# Google Cloud Monitor Integration

Google Cloud Monitoring (formerly Stackdriver) lets you set up alerting policies on metrics and logs across your GCP infrastructure. When a condition is met, it fires a webhook notification to any endpoint you configure — including ITOC360.

This integration receives those webhook notifications and turns them into incidents in your on-call workflow. When the alert resolves in Google Cloud, the incident is automatically resolved in itoc360 as well.

### How It Works

Google Cloud Monitoring sends a webhook payload to ITOC360 every time an alerting policy condition is triggered or resolved. The payload always contains an `incident_id` that stays the same for both the open and close events — ITOC360 uses this to match them together automatically.

* When `state` is `OPEN` → a new alert is created in ITOC360
* When `state` is `CLOSED` → the existing alert is resolved

### Prerequisites

* A Google Cloud project with Cloud Monitoring enabled
* An alerting policy (or you will create one during setup)
* An ITOC360 source configured for Google Cloud Monitoring

***

### Step 1 — Copy Your Webhook URL

In ITOC360, navigate to your source settings and copy the webhook URL generated for your Google Cloud Monitoring source. You will paste this into Google Cloud in the next step.

***

### Step 2 — Add a Webhook Notification Channel

Open the [Google Cloud Console](https://console.cloud.google.com/) and navigate to **Monitoring** from the left sidebar.On the Monitoring page, go to **Alerting**.

<figure><img src="https://4108595529-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FimJRSa33y5Ej6rwXrBeA%2Fuploads%2FzcSL0n8B6mjX2Pj5ghxK%2Fimage.png?alt=media&#x26;token=40dfc971-11cf-4b99-ad1e-2e67327e0677" alt=""><figcaption></figcaption></figure>

Click the **"Edit Notification Channels"** button in the top right corner of the Alerting page.

<figure><img src="https://4108595529-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FimJRSa33y5Ej6rwXrBeA%2Fuploads%2FNdAWFG7Eh7f28OQ6LJDS%2Fimage.png?alt=media&#x26;token=10d5412a-09c6-455b-ac18-ae99be2e8e91" alt=""><figcaption></figcaption></figure>

On the Notification Channels page, scroll down to the **Webhooks** section and click **"Add New"**.

Fill in the form:

* **Display Name** — enter a recognizable name, for example `itoc360`
* **Endpoint URL** — paste the webhook URL you copied from ITOC360, then append your source token as a query parameter at the end

Google Cloud Monitoring does not support custom request headers, so the source token must be passed in the URL itself. The final URL should look like this:

```
https://<your-project-url>/?token=YOUR_TOKEN
```

You can find your source token on the source settings page in ITOC360.

<figure><img src="https://4108595529-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FimJRSa33y5Ej6rwXrBeA%2Fuploads%2FsvNdHzUtKxNQvt7NjxNU%2Fimage.png?alt=media&#x26;token=75dda606-fa48-469e-9d37-3adaa6d01783" alt=""><figcaption></figcaption></figure>

Click **"Test Connection"** to verify that ITOC360 can receive the payload. You should see a success toast at the bottom of the page.

Click **Save**. The new webhook channel will now appear in the Webhooks list.

<figure><img src="https://4108595529-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FimJRSa33y5Ej6rwXrBeA%2Fuploads%2FN2HLi0tW4Ryr8bZertk5%2FEkran%20Resmi%202026-03-07%2017.22.22.png?alt=media&#x26;token=1a498564-090b-4406-8ea0-1c8f8173dd0b" alt=""><figcaption></figcaption></figure>

***

### Step 3 — Attach the Webhook to an Alerting Policy

Go back to **Monitoring > Alerting** and open an existing alerting policy, or create a new one by clicking **"Create Policy"**.

<figure><img src="https://4108595529-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FimJRSa33y5Ej6rwXrBeA%2Fuploads%2F3ZUSNh11mJqCb2DpotQq%2Fimage.png?alt=media&#x26;token=1d7746a7-6ac5-4055-80d4-c84a09519c7b" alt=""><figcaption></figcaption></figure>

In the left sidebar, click **"Notifications and name"** to jump to the notifications step.

Click **"Add Notification Channels"**.

A panel will open listing all available notification channels. Find the webhook you created under the **Webhooks** section and select it.

<figure><img src="https://4108595529-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FimJRSa33y5Ej6rwXrBeA%2Fuploads%2F82WNlFojFVRxh9STcHiP%2Fimage.png?alt=media&#x26;token=3bba68ab-a538-4063-85a6-a3f49f9b2f6b" alt=""><figcaption></figcaption></figure>

After selecting it, the channel will appear under the Notifications section of the policy.

Give the policy a name in the **"Alert policy name"** field at the bottom, then click **"Create Policy"** or **"Save"** if you are editing an existing one.

The policy will now appear in the Alerting list.

***

### Payload Reference

Below is the payload structure that Google Cloud Monitoring sends to webhook. This is provided for reference — no manual configuration is needed.

```json
{
  "version": "1.2",
  "incident": {
    "incident_id": "0.opqiw61fsv7p",
    "scoping_project_id": "your-project",
    "scoping_project_number": 12345,
    "url": "https://console.cloud.google.com/monitoring/alerting/incidents/...",
    "state": "OPEN",
    "severity": "ERROR",
    "started_at": 1577840461,
    "ended_at": null,
    "policy_name": "projects/your-project/alertPolicies/12345",
    "condition_name": "CPU utilization > 90%",
    "resource_name": "your-project gke-cluster-1-default-pool",
    "resource_display_name": "gke-cluster-1-default-pool",
    "resource_type_display_name": "VM Instance",
    "resource": {
      "type": "gce_instance",
      "labels": {
        "instance_id": "11223344",
        "project_id": "your-project",
        "zone": "us-central1-c"
      }
    },
    "metric": {
      "type": "compute.googleapis.com/instance/cpu/utilization",
      "displayName": "CPU utilization",
      "labels": {
        "instance_name": "my-vm-instance"
      }
    },
    "documentation": {
      "content": "CPU is above the threshold. Check the runbook.",
      "mime_type": "text/markdown"
    },
    "summary": "CPU for gke-cluster-1 is above the threshold of 90%"
  }
}
```

When the alert resolves, the same payload is sent with `state` set to `"CLOSED"` and `ended_at` filled in. itoc360 matches it to the original alert using `incident_id` and closes the incident automatically.

***

### Priority Mapping

itoc360 maps the `severity` field from the incoming payload to its own priority levels. The default mapping is shown below. You can override it per source from the source settings page.

| Google Cloud Severity | itoc360 Priority |
| --------------------- | ---------------- |
| CRITICAL              | Critical         |
| ERROR                 | High             |
| WARNING               | Medium           |
| INFO                  | Low              |
| no severity           | Medium           |

> **Note:** When an alerting policy does not have a severity level configured, Google Cloud sends `"no severity"` as the value. ITOC360 treats this as Medium priority by default.

### Troubleshooting

**Test notification was sent but no event appeared in itoc360** Check that the endpoint URL is correct and that the `token` query parameter is present and matches your itoc360 source token. Google Cloud Monitoring does not support custom headers, so authentication must be done via the query parameter. Also make sure your itoc360 source is active.

**Incidents are not resolving automatically** This usually means the alerting policy is not configured to send a notification on resolution. In Google Cloud, make sure the **"Notify on incident closure"** option is enabled for the notification channel, or that your alerting policy has a closing condition defined.

**`severity` field is missing from the payload** Some alerting policies do not set a severity level. In that case, ITOC360 falls back to Medium priority. You can set a default priority override from the source settings if needed.