GCP CC Integrity Monitoring failure modes

Examples

earlyBootReportEvent

{
  "insertId": "2",
  "jsonPayload": {
    "bootCounter": "33",
    "@type": "type.googleapis.com/cloud_integrity.IntegrityEvent",
    "earlyBootReportEvent": {
      "policyEvaluationPassed": false,
      "actualMeasurements": [
        {
          "hashAlgo": "SHA1",
          "pcrNum": "PCR_0",
          "value": "Dy06KhrapHmu7Kj133aq3EG4Yuo="
        },
        {
          "value": "laCtkvSv/eDwpgXsQY/onAHzU5w=",
          "pcrNum": "PCR_1",
          "hashAlgo": "SHA1"
        },
        {
          "pcrNum": "PCR_2",
          "hashAlgo": "SHA1",
          "value": "sqg7Dr8vg3Qpmlsr38MeqVWtcjY="
        },
        {
          "hashAlgo": "SHA1",
          "pcrNum": "PCR_3",
          "value": "sqg7Dr8vg3Qpmlsr38MeqVWtcjY="
        },
        {
          "pcrNum": "PCR_4",
          "hashAlgo": "SHA1",
          "value": "a9xyE1HT3kQpZXRPouTmovQRP1Y="
        },
        {
          "value": "KaFrLYBbZ2eG6C334lfSwMh9jEw=",
          "pcrNum": "PCR_5",
          "hashAlgo": "SHA1"
        },
        {
          "pcrNum": "PCR_6",
          "hashAlgo": "SHA1",
          "value": "sqg7Dr8vg3Qpmlsr38MeqVWtcjY="
        },
        {
          "pcrNum": "PCR_7",
          "hashAlgo": "SHA1",
          "value": "uYBoQB4+ffZhO9KBmBE1/ik5h5o="
        }
      ],
      "policyMeasurements": []
    }
  },
  "resource": {
    "type": "gce_instance",
    "labels": {
      "zone": "europe-north1-a",
      "project_id": "att-nightly",
      "instance_id": "8743507030673467536"
    }
  },
  "timestamp": "2024-03-04T02:01:58.026150023Z",
  "severity": "ERROR",
  "logName": "projects/att-nightly/logs/compute.googleapis.com%2Fshielded_vm_integrity",
  "receiveTimestamp": "2024-03-04T02:02:00.036207919Z"
}

lateBootReportEvent

You can determine which hashes are failing my comparing the hash values of "lateBootReportEvent": { "actualMeasurements": [ against the hash values of "policyEvaluationPassed": false, "policyMeasurements": [. The values which differ from each other have changes in them that are being flagged in integrity monitoring. To update the policies you have to run a gcloud command against the instance you want to update (Read more in Google's docs).

{
  "insertId": "6",
  "jsonPayload": {
    "bootCounter": "2",
    "@type": "type.googleapis.com/cloud_integrity.IntegrityEvent",
    "lateBootReportEvent": {
      "actualMeasurements": [
        {
          "hashAlgo": "SHA1",
          "value": "0KUbR/mg3+8bwW0xjQtbxWh/1gI=",
          "pcrNum": "PCR_0"
        },
        {
          "hashAlgo": "SHA1",
          "value": "qWFu7cbrMBkI9u/GdjxyxeFgmJY=",
          "pcrNum": "PCR_1"
        },
        {
          "value": "sqg7Dr8vg3Qpmlsr38MeqVWtcjY=",
          "hashAlgo": "SHA1",
          "pcrNum": "PCR_2"
        },
        {
          "value": "sqg7Dr8vg3Qpmlsr38MeqVWtcjY=",
          "pcrNum": "PCR_3",
          "hashAlgo": "SHA1"
        },
        {
          "hashAlgo": "SHA1",
          "pcrNum": "PCR_4",
          "value": "e0MgwNqj+Fen3HDySi9e4Vmw6eA="
        },
        {
          "pcrNum": "PCR_5",
          "value": "pbqckhgkUCCtqTR+C2phZkU8Eoo=",
          "hashAlgo": "SHA1"
        },
        {
          "hashAlgo": "SHA1",
          "pcrNum": "PCR_6",
          "value": "sqg7Dr8vg3Qpmlsr38MeqVWtcjY="
        },
        {
          "hashAlgo": "SHA1",
          "value": "dlh+O6ynjumcloVjqEpU2qF7c2U=",
          "pcrNum": "PCR_7"
        },
        {
          "pcrNum": "PCR_8",
          "value": "c0SnargvfmUOT3UNE9bEpvkZR5g=",
          "hashAlgo": "SHA1"
        },
        {
          "hashAlgo": "SHA1",
          "pcrNum": "PCR_9",
          "value": "/c0m3VDclN31wyQg1JT5AsV7B/M="
        },
        {
          "value": "pIKhXhEnF9apFbmJoOphQKUH4+Y=",
          "hashAlgo": "SHA1",
          "pcrNum": "PCR_14"
        }
      ],
      "policyEvaluationPassed": false,
      "policyMeasurements": [
        {
          "pcrNum": "PCR_0",
          "value": "0KUbR/mg3+8bwW0xjQtbxWh/1gI=",
          "hashAlgo": "SHA1"
        },
        {
          "value": "wBUNrVgqb1Zp1yWyr0a1Pfa51J8=",
          "hashAlgo": "SHA1",
          "pcrNum": "PCR_4"
        },
        {
          "hashAlgo": "SHA1",
          "value": "2xpYlFcPAnc0KfUhxfvLuE/AxRg=",
          "pcrNum": "PCR_7"
        }
      ]
    }
  },
  "resource": {
    "type": "gce_instance",
    "labels": {
      "zone": "europe-north1-a",
      "instance_id": "3349871045721604404",
      "project_id": "attracs-services-195009"
    }
  },
  "timestamp": "2023-10-25T17:08:05.821027727Z",
  "severity": "ERROR",
  "logName": "projects/attracs-services-195009/logs/compute.googleapis.com%2Fshielded_vm_integrity",
  "receiveTimestamp": "2023-10-25T17:08:07.830428197Z"
}