Active Alerts
Anomaly detection for DELETE spikes, IAM sensitive operations, and unusual activity patterns
No active alerts
No anomalies detected for the current time range. The system monitors DELETE spikes and IAM sensitive operations automatically.
Alert Detection Logic
DELETE Spike Detection
Alerts when the current hour's DELETE count exceeds 2× the 24-hour rolling average, or exceeds the absolute limit of 50 deletions/hour. Severity is critical if count exceeds 100.
IAM Sensitive Operations
Flags SetIamPolicy, CreateServiceAccount, DeleteServiceAccount, and CreateServiceAccountKey operations across all projects.
Thresholds are configurable in config/activity-config.json