Event collection from Google Cloud Platform (GCP)

The MID WebService Event Collector enables you to collect JSON formatted event messages sent from Google Cloud Platform (GCP).

Before you begin

Ensure that the Event Management Connectors (sn_em_connector) plugin is installed on the ServiceNow AI Platform instance.

Ensure that you:

• Deploy and start the MID Server. See MID Server configuration .
• Configure and start the MID Web Server. See Configure the MID Web Server extension.
• Configure and start the MID WebService Event Collector. See Configure the MID WebService Event Collector Context.

Role required: evt_mgmt_admin

About this task

JSON formatted event messages are sent from Google Cloud Platform. The MID Server transforms the collected event messages by parsing them using the TransformEvents_MidGoogleMonitor script include, located here: Event Management > Integrations > PushConnectors. In the Push Connectors page, click Google Monitor Mid Push Connector.

The default format of the URL to push event messages from the GCP to the MID Server is http://<MID_Server_IP>:<MID_Web_Server_Port>/api/mid/em/inbound_event?Transform=TransformEvents_MidGoogleMonitor.

The following procedure describes the collection of JSON formatted event messages using basic authentication.

Procedure

1. In the Google Cloud Platform (GCP) console, make sure the MID Server IP is accessible from the GCP console and MID rest point is accessible from GCP or install the MID Server on a GCP VM and provide the GCP VM external IP address in the URL.

   In the GCP console, create a firewall rule.

   1. Navigate to VPC Network > Firewall > Create Firewall.

   2. Set the direction to ingress to allow the mid_web_server_port to connect.

   3. Add the GCP VM that the MID Server is installed on to the Applicable to instances list.

2. In the GCP console, add a webhook.

   1. Navigate to Monitoring > Alerting and click Edit Notification Channels.

   2. In the Webhooks section, click Add New.

   3. Select the Use HTTP Basic Auth check box, and enter the username and password of the MID Webserver User.

      Note: Ensure that the selected user is assigned the evt_mgmt_integration role. To ensure proper authentication, use the least privileged user with the evt_mgmt_integration role, rather than a high privileged user.

   4. Enter the endpoint URL.

      For example, use http://<MID_Server_IP>:<MID_Web_Server_Port>/api/mid/em/inbound_event?Transform=TransformEvents_MidGoogleMonitor

3. In the GCP console, create an alerting policy.

   1. Navigate to Monitoring > Alerting and click Create Policy.

   2. Configure the policy conditions that initiate alerts when the conditions are violated.

   3. Select the webhook notification channel on which the problem should be notified.

   4. Select the Notify on incident closure check box to send the closure events to the MID Server and save the alert policy.

      Note: If you need to directly open an incident in the GCP Console from the alert, navigate to Quick Response (in Alert) > Show Incident in GCP Console. For more information about creating an alert policy, see Managing alerting policies on the Google Cloud documentation site.

Result

GCP does not send values such as the severity level into the payload. The default severity is Minor, which can be changed in the Push Connector Configuration section of Push Connectors > Google Monitor MID Push Connector. The valid values of severity are 1- Critical, 2- Major, 3- Minor, 4- Warning, and 5- Info.

Parent Topic:Integrate with push connectors