Integrate Aquasec and Prometheus for Greater Visibility Into Runtime Security Operations

TL;DR: Maintaining runtime protection across cloud native environments requires visibility into the health of security controls and the activity they detect. Aquasec protects running workloads through local enforcement, while the integration with Prometheus makes diagnostic metrics from the Aquasec Platform and Aquasec Enforcers available for continuous monitoring. Security and platform teams can track Enforcer connectivity, image scanning operations and runtime security activity, helping them identify operational issues and understand how protection is functioning as their environments change.

What does the Aquasec and Prometheus integration do?

Security controls need to remain effective as workloads scale, clusters change and new applications enter production. While Aquasec enforces security policies inside running workloads, teams also need to understand whether the infrastructure supporting that protection is operating as expected.

For example, an increasing image scan queue could indicate that scanning capacity is struggling to keep pace with new images. A change in Enforcer connectivity could require investigation to determine whether protection coverage has been affected. Security teams also need insight into runtime activity, including file operations blocked by security controls and behavioral detection activity.

The Aquasec integration with Prometheus makes these operational and security metrics available in a monitoring system many organizations already use to track infrastructure and application health.

The integration supports two sources of metrics.

• Aquasec Platform metrics provide visibility into the broader security environment, including connected Enforcers and Gateways, image scanning activity, configured security policies and user login activity.
• Aquasec Enforcer metrics provide more detailed insight into the health and activity of Aquasec Enforcers and VM Enforcers. These include resource utilization, container activity, Gateway connection status and counters associated with runtime security controls.

Prometheus collects these metrics over time, allowing teams to identify trends and investigate changes that may affect security operations.

How does the Aquasec and Prometheus integration work?

The integration uses two separate configurations to make diagnostic metrics available to Prometheus.

Aquasec Platform monitoring

Administrators enable Prometheus under Administration, Integrations, Monitoring Systems in the Aquasec Platform.

The configuration supports an optional bearer token and a configurable data collection interval. Aquasec makes diagnostic metrics available at the specified interval, including the number of connected Enforcers and Gateways, images waiting to be scanned, images being scanned and images that failed scanning.

The integration also provides metrics for successful and failed user logins, defined Image Assurance Policies, Runtime Policies and Firewall Policies.

These metrics help teams understand the operational state of their Aquasec environment and identify patterns that may require attention.

Aquasec Enforcer monitoring

For more detailed runtime monitoring, Aquasec provides a Prometheus Metrics Exporter for Aquasec Enforcers and VM Enforcers.

Administrators enable the exporter under Settings, Enforcer, Prometheus Metrics Exporter. The exporter uses port 8995 by default, although this can be changed. The Metrics Exporter advanced setting must also be enabled for the relevant Enforcer groups.

The exporter exposes several categories of metrics, including:

• Resource utilization: CPU and memory usage at the host and Enforcer levels, helping teams monitor the resources consumed by runtime protection.
• Enforcer health: Enforcer version and type, active container counts, enabled functions and Gateway connection status.
• Runtime security activity: File related events detected or blocked by runtime controls, malware scanning activity and behavioral detection event counts.
• Security operations: Audit activity, event processing errors and host or image scanning results.

For Kubernetes deployments, Aquasec’s documentation provides an example using a local Prometheus server with service discovery to collect metrics within a cluster. A remote Prometheus server can use federation to collect metrics across clusters. Standalone Aquasec Enforcers and VM Enforcers do not require the local cluster deployment step.

This architecture allows organizations to monitor Aquasec metrics across distributed environments while maintaining the runtime enforcement capabilities that operate inside protected workloads.

What does this integration mean for Aquasec customers?

The value of the Prometheus integration comes from connecting operational monitoring with security controls that operate directly inside running workloads.

Aquasec uses its Enforcer architecture to observe workload behavior and enforce supported security policies at the point of execution. When configured in enforcement mode, Aquasec can block unauthorized activity as it occurs, without waiting for a centralized monitoring system to make that decision.

Prometheus provides an additional operational view of that protection through the metrics Aquasec exports.

Monitor the health of runtime protection. Teams can track Enforcer resource consumption, Gateway connectivity and enabled protection functions. This information helps platform engineers recognize conditions that may affect the operation of their security infrastructure.

