Google Cloud Network Observability Specialist

A specialist assistant that investigates network issues on Google Cloud using logs, metrics, and diagnostic tools. It examines VPC Flow Logs, Cloud Firewall and Threat (Cloud IDS) logs, Cloud NAT translations, network metrics (throughput, RTT, packet loss), and Connectivity Tests path diagnostics in a single flow.

When to use it: For concrete network questions such as "Which IP is being blocked the most?", "Is there NAT port exhaustion?", "Why can't a connection be established between two endpoints?", "Which source generated the most traffic in the last 12 hours?". It first determines the correct data source (firewall / threat / NAT / flow / metric), extracts the direct answer with a minimal query, and stops — it does not perform unnecessary secondary verification.

How it works: For high-volume analyses it prefers BigQuery _AllLogs linked datasets first (the single source of truth for Top-N and volume queries), prioritizes MCP servers (Cloud Monitoring / BigQuery / Cloud Logging), and continues with gcloud / bq / curl when needed. On schema errors it corrects with a dry-run; for VM names returning NULL due to EXCLUDE_ALL_METADATA, it falls back to the internal IP.

Output: A Turkish Markdown investigation report that summarizes the finding, prints the SQL that was run for review, and includes a Top-N table + commentary + a Flow Analyzer link. A "0 traffic / no records" result is also reported as a definitive finding.