A company has been running their application on Compute Engine. A bug in the application allowed a malicious user to repeatedly execute a script that results in the Compute Engine instance crashing. Although the bug has been fixed, you want to get notified in case this hack re-occurs. What should you do?

The most direct way to be notified about a specific script's execution is to monitor the process itself. Cloud Monitoring's Process Health condition allows you to create an alerting policy that specifically tracks the number of running processes matching a command line string. You can set a threshold for the number of executions, and if this threshold is breached, an alert is triggered and a notification is sent. This precisely addresses the need to be notified if the hack re-occurs.

B. Alerting on CPU usage is an indirect and unreliable metric for this specific problem, as high CPU can have many legitimate causes, leading to false positives.
C. A dashboard requires manual observation to notice an issue; it does not actively send a notification as required by the question.
D. Using BigQuery is for large-scale, non-real-time analysis. It introduces significant delay and complexity for a simple real-time alerting requirement.

1. Google Cloud Documentation, "Alerting on process health". In the overview, it states: "You can create an alerting policy that monitors the number of processes running on a VM instance that match a string... If the number of matching processes is above or below a threshold you set, Cloud Monitoring sends a notification."

2. Google Cloud Documentation, "Alerting policy structure". This page details the components of an alerting policy, including the Condition, which for this case would be a ProcessHealthCondition.