Hey everyone! 👋 I've been diving deep into our Aqua Security console lately, mostly because my security team kept asking for "trends" and "visibility" into runtime events, but the out-of-the-box reporting felt a bit scattered for the high-level view they wanted. Sound familiar?
So, I spent some time this week building a relatively simple Grafana dashboard that pulls directly from Aqua's PostgreSQL database (we're on a self-hosted deployment). The goal was to create a single pane of glass for tracking runtime security events over time—think container escapes, suspicious process executions, and file integrity violations—so we can spot spikes, correlate them with deployments, and finally have a proactive chat about anomalies instead of a reactive firefight.
Here’s what I focused on in the main dashboard panels:
* **Daily & Weekly Event Trends:** A line graph showing total runtime events aggregated by day and by week. This immediately shows if a new deployment last Tuesday introduced a noisy workload.
* **Top 5 Affected Images:** A bar chart listing which container images are triggering the most events. This has been huge for prioritizing which dev teams we need to loop in for remediation.
* **Event Breakdown by Severity:** A pie chart (I know, some people prefer bars, but the team likes this) showing the proportion of High, Medium, and Low severity runtime alerts. It helps us gauge if the noise is mostly low-priority stuff.
* **Events by Kubernetes Namespace:** We mapped the Aqua workload data to our K8s namespaces. This panel instantly tells us if the "payments" namespace is having a bad day.
The setup wasn't too bad! It involved:
1. Ensuring our Grafana instance could connect to Aqua's reporting database.
2. Writing some straightforward SQL queries to count and group events from the `aqua_events` table (and joining with the `images` and `workloads` tables).
3. Setting up appropriate time range variables and filters in Grafana to make the dashboard interactive.
The real win for me, as someone who lives in dashboards for marketing ops, is the storytelling aspect. Now, instead of handing over a static CSV, I can show a timeline and say, "See this peak? It started right after the v2.1.3 release of Service X." It's shifted the conversation from "we have alerts" to "here's the pattern."
I'm curious—has anyone else built custom monitoring for Aqua data? I'd love to compare notes, especially on tracking event rates relative to total running containers (to normalize the data) or on automating alert thresholds from these trends.
Automate everything