Prometheus Metrics#

InfraGuard exposes a /metrics endpoint for Prometheus scraping. Metrics cover request counts, upstream latency, circuit breaker state, threat feed freshness, and active connection counts.

Endpoint#

curl https://ig:8080/metrics

The endpoint returns Prometheus text format. No authentication is required by default (configure your firewall or reverse proxy accordingly).

Available Metrics#

infraguard_requests_total (Counter)#

Total requests processed, labeled by domain, filter result, and protocol.

infraguard_requests_total{domain="cdn.example.com",result="allow",protocol="https"} 4821
infraguard_requests_total{domain="cdn.example.com",result="block",protocol="https"} 1293
infraguard_requests_total{domain="cdn.example.com",result="suspect",protocol="https"} 87

infraguard_upstream_latency_seconds (Histogram)#

Time spent waiting for the upstream C2 backend to respond, labeled by domain. Useful for detecting backend degradation before it trips the circuit breaker.

infraguard_upstream_latency_seconds_bucket{domain="cdn.example.com",le="0.1"} 3891
infraguard_upstream_latency_seconds_bucket{domain="cdn.example.com",le="0.5"} 4702
infraguard_upstream_latency_seconds_bucket{domain="cdn.example.com",le="1.0"} 4819
infraguard_upstream_latency_seconds_count{domain="cdn.example.com"} 4821
infraguard_upstream_latency_seconds_sum{domain="cdn.example.com"} 312.47

infraguard_circuit_breaker_state (Gauge)#

Current circuit breaker state per domain.

infraguard_circuit_breaker_state{domain="cdn.example.com"} 0

infraguard_feed_last_refresh (Gauge)#

Unix timestamp of the last successful refresh for each threat intelligence feed. Alert if this falls behind schedule.

infraguard_feed_last_refresh{feed="urlhaus"} 1711234567.0
infraguard_feed_last_refresh{feed="openphish"} 1711231200.0

infraguard_active_connections (Gauge)#

Number of currently active connections, labeled by protocol.

infraguard_active_connections{protocol="https"} 12
infraguard_active_connections{protocol="websocket"} 3
infraguard_active_connections{protocol="dns"} 0

Registry Isolation#

InfraGuard uses a dedicated CollectorRegistry rather than the Prometheus client’s global default registry. This prevents metric collisions with other Python libraries and makes testing straightforward since each test can create its own isolated registry.

Grafana Dashboard#

A basic Grafana dashboard configuration for InfraGuard would track:

• Request rate by result (allow/block/suspect) over time
• p50/p95/p99 upstream latency
• Circuit breaker state changes
• Feed freshness staleness alerts
• Active connection count by protocol

Prometheus Scrape Config#

scrape_configs:
  - job_name: 'infraguard'
    scrape_interval: 15s
    static_configs:
      - targets: ['ig:8080']