52 Alert-pipeline heartbeat

Caveats

• A heartbeat proves the pipeline is alive, not that any detection logic is correct¹
• Suppressing the heartbeat alert to reduce noise silently defeats the control²
• Activity rules are available in all editions, but the per-event notification the heartbeat relies…³

Setup steps

1. open ↗

   

   https://admin.google.com/ac/ax · captured 2026-07-15

   Rules › Create rule › Activity ↗

   Create a low-noise activity rule whose condition a scheduled synthetic event will deliberately trip (e.g. a login-audit event on a dedicated heartbeat account).

   Action

   Send to alert center + email notification to selected admin accounts (non-admin/external recipients must be reached via a Google Group)

   Severity

   Low

   Create and manage activity rules ↗

2. Schedule the synthetic trigger (cron/Apps Script/CI) so it fires the event on a fixed cadence, e.g. every 24h.

   Cadence

   daily, fixed UTC hour

   Installable Triggers ↗

3. Assert receipt: a watcher checks the alert/mail arrived inside the expected window and pages if it did not.

   Missing heartbeat within window

   page on-call ('the detector is dead')

   Alert Center API overview ↗

4. open ↗

   

   https://admin.google.com/ac/ac · captured 2026-07-15

   Security › Alert center ↗

   Confirm the heartbeat alert lands in the alert center feed and is filterable/suppressible without silencing the rest of the rule set.

Ongoing maintenance

• automatable: script Daily/weekly per design: the heartbeat itself runs and a missing beat pages someone.
• requires a human Per missing beat: investigate which stage of the pipeline dropped it.

How to verify

1. Trigger the synthetic event and confirm the alert lands in the monitored mailbox within the expected window — an alert pipeline is only verified by an alert.