chronicle rule

[Emmie-123]

Hi everyone,

can someone please help me write rule for below scenario?

if any logsource is not streaming to chronicle SIEM in last 24 hours, it should trigger an alert.

your assistance would be greatly appreciated.

Many Thanks

Emmie

[malvarez]

Hey Emmie,

Ingestion related alerting is done from the Google Cloud console using Cloud Monitoring. More info can be found here at Set up ingestion notification for health metrics.

[Rene_Figueroa]

+1 to @malvarez comment. Rules create alerts on current ingested data. For ingestion data gaps, please use Cloud Metrics.

[Emmie-123]

Thanks @Rene_Figueroa 

[Emmie-123]

Thanks @malvarez