VincentChuWaiChow GCP Networking Observability
Core Directive: Results First
- Identify the primary source (VPC Flow, firewall, NAT, threat, metrics)
- Execute minimum required query; present direct answer
- Once primary source answers the question — STOP and report
Log & Telemetry Sources
- Threat Logs: Cloud Firewall Plus / Cloud IDS — malicious traffic, SQL injection, malware signatures
- VPC Flow Logs: sampled IP traffic to/from NICs — volume trends, top talkers
- Firewall Logs: connection attempts matched by rules — DENY/ALLOW verification
- Cloud NAT Logs: NAT translations — audit, port exhaustion diagnosis
- Networking Metrics: time-series throughput, RTT, packet loss via Cloud Monitoring
- Connectivity Tests: static path analysis — firewall and routing misconfiguration
Procedures
- Log source preference: ALWAYS check BigQuery linked datasets (
_AllLogs) before Cloud Logging for high-volume/aggregation. For metadata NULL issue: if VM name returns nothing, retry withsrc_ip(EXCLUDE_ALL_METADATA scenario). - Tool selection: MCP servers first (Cloud Monitoring MCP, BigQuery MCP, Cloud Logging MCP), then gcloud/bq fallback.
- Schema verification: if BigQuery fails with
Unrecognized name, runbq show --schemato validate, do a--dry_runbefore executing.
Analysis Reference Directory (load only when needed)
| Scenario | Reference |
|---|---|
| Threat log analysis | references/threat-analysis.md |
| VPC Flow analysis | references/vpc-flow-analysis.md |
| Cloud NAT analysis | references/cloud-nat-analysis.md |
| Firewall rule analysis | references/firewall-analysis.md |
| Networking metrics | references/metrics-analysis.md |
| Connectivity tests | references/connectivity-tests.md |
Boundaries (CRITICAL — NEVER violate)
- ALWAYS present direct answer as soon as identified
- NEVER run more than 2 exploratory queries before showing results
- NEVER perform secondary verification without explicit user permission
- ALWAYS print SQL before execution for review
- NEVER query a second data source if the primary already answered
- NO DISCREPANCY LOOPS: if Tool A gives 80K and Tool B gives 1K, present Tool A's result and STOP
- Treat "0 results" / "No records found" as a definitive conclusive finding — report and terminate
- BigQuery aggregation on
_AllLogsis PRIMARY for Top-N/volume analysis — never use Cloud Monitoring API for volume aggregation - Do NOT write shell scripts (.sh) or python files for data retrieval — use tool calls directly
- ALWAYS include a link to the Flow Analyzer: https://console.cloud.google.com/net-intelligence/flow-analyzer
Official Docs
- https://cloud.google.com/vpc/docs/flow-logs
- https://cloud.google.com/firewall/docs/firewall-rules-logging
- https://cloud.google.com/nat/docs/monitoring
- https://cloud.google.com/network-intelligence-center/docs/connectivity-tests/overview
Security Notes
Read-only forensic analysis. Never modify firewall rules, routes, or NAT configs. Never run queries that write data. Print SQL before executing for user review.