Event collection from Google Cloud Platform (GCP)

The MID WebService Event Collector enables you to collect JSON formatted event messages sent from Google Cloud Platform (GCP).

Avant de commencer

Ensure that the Event Management Connectors (sn_em_connector) plugin is installed on the ServiceNow AI Platform instance.

Ensure that you:

• Deploy and start the MID Server. See MID Server configuration .
• Configure and start the MID Web Server. See Configure the MID Web Server extension.
• Configure and start the MID WebService Event Collector. See Configure the MID WebService Event Collector Context.

Role required: evt_mgmt_admin

Pourquoi et quand exécuter cette tâche

JSON formatted event messages are sent from Google Cloud Platform. The MID Server transforms the collected event messages by parsing them using the TransformEvents_MidGoogleMonitor script include, located here: Event Management > Integrations > PushConnectors. In the Push Connectors page, click Google Monitor Mid Push Connector.

The default format of the URL to push event messages from the GCP to the MID Server is http://<MID_Server_IP>:<MID_Web_Server_Port>/api/mid/em/inbound_event?Transform=TransformEvents_MidGoogleMonitor.

Tableau 1. Variables in the default URL

Variable	Description
MID_Server_IP	IP address of the MID Web Server Extension.
MID_Web_Server_Port	Listening port of the MID Web Server Extension.
MID_Web_Server_User	Username for the MID Web Server Extension.
MID_Web_Server_Password	Password of the user of the MID Web Server.

The following procedure describes the collection of JSON formatted event messages using basic authentication.

Procédure

1. In the Google Cloud Platform (GCP) console, make sure the MID Server IP is accessible from the GCP console and MID rest point is accessible from GCP or install the MID Server on a GCP VM and provide the GCP VM external IP address in the URL.
   In the GCP console, create a firewall rule.
   1. Navigate to VPC Network > Firewall > Create Firewall.
   2. Set the direction to ingress to allow the mid_web_server_port to connect.
   3. Add the GCP VM that the MID Server is installed on to the Applicable to instances list.
2. In the GCP console, add a webhook.
   1. Navigate to Monitoring > Alerting and click Edit Notification Channels.
   2. In the Webhooks section, click Add New.
   3. Select the Use HTTP Basic Auth check box, and enter the username and password of the MID Webserver User.
      Remarque :

      Ensure that the selected user is assigned the evt_mgmt_integration role. To ensure proper authentication, use the least privileged user with the evt_mgmt_integration role, rather than a high privileged user.
   4. Enter the endpoint URL.
      For example, use http://<MID_Server_IP>:<MID_Web_Server_Port>/api/mid/em/inbound_event?Transform=TransformEvents_MidGoogleMonitor
3. In the GCP console, create an alerting policy.
   1. Navigate to Monitoring > Alerting and click Create Policy.
   2. Configure the policy conditions that initiate alerts when the conditions are violated.
   3. Select the webhook notification channel on which the problem should be notified.
   4. Select the Notify on incident closure check box to send the closure events to the MID Server and save the alert policy.
      Remarque :

      If you need to directly open an incident in the GCP Console from the alert, navigate to Quick Response (in Alert) > Show Incident in GCP Console. For more information about creating an alert policy, see Managing alerting policies on the Google Cloud documentation site.

Résultats

GCP does not send values such as the severity level into the payload. The default severity is Minor, which can be changed in the Push Connector Configuration section of Push Connectors > Google Monitor MID Push Connector. The valid values of severity are 1- Critical, 2- Major, 3- Minor, 4- Warning, and 5- Info.