GCP Log metric filter and alert does not exist for Project Ownership assignments/changes
This policy identifies the GCP account which does not have a log metric filter and alert for Project Ownership assignments/changes. Project Ownership Having highest level of privileges on a project, to avoid misuse of project resources project ownership assignment/change actions mentioned should be monitored and alerted to concerned recipients.
This is applicable to gcp cloud and is considered a informational severity issue.
Sample categories of findings relevant here are ['MISCONFIGURATION'].
Mitigation of this issue can be done as follows: 1. Sign in to GCP Console
2. Navigate to 'Logs-based metrics' under the 'Logging' section.
3. Click on 'CREATE METRIC'.
4. Provide 'Metric Type' and 'Details'.
5. In 'Filter selection', add filter as 
(protoPayload.serviceName="cloudresourcemanager.googleapis.com") AND (ProjectOwnership OR projectOwnerInvitee) OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner") OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD" AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")
6. Click on 'CREATE METRIC'.
7. Under 'User-defined metrics' section, choose the metric you created in step 6 and click on the kebab menu (Vertical 3 dots) on the right side of the metrics
8. Click on 'Create alert from metric'; it will navigate to 'Create alerting policy' under the section 'Monitoring'.
9. Add the metric name created above if not auto-filled in the Monitoring filter. Choose an appropriate value for other alert condition parameters as desired. Then Click on 'NEXT'
10. Configure all alert trigger settings as desired. Then Click on 'NEXT'
11. Configure notifications as desired and provide an appropriate name for the alert policy. Then Click on 'NEXT'
12. Click on 'CREATE POLICY'..

Query:
```config from cloud.resource where api.name = 'gcloud-logging-metric' as X; config from cloud.resource where api.name = 'gcloud-monitoring-policies-list' as Y; filter '($.Y.conditions[*].metricThresholdFilter contains $.X.name) and ($.X.filter contains "protoPayload.serviceName=" or $.X.filter contains "protoPayload.serviceName =") and ($.X.filter does not contain "protoPayload.serviceName !=" and $.X.filter does not contain "protoPayload.serviceName!=") and $.X.filter contains "cloudresourcemanager.googleapis.com" and ($.X.filter contains "ProjectOwnership OR projectOwnerInvitee" or $.X.filter contains "ProjectOwnership or projectOwnerInvitee") and ($.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.action=" or $.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.action =") and ($.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.action!=" and $.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.action !=") and ($.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.role=" or $.X.filter contains "protoPayload.serviceData.policyDelta.bindingDeltas.role =") and ($.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.role!=" and $.X.filter does not contain "protoPayload.serviceData.policyDelta.bindingDeltas.role !=") and $.X.filter contains "REMOVE" and $.X.filter contains "ADD" and $.X.filter contains "roles/owner"'; show X; count(X) less than 1```