Skip to main content
Question

ingest gcp monitoring alerts to secops via pubsub push

  • January 21, 2026
  • 3 replies
  • 152 views

NASEEF
Forum|alt.badge.img+9

Hello team,

I’m trying to ingest GCP Monitoring alerts into SecOps using a Pub/Sub push subscription. To do this, I created an alert policy for “agent goes silent” and configured a notification channel using a Pub/Sub topic. That topic is attached to a push subscription that forwards events to the endpoint.

I am receiving email notifications (since email is also configured in the notification channel along with the pubsub topic), but the alerts are not being pushed to SecOps from the Pub/Sub topic.

I have given the pubsub publisher  permission to the topic 
My alerts are not getting acknowledged by secops endpoint

Is there any documentation I can refer to for correctly pushing GCP Monitoring alerts to SecOps?

3 replies

Eoved
Forum|alt.badge.img+9
  • Bronze 3
  • January 21, 2026

I know one way to do it is to create a webhook on the SOAR side and integrate between the systems.
See the following document:
https://docs.cloud.google.com/chronicle/docs/soar/ingest/webhooks/setting-up-a-webhook
 


secops_maneesh

Hi ​@NASEEF , are you seeing alerts in your pub sub?

I am also trying the same but i cant see generated alerts in my pub sub . 


RL01
  • New Member
  • May 13, 2026

Hi ​@NASEEF,

you have to create a push subscription.
On SecOps site you create a feed with source type “Google Cloud Pub/Sub Push” and log type “GCP Cloud Audit”. Create some namespace to find your alerting logs.
Use the feed endpoint url in the push subscription. Enable Authentication and take a service account that is specially for ingesting logs. For the service account you can create a custom role only with this permission “chronicle.logs.import”.