Discovery

This plugin can be integrated with Pandora FMS Discovery.

To use it, the corresponding .disco package must be uploaded from the Pandora FMS plugin library or from the console plugin system.

Once uploaded, Azure Application Gateway resources can be monitored by creating Discovery tasks from the Cloud/Application Discovery section.

Each task asks for the following data in the Azure Base step:

• Azure Subscription ID: Azure subscription identifier where Application Gateways will be discovered.
• Azure Tenant ID: Azure Active Directory tenant identifier used by the Service Principal.
• Azure Client ID: Service Principal application identifier.
• Azure Client Secret: Service Principal secret.
• Resource group: optional filter to limit discovery to a specific resource group. If left empty, Application Gateways from the whole subscription are discovered.

The Application Gateway Options step contains additional options:

• Target agent: target agent where all modules are stored when one agent per Application Gateway is not enabled.
• Create one agent per Application Gateway: when enabled, each Application Gateway creates its own agent. When disabled, all modules are sent to the agent configured in Target agent.
• Application Gateway agent prefix: optional prefix for agents created per Application Gateway. For example, Azure Application Gateway creates agents such as Azure Application Gateway agw-production.
• Modules prefix: optional prefix for all generated module names.
• Scan Application Gateways: enables automatic Application Gateway discovery.
• Entities file: temporary file where discovered resource cache is stored.
• Enable entities file re-scan interval: enables periodic refresh of the temporary discovered entities file.
• Entities re-scan interval: interval used to rebuild the entity cache when re-scan is enabled.
• Mock Azure API URL: optional URL for local tests. It must be left empty in production.

The Metrics step contains metric and filtering options:

• Metrics time window: time window used to query Azure Monitor metrics.
• Azure metric interval: Azure Monitor granularity in ISO-8601 format. Default value is PT1M.
• Metric timeout: timeout in seconds for each Azure call. If set to 0 or a negative value, the plugin uses 30 seconds.
• Max retries: maximum number of retries for temporary API errors, including HTTP 429 rate limiting.
• Output format: output format generated by the plugin. JSON must be used for Discovery.
• Performance modules: creates CPU, current connections, throughput and new connections per second modules.
• Request modules: creates failed requests, HTTP status and total requests modules.
• Backend modules: creates healthy hosts, unhealthy hosts, requests per healthy host and backend HTTP status modules.
• Latency modules: creates backend connection time, first byte response time, last byte response time, total time and client RTT modules.
• Traffic modules: creates bytes sent and bytes received modules.
• Security modules: creates TLS protocol, backend TLS negotiation error and rejected connections modules.
• Capacity modules: creates compute units, capacity units, estimated billed capacity units and fixed billable capacity units modules. These metrics apply to v2 SKUs.
• WAF modules: creates WAF matched, blocked, request, rule, bot protection, challenge and penalty box modules. These metrics apply to WAF SKUs.
• WebSocket modules: creates WebSocket active connections and WebSocket close status code modules.
• Application Gateway count module: creates the discovered Application Gateway count module.
• Modules allow regexp: allows defining allowed module regular expressions, one per line. If configured, only modules whose final name matches one expression are created.
• Modules deny regexp: allows defining denied module regular expressions, one per line. If a module matches this list, it is not created.

Successful tasks include an execution summary similar to:

• application_gateways_discovered: number of Application Gateways discovered in the current execution.
• application_gateways_vanished: number of previously stored Application Gateways that no longer appear in the current discovery.
• modules: total number of generated modules.
• errors: number of errors detected during execution.
• scan_source: scan origin, azure when Azure is queried or entities_cache when the cache is reused.