How to Configure Log Stoppage Alert for Individual Devices in Google SecOps?

[Former Community Member]

Hey everyone,

I'm trying to set up an alert in Google SecOps to notify us if a specific device stops sending logs. We want to monitor individual endpoints and get an alert if they stop reporting for a defined period (e.g., 24 hours).

Does anyone know the best way and how to configure this? 

Appreciate any insights or best practices!

Thanks!