Cloud Network Insights

Attribution

For all

gcloud

CLI, REST API, and MCP attribution requirements when executing commands with this skill, follow the instructions in Usage Attribution.

🛑 Core Directive: Results First

Identify the Requested Task: Determine if the user is attempting service enablement, checking activation status, downloading/installing or troubleshooting Monitoring Points (MPs), configuring AppNeta monitoring policies or alarm rules, verifying provisioned resources and paths, configuring alert policies, or querying Cloud Logging alarms and Cloud Monitoring metrics.
Execute and Present: Perform the minimum required commands or API calls to accomplish the task or provide exact guidance.
Definitive Answers: For status and verification queries, report the definitive state (for example,
```
ACTIVE
```
,
```
ACTIVATING
```
, or path listings) immediately.

Overview

Cloud Network Insights provides comprehensive synthetic monitoring for Cross-Cloud Network observability in partnership with Broadcom AppNeta. It monitors network and web paths using Monitoring Points (MPs) installed across Google Cloud, on-premises data centers, other public clouds (like AWS or Azure), and the public internet.

This skill automates onboarding, service enablement, Monitoring Point deployment, policy creation, and path verification.

Procedures and CUJs

1. Service Enablement and Status

Enable API:

bash

gcloud services enable networkmanagement.googleapis.com --project=PROJECT_ID

Create Provider (use

external

to match the Google Cloud console default, or a custom

PROVIDER_ID

bash

gcloud network-management network-monitoring-providers create PROVIDER_ID \
  --provider-type=EXTERNAL \
  --location=global \
  --project=PROJECT_ID

⚠️ If this command fails due to unaccepted Terms of Service, direct the user to the Google Cloud console onboarding page:
https://console.cloud.google.com/net-intelligence/cloud-network-insights/onboarding?project=PROJECT_ID

Verify State:

bash

gcloud network-management network-monitoring-providers \
  describe PROVIDER_ID \
  --location=global \
  --project=PROJECT_ID \
  --format=json

Check that

.state

ACTIVE

. (

ACTIVATING

indicates the backend is provisioning AppNeta resources.)

Delete Provider (Cleanup):

bash

gcloud network-management network-monitoring-providers delete PROVIDER_ID \
  --location=global \
  --project=PROJECT_ID

2. Monitoring Point Deployment and Verification

Cloud Network Insights supports 7 distinct Monitoring Point deployment types:

container

helm

gce-vm

aws-ec2

azure-vm

vmware

, and

kvm

Platform Selection: Never assume a default deployment type. Identify or prompt the user for their target environment before proceeding.
Procedures and Commands: For all required parameters, download commands, deployment manifests, and status verification commands (
```
monitoring-points list
```
), see Monitoring Point Deployment Reference.

3. Monitoring Policy and Alarm Rule Configuration (AppNeta)

Monitoring policies configure active synthetic network and web tests executed by Monitoring Points, and alarm rules define the thresholds and evaluation windows that raise path alarms.

Policy Types (
/api/v4/monitoringPolicy
):
- Network Monitoring Policies: Monitor packet loss, latency, and jitter to target IPs (or dual-ended between Monitoring Points) over TCP or UDP.
- Web Monitoring Policies: Synthetic HTTP/HTTPS application checks (such as GET requests with status code 200 assertions).
Check Before Creating: Always query
```
GET /api/v4/monitoringPolicy
```
first to verify whether a policy with your target name already exists before creating a new one, avoiding duplicate resource creation and API conflicts.
Alarm Rules (AppNeta Web UI Only): Alarm rules are configured in the AppNeta Web UI (in Alarms > Alarm Rules; see Broadcom Alarm Rules) and are not supported via the REST API v4.
Procedures and Payloads: For authentication token generation, organization discovery, and REST JSON payloads, see Monitoring Policy Configuration Reference.

4. Verifying Provisioned Paths in Google Cloud

Once policies are configured and MPs are online, verify provisioned paths:

List Network Paths:

bash

gcloud network-management network-monitoring-providers network-paths list \
  --network-monitoring-provider=PROVIDER_ID \
  --location=global \
  --project=PROJECT_ID \
  --format=json

List Web Paths:

bash

gcloud network-management network-monitoring-providers web-paths list \
  --network-monitoring-provider=PROVIDER_ID \
  --location=global \
  --project=PROJECT_ID \
  --format=json

5. Querying Cloud Network Insights Resources and State

Discover the Provider Name: Run
```
gcloud network-management network-monitoring-providers list --location=global --project=PROJECT_ID
```
to retrieve the provider ID (
```
PROVIDER_ID
```
). The provider ID is
```
external
```
when enabled via the Google Cloud console, or a custom name if created manually.

