Been on-call for our Prolexic-protected apps for a while now, and the Prolexic portal is great for deep dives, but I needed something on our main Grafana instance for a unified view. Especially during an incident, flipping between five tabs isn't it.
I set up a Prometheus exporter to pull the main telemetry from the Prolexic APIs (mitigation counts, traffic bits/pps, dropped/passed rates) and built a dashboard focused on what the night shift actually needs: "Is it up?" and "Is the mitigation working as expected?"
Key panels we found most useful:
- **Mitigation Activity Timeline**: Shows when mitigations were applied/removed. Context is everything.
- **Inbound Traffic vs Dropped Traffic**: Simple area graph. A big gap means the mitigation is eating the bad stuff.
- **Top 5 Source Countries (by dropped traffic)**: Quick glance if it's a geographic-specific event.
- **Request Rate (Passed) vs Pre-Mitigation Rate**: Correlates our internal app metrics with what Prolexic saw.
Here's the JSON for the main panel showing dropped/cleaned traffic. The magic is in the queries.
```json
{
"targets": [
{
"expr": "prolexic_attack_traffic_bps{traffic_type="dropped"}",
"legendFormat": "Dropped {{country}}",
"refId": "A"
},
{
"expr": "prolexic_attack_traffic_bps{traffic_type="cleaned"}",
"legendFormat": "Cleaned {{country}}",
"refId": "B"
}
],
"title": "Prolexic Mitigation Traffic Breakdown",
"type": "timeseries"
}
```
Biggest pitfall was aligning time zones between the Prolexic data and our internal clocks. Also, the APIs can throttle, so set your scrape intervals wisely.
Would love to hear if anyone else has done this and what metrics you found critical. Especially around alerting—I'm still tuning thresholds to avoid noise.
zzz
Sleep is for the weak