# Integrate CloudGuard WAF with Prometheus

Integrate CloudGuard WAF with [Prometheus](https://prometheus.io/) to collect and monitor key metrics related to WAF performance and behavior.

{% hint style="warning" %}
Prometheus integration is currently in **beta**. Features and behavior may change in future releases.
{% endhint %}

### Configuration <a href="#configuration" id="configuration"></a>

{% hint style="warning" %}
Note that enabling Prometheus integration is currently only supported for Embedded, Docker and Single GW deployments
{% endhint %}

**Prerequisites**

* An Cloud Guard Agent connected to a supported Profile
  * If you don't have an agent see instructions on how to get started [here](https://waf-doc.inext.checkpoint.com/getting-started/deploy-enforcement-point).
  * If the agent is running as a container, ensure Prometheus port `7465` is open.
* Prometheus Server

**Instructions:**

1. In the Web UI, go to the **Profiles** page
2. Click the profile assigned to your agent and switch to **Advanced** tab
3. Under **Advanced Settings**, add:
   * **Key:** `prometheus`
   * **Value:** `true`
4. Click **Enforce Policy** to apply changes

![](https://docs.openappsec.io/~gitbook/image?url=https%3A%2F%2F1225393248-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252FNcZmX14M2KdTBrq9EOnI%252Fuploads%252FgpIlgmc9xdMOds373dCI%252Fimage.png%3Falt%3Dmedia%26token%3Dd7bffbf8-8ac4-460c-99cc-224040dbbc16\&width=768\&dpr=4\&quality=100\&sign=151cc6f0\&sv=2)

1. Add a Job in your Prometheus Server configure the agent IP and Port, see example:

Copy

```
scrape_configs:
  - job_name: 'openappsec'
    static_configs:
      - targets: ['<agent-ip>:7465']
```

### Supported Parameters <a href="#supported-parameters" id="supported-parameters"></a>

<table><thead><tr><th width="333">Display Name</th><th>Type</th><th>Description</th></tr></thead><tbody><tr><td>nano_service_restarts_counter</td><td>LastReportedValue</td><td>watchdog process restart counter</td></tr><tr><td>total_requests_counter</td><td>Counter</td><td>total requests</td></tr><tr><td>unique_sources_counter</td><td>Counter</td><td>sources</td></tr><tr><td>requests_blocked_by_force_and_exception_counter</td><td>Counter</td><td>override: force exception and force block</td></tr><tr><td>requests_blocked_by_waf_counter</td><td>Counter</td><td>WAF blocked requests</td></tr><tr><td>requests_blocked_by_open_api_counter</td><td>Counter</td><td>API blocked requests</td></tr><tr><td>requests_blocked_by_bot_protection_counter</td><td>Counter</td><td>bot protection blocked requests</td></tr><tr><td>requests_threat_level_info_and_no_threat_counter</td><td>Counter</td><td>requests identified as info threat + none threat</td></tr><tr><td>requests_threat_level_low_counter</td><td>Counter</td><td>request identified as low threat</td></tr><tr><td>requests_threat_level_medium_counter</td><td>Counter</td><td>request identified as medium threat</td></tr><tr><td>requests_threat_level_high_counter</td><td>Average</td><td>request identified as high threat</td></tr><tr><td>post_requests_counter</td><td>Counter</td><td>post requests</td></tr><tr><td>get_requests_counter</td><td>Counter</td><td>get requests</td></tr><tr><td>put_requests_counter</td><td>Counter</td><td>put requests</td></tr><tr><td>patch_requests_counter</td><td>Counter</td><td>patch requests</td></tr><tr><td>delete_requests_counter</td><td>Counter</td><td>delete requests</td></tr><tr><td>other_requests_counter</td><td>Counter</td><td>other requests</td></tr><tr><td>2xx_status_code_responses_counter</td><td>Counter</td><td>response 2xx</td></tr><tr><td>4xx_status_code_responses_counter</td><td>Counter</td><td>response 4xx</td></tr><tr><td>5xx_status_code_responses_counter</td><td>Counter</td><td>response 5xx</td></tr></tbody></table>

<table data-header-hidden><thead><tr><th width="338"></th><th></th><th></th></tr></thead><tbody><tr><td>requests_time_latency_average</td><td>Average</td><td>average latency</td></tr><tr><td>sql_injection_attacks_type_counter</td><td>Counter</td><td>SQL Injection</td></tr><tr><td>vulnerability_scanning_attacks_type_counter</td><td>Counter</td><td>Vulnerability Scanning</td></tr><tr><td>path_traversal_attacks_type_counter</td><td>Counter</td><td>Path Traversal</td></tr><tr><td>ldap_injection_attacks_type_counter</td><td>Counter</td><td>LDAP Injection</td></tr><tr><td>evasion_techniques_attacks_type_counter</td><td>Counter</td><td>Evasion Techniques</td></tr><tr><td>remote_code_execution_attacks_type_counter</td><td>Counter</td><td>Remote Code Execution</td></tr><tr><td>xml_extern_entity_attacks_type_counter</td><td>Counter</td><td>XML External Entity</td></tr><tr><td>cross_site_scripting_attacks_type_counter</td><td>Counter</td><td>Cross Site Scripting</td></tr><tr><td>general_attacks_type_counter</td><td>Counter</td><td>General</td></tr><tr><td>all_assets_counter</td><td>LastReportedValue</td><td>number of protected assets</td></tr><tr><td>prevent_action_matches_counter</td><td>Counter</td><td>prevent engine matches</td></tr><tr><td>detect_action_matches_counter</td><td>Counter</td><td>detect engine matches</td></tr><tr><td>ignore_action_matches_counter</td><td>Counter</td><td>ignore engine matches</td></tr><tr><td>cpu_usage_percentage_max</td><td>Max</td><td>Max CPU usage</td></tr><tr><td>cpu_usage_percentage_average</td><td>Average</td><td>Average CPU usage</td></tr><tr><td>cpu_usage_percentage_last_value</td><td>LastReportedValue</td><td>last CPU usage reported</td></tr><tr><td>service_virtual_memory_size_kb_max</td><td>Max</td><td>max service virtual memory size</td></tr><tr><td>service_virtual_memory_size_kb_min</td><td>Min</td><td>min service virtual memory size</td></tr><tr><td>service_virtual_memory_size_kb_average</td><td>Average</td><td>average service virtual memory size</td></tr><tr><td>service_physical_memory_size_kb_max</td><td>Max</td><td>max service RSS memory size</td></tr><tr><td>service_physical_memory_size_kb_min</td><td>Min</td><td>min service RSS memory size</td></tr><tr><td>service_physical_memory_size_kb_average</td><td>Average</td><td>average service RSS memory size</td></tr><tr><td>general_total_used_memory_max</td><td>Max</td><td>max general total memory size</td></tr><tr><td>general_total_used_memory_min</td><td>Min</td><td>min general total memory size</td></tr><tr><td>general_total_used_memory_average</td><td>Average</td><td>average general total memory size</td></tr></tbody></table>