Open seamus-45 opened 1 month ago
@seamus-45: Thanks for opening an issue, it is currently awaiting triage.
In the meantime, you can:
@seamus-45: There are no 'kind' label on this issue. You need a 'kind' label to start the triage process.
/kind feature
/kind enhancement
/kind refactoring
/kind bug
/kind packaging
/kind enhancement
What would you like to be added?
Add some context for alert metrics like machine name. This will allow to better see the attack vector on Grafana dashboards.
Current query is
sum(cs_alerts{instance="$instance"})
on Crowdsec Details per instance dashboard and it display 0 alerts on agent nodes when local DB is disabled. When I change it tosum(cs_alerts{})
then all alerts from all instances is displayed. It would be better if we could see the source for alerts likesum(cs_alerts{}) by (alert_source)
if such data were available.Why is this needed?
Prometheus alert metrics become useless when the engine switched to the agent mode (with centralized LAPI) as they comes from the local DB even if local LAPI server is disabled.