Query Child Resources: Pass

--network-monitoring-provider=PROVIDER_ID

and

--location=global

to child resource commands (such as

list

and

describe

Monitoring Points:

gcloud network-management network-monitoring-providers monitoring-points [list|describe]

Network Paths:

gcloud network-management network-monitoring-providers network-paths [list|describe]

Web Paths:

gcloud network-management network-monitoring-providers web-paths [list|describe]

6. Alert Policies, Cloud Logging, and Cloud Monitoring Metrics

Alert Policies (
gcloud monitoring policies
): Create log-matched alert policies (

conditionMatchedLog.filter

, including

alertStrategy.notificationRateLimit

POLICY_FILE

) for path alarms and operational events (see Set up alerts and notifications). For

insights_alarm

policies, include

AND NOT jsonPayload.noise_conditions:*

by default to filter out frequent/burst noise unless the user asks to include noisy alarms:

bash

# Create an alert policy from a JSON or YAML file
gcloud monitoring policies create --project=PROJECT_ID \
  --policy-from-file=POLICY_FILE

# Delete an alert policy (for cleanup)
gcloud monitoring policies delete POLICY_ID \
  --project=PROJECT_ID \
  --quiet

Example

conditionMatchedLog.filter

values for Google Cloud console alert templates:

Network Path Outage / Extended Loss / DNS Errors:

text

resource.type = "networkmanagement.googleapis.com/NetworkPath" AND logName =~ "insights_alarm" AND (jsonPayload.alarm_severity = "MAJOR" OR jsonPayload.alarm_severity = "CRITICAL") AND jsonPayload.state = "RAISED" AND jsonPayload.alarm_type =~ "QUALITY_OF_SERVICE" AND jsonPayload.rule =~ "Outage" AND NOT jsonPayload.noise_conditions:*

(Substitute
jsonPayload.rule =~ "Extended loss"
or
"Multiple DNS errors"
with
alarm_severity = "MINOR"
as needed.)

Web Path Multiple Web Errors:

text

resource.type = "networkmanagement.googleapis.com/WebPath" AND logName =~ "insights_alarm" AND jsonPayload.alarm_severity = "MAJOR" AND jsonPayload.state = "RAISED" AND jsonPayload.alarm_type =~ "QUALITY_OF_SERVICE" AND jsonPayload.rule =~ "Multiple Web errors" AND NOT jsonPayload.noise_conditions:*

Monitoring Point Offline and Network Path MTU Change Events:

text

resource.type = "networkmanagement.googleapis.com/MonitoringPoint" AND logName =~ "insights_event" AND jsonPayload.event_type = "MONITORING_POINT_OFFLINE"

text

resource.type = "networkmanagement.googleapis.com/NetworkPath" AND logName =~ "insights_event" AND jsonPayload.event_type = "MTU_CHANGE"

Cloud Logging (
gcloud logging read
): Query path alarms (
```
logName =~ "insights_alarm"
```
) and operational lifecycle events (
```
logName =~ "insights_event"
```
) exported to Cloud Logging (see Set up logging for
```
jsonPayload
```
field schemas and event types). Because alarm state transitions (
```
RAISED
```
,
```
UPDATED
```
,
```
CLEARED
```
) are logged as separate entries sharing the same
```
jsonPayload.alarm_id
```
, determine currently active alarms by checking that the latest entry for an
```
alarm_id
```
has not transitioned to
```
CLEARED
```
.

Cloud Monitoring (REST API
projects.timeSeries.list
): Query path performance metrics (

NetworkPath

and

WebPath

, filtered by

resource.labels.path_id

) via

GET "https://monitoring.googleapis.com/v3/projects/PROJECT_ID/timeSeries"

with

Authorization: Bearer $(gcloud auth application-default print-access-token)

in Cloud Monitoring (see Monitoring metrics and View dashboards).

7. Deployment Diagnostics and Troubleshooting

To diagnose a Monitoring Point deployment across any platform:

Google Cloud Registration: Check that
```
connectionStatus
```
is
```
ONLINE
```
in
```
monitoring-points list
```
(or
```
describe
```
) to verify the Monitoring Point is registered and connected to Cloud Network Insights.
Model-Specific Workload, Host, and Appliance Health: Inspect the Monitoring Point runtime, container/Kubernetes workload, or v35 Web Admin status on the target platform using the model-specific troubleshooting guides in Monitoring Point Deployment Reference, Broadcom Troubleshooting Monitoring Points, and Troubleshooting Cloud Network Insights.
Network, Proxy, and Firewall Rules: Verify the target environment's firewall, Web Proxy, custom CA certificate, and gRPC/SSL inspection bypass settings (
```
data.na1.cni.appneta.com
```
,
```
content.na1.cni.appneta.com
```
,
```
comms.na1.cni.appneta.com
```
, or
```
.p.
```
endpoints for Private Service Connect) against Broadcom Firewall Configuration and Add Monitoring Points.

Reference Documentation

For detailed guides, complete payloads, and templates:

Monitoring Point Deployment Reference: Deployment guides and command references across all 7 platforms (container, Helm, GCE VM Terraform, AWS, Azure, VMware, KVM).
Monitoring Policy Configuration Reference: Network and Web monitoring policy JSON payloads and AppNeta API workflows.
Google Cloud Network Insights Documentation: Official Google Cloud documentation for Cloud Network Insights setup, concepts, and operations.
Broadcom AppNeta for Cloud Network Insights Documentation: Broadcom AppNeta monitoring points, path performance, and API guides.

cloud-network-insights

NPX Install

Tags

SKILL.md Content

Cloud Network Insights

Attribution

🛑 Core Directive: Results First

Overview

Procedures and CUJs

1. Service Enablement and Status

2. Monitoring Point Deployment and Verification

3. Monitoring Policy and Alarm Rule Configuration (AppNeta)

4. Verifying Provisioned Paths in Google Cloud

5. Querying Cloud Network Insights Resources and State

6. Alert Policies, Cloud Logging, and Cloud Monitoring Metrics

7. Deployment Diagnostics and Troubleshooting

Reference Documentation