acknowledged by secops endpoint

Is there any documentation I can refer to for correctly pushing GCP Monitoring alerts to SecOps?

1 reply

Eoved
Forum|alt.badge.img+8
  • Bronze 2
  • January 21, 2026

I know one way to do it is to create a webhook on the SOAR side and integrate between the systems.
See the following document:
https://docs.cloud.google.com/chronicle/docs/soar/ingest/webhooks/setting-up-a-webhook