Understand activity detected and blocked by runtime controls. Enforcer metrics include counters for file related events detected and blocked by runtime controls, as well as behavioral detection activity. Teams can monitor how these counters change over time and determine when additional investigation in Aquasec may be necessary.

Identify operational issues before they create larger backlogs. Image scanning metrics show whether images are waiting to be scanned, whether scanning is progressing and where failures are occurring. These signals can help teams determine when additional scanner capacity or configuration changes may be needed.

Prometheus adds monitoring and trend analysis, while Aquasec remains responsible for runtime detection and enforcement. Exported metrics provide operational context, but they do not replace the detailed security investigation and response capabilities available in Aquasec.

Where does this matter most?

Runtime protection health. As organizations add workloads and cluster nodes, platform teams need to monitor whether Enforcers remain connected and their resource consumption stays within expected operating conditions. Prometheus allows teams to follow these metrics across the environment and investigate unexpected changes.

Runtime security activity. When Aquasec runtime controls detect or block file related activity, the Enforcer exporter records relevant counters. Security teams can use these metrics to recognize changes in activity patterns and return to Aquasec for further investigation.

Image scanning operations. A growing scan queue can delay visibility into security issues in newly introduced images. Monitoring pending scans, completed scans and failures helps teams recognize capacity constraints and determine whether additional scanner daemons are needed.

Detection pipeline health. The Enforcer exporter includes metrics for dropped behavioral detection events and audit processing errors. Monitoring these counters can help teams identify conditions that deserve investigation because they may affect the completeness of collected security information.

Monitoring across Kubernetes clusters. Organizations operating multiple Kubernetes clusters can use the documented Prometheus federation model to consolidate Enforcer metrics from cluster local monitoring deployments, providing an operational view across their distributed infrastructure.

What do you need to get started with Aquasec and Prometheus?

The integration requires a running Prometheus server and access to the relevant configuration settings in the Aquased Platform.

For Aquasec Platform monitoring, administrators enable Prometheus under Monitoring Systems and configure the bearer token and collection interval as needed.

For Enforcer monitoring, administrators activate the Prometheus Metrics Exporter and configure the relevant Aquasec Enforcer or VM Enforcer groups. Kubernetes deployments can use the example Prometheus configuration provided by Aquasec to collect metrics locally and federate them to a remote server.

Aquasec also documents the option of using Grafana with Prometheus for additional data visualization. That configuration is managed separately.

Detailed configuration instructions are available in Aquasec Docs:

Aquasec Platform Prometheus Integration

Prometheus Metrics Exporter for Enforcers

To learn more about how Aquasec protects running workloads and how Prometheus can support monitoring of your security operations, request anAquasec demo.

FAQs

What metrics does Aqua export to Prometheus?

Aqua exports diagnostic metrics covering Platform operations and Enforcer activity. These include image scan queue status, Enforcer connectivity, resource utilization, runtime control activity and selected malware detection and scanning counters.

Can Prometheus show whether Aqua runtime controls are blocking activity?

Yes. The Enforcer metrics exporter includes counters for file related events blocked by Aqua runtime controls. These metrics help teams monitor enforcement activity over time, although detailed investigation of individual security events remains within Aqua.

Does Prometheus replace Aqua's runtime security controls?

No. Aqua performs runtime detection and enforcement inside protected workloads. Prometheus collects and monitors the diagnostic metrics exposed by Aqua and does not perform runtime enforcement through this integration.

Can organizations monitor Aqua across multiple Kubernetes clusters?

Yes. Aqua documents an example architecture using local Prometheus deployments within Kubernetes clusters and a remote Prometheus server that collects metrics through federation.

Can Aqua metrics be visualized in Grafana?

Yes. Aqua documentation describes Grafana as an option for visualizing metrics collected by Prometheus. Configuring Grafana is a separate process and is outside the scope of the Aqua integration documentation.

Aqua Security is the pioneer in securing containerized cloud native applications from development to production. The Aqua full lifecycle solution prevents attacks by enforcing pre-deployment hygiene and mitigates attacks in real time in production, reducing mean time to repair and overall business risk. The Aqua Platform, a Cloud Native Application Protection Platform (CNAPP), integrates security from Code to Cloud, combining the power of agent and agentless technology into a single solution. With enterprise scale that doesn’t slow development pipelines, Aqua secures your future in the cloud. Founded in 2015, Aqua is headquartered in Boston, MA and Ramat Gan, IL protecting over 500 of the world’s largest enterprises.