Live metrics, logs, and SIEM export

Watch traffic in real time, understand the key metrics, and stream security events to your SIEM.

Goal

Use the live dashboard to understand what the platform is doing right now, and forward security events to an external SIEM for retention and correlation.

The metrics that matter

Requests per second and status code mix — your baseline heartbeat.
Blocked / challenged counts — WAF and rate-limit activity; a sudden spike means an attack or a bad rule.
Upstream latency and health — the difference between "ShieldGate is slow" and "the backend is slow".
Connection and flow counts on the network side.

Metrics are exposed in Prometheus format, so existing Grafana stacks scrape them directly.

Structured logs

Every decision — allow, block, challenge, limit — is logged with structured fields: client, rule, action, latency. Structured means you filter by field, not by regex.

SIEM export

Compliance and incident response need events in your central SIEM:

Configure a SIEM output (an HTTP/JSON plugin ships in the box).
Choose which event categories to forward (security events at minimum).
Verify events arrive with correct timestamps and fields.

Verify

The dashboard reflects a test burst of traffic within seconds.
A blocked test request appears both in local logs and in the SIEM.

Pitfalls

Forwarding all traffic logs to a paid SIEM gets expensive fast — forward security events, sample the rest.