Question

A security analyst at a financial services company must detect any interactive access to Compute Engine VM serial consoles, because attackers sometimes use them to bypass network-based controls and SSH logging. The organization already exports all audit logs to a central log bucket, but the analyst wants a near-real-time alert whenever serial console access is enabled or used on any VM in the organization. What is the most appropriate way to implement this detection?

Accepted Answer

Create an organization-level log-based alerting policy that matches Admin Activity audit log entries for the SetMetadata/serial-port-enable and connectToSerialPort operations, and notify the security team.

Answer

Enable Data Access audit logs for Compute Engine and rely on the default System Event logs to record serial console connections.

Answer

Configure VPC Flow Logs on all subnets and alert when traffic is seen on the serial console TCP port.

Answer

Enable OS Login for all projects, which automatically blocks and logs any serial console access attempt.