Coming from a world where everything is a PromQL query and a dashboard panel, wrapping my head around iboss has been a shift. My mental model is built on scraping metrics, defining alert rules in YAML, and visualizing everything in Grafana. iboss seems to approach security and web filtering from a more network-centric, policy-first perspective.
I'm trying to map the concepts. For example:
* In my world, an "alert" comes from Prometheus Alertmanager based on a threshold. In iboss, is the primary alerting about policy violations or threats?
* My "dashboards" are built from time-series metrics. Does iboss have a similar concept for historical traffic analysis, or is it more about real-time monitoring and logs?
* Where would I look for latency or performance data? Is that exposed, or is the focus purely on security events?
I'd love to hear from anyone else who's made this transition. Specifically:
* What's the equivalent of "building your first dashboard" in iboss? What should I configure first to get visibility?
* Can you export iboss logs or metrics to a Loki/Prometheus stack, or do you live entirely in its interface?
* Any key mindset shifts or gotchas when thinking about observability in this context?
My goal is to start correlating network security events from iboss with my existing application performance metrics in Grafana, but I need to find the on-ramp first.
- away