Monitoring and metrics

Every component in a private cloud pool publishes Prometheus metrics, so you can watch traffic, data protection and pool health in the monitoring tools you already use.

Quick Start

I want to...	Go to
Find which component publishes metrics where	Metrics endpoints
Scrape metrics with my own Prometheus	Scrape with Prometheus
Send metrics to Datadog, Grafana or another OTLP destination	Export through SIEM
Watch the DLP engine	DLP engine metrics

Metrics endpoints

Component	Endpoint	Metric names start with
Gateway (Armor)	/metrics on port 8080	armor_
DLP engine	/metrics on port 8080	dlp_, promptguard_v2_
Operator	/metrics on port 3000	aigw_operator_, operator_
SIEM Manager	/metrics on port 8888	otelcol_

These endpoints don't require authentication, so keep them reachable only from inside your cluster.

Every metric, with its labels and meaning, is listed on the portal's Metrics Reference, under Monitoring → SIEM Integration.

Two ways to collect metrics

You can use either, or both together.

Scrape with Prometheus

Point your Prometheus at the endpoints above. The gateway doesn't add Prometheus scrape annotations or monitors for you, so add a scrape job, or your own ServiceMonitor or PodMonitor, for the components you want. The DLP engine runs as the aigw-dlp-engine Deployment and Service in the pool's namespace.

Export through SIEM

If you already export logs through SIEM, you can send metrics the same way:

1. Open the pool's SIEM tab.
2. Add a destination that accepts metrics: OTLP, Datadog or Grafana. Splunk and Syslog destinations receive logs only.
3. Under Data Routing, select Edit, turn on Metrics and choose that destination. Optionally, list the metrics to send under Metric Allowlist, one name pattern per line, such as dlp_.*. Leave it empty to send everything.

The gateway, the DLP engine and the operator then send their metrics to the SIEM Manager in your pool, which forwards them. See Observability and SIEM Integration for setting up destinations.

DLP engine metrics

The DLP engine publishes metrics on the same port it scans on, 8080, at /metrics. You need DLP Engine 1.6.0 or later.

The metrics most teams watch:

Metric	What it tells you
dlp_requests_total	Scan requests received
dlp_findings_total	Sensitive data found
dlp_blocks_total	Scans that ended in a block
dlp_redactions_total	Scans that redacted content
dlp_stage_duration_ms	Time spent in each step of a scan
dlp_queue_drops_total	Background scans dropped because the queue was full
dlp_ratelimit_drops_total	Requests turned away by the engine's rate limit

The engine also publishes Prompt Guard metrics, starting with promptguard_v2_, and standard Go runtime, process and HTTP server metrics.

Counters appear only after their first event. A metric that is missing, such as dlp_blocks_total in a pool that has never blocked anything, usually means the event hasn't happened yet.

Tips

• Watch the gateway's view of the DLP engine too. The gateway's own metrics show how long it waits for each scan, and whether any responses reached the client without being checked. The Metrics Reference lists them under the gateway.
• Limit what you export. A Metric Allowlist keeps metrics you don't watch out of your destination, and its bill.
• Keep the endpoints private. They don't ask for credentials, so don't expose them outside the cluster.