You are implementing Google Security Operations (SecOps) with multiple log sources. You want to closely monitor the health of the ingestion…

The most effective way to detect a "silent source" is to monitor for the absence of expected data. A Cloud Monitoring metric-absence alerting policy is specifically designed for this scenario. It triggers an alert when no data points are received for a particular metric time series (identified here by collectorid) within a specified duration. By setting this duration to five minutes, you create a proactive and automated notification system that precisely meets the requirement of detecting silent forwarders or agents in a timely manner.

A. An alert on total log count might not trigger if a forwarder goes offline completely and stops sending metrics altogether, including a metric with a zero value. Metric-absence detects the lack of the metric itself.

C. A Looker dashboard is a passive visualization tool. It requires manual observation to detect an issue and does not provide the proactive, automated alerting required by the scenario.

D. Similar to a Looker dashboard, the native Google SecOps dashboard is for visualization and investigation, not for creating automated, time-sensitive alerts based on the absence of data.

1. Google Cloud Documentation

"Alerting on metric absence": This document explicitly states

"You can use a metric-absence alerting policy to notify you when a resource stops sending data... For example

if you have a process that is expected to write a data point to a time series every minute

you can create a policy that notifies you if you don't see a data point for five minutes." This directly maps to the question's scenario.

Source: Google Cloud Documentation

Cloud Monitoring

"Alerting on metric absence".

2. Google Cloud Documentation

"Create metric-absence alerting policies (UI)": This guide details the configuration steps. In the "Configure alert trigger" section

it shows how to set the "Alert trigger" to "Metric Absence" and configure the "Absence duration" (e.g.

5 minutes)

confirming the technical feasibility of the correct answer.

Source: Google Cloud Documentation

Cloud Monitoring

"Create metric-absence alerting policies (UI)".

3. Google Cloud Documentation

"Chronicle ingestion metrics": This page lists the metrics available for monitoring Google SecOps ingestion

such as chronicle.googleapis.com/ingestion/logentrycount. It also specifies the available metric labels

including collectorid

which allows for creating distinct time series for each forwarder or agent

as required by the question.

Source: Google Cloud Documentation

Chronicle

"Chronicle ingestion metrics".