Uptime monitoring for Aqua Security

Aqua Security sits at the heart of your container and Kubernetes security posture. Its scanning engines, policy controllers, and runtime enforcement components handle everything from image vulnerability detection to real-time workload protection. When Aqua goes down, your pipeline loses its security gate — images ship unscanned, policy checks stop, and runtime anomaly detection goes dark. Most teams only discover this after a failed audit or a missed CVE slips through.

This tutorial covers production-grade uptime monitoring for Aqua Security using Vigilmon. We will walk through:

• Monitoring the Aqua Server API health endpoint
• Monitoring the Aqua Enforcer and Gateway components
• SSL certificate monitoring for the Aqua console
• Webhook alerts for DOWN/UP events

Prerequisites

• Aqua Security platform deployed (self-hosted or SaaS console)
• Aqua Server accessible over HTTPS
• A free account at vigilmon.online

Part 1: Locate the Aqua Server health endpoint

Aqua Server exposes a health check endpoint that confirms the API layer is alive and connected to its database.

API health check

curl -k https://aqua.example.com/api/v1/ping

Expected response:

{"status": "OK"}

If Aqua is unhealthy or starting up, this endpoint returns a non-200 status or times out. The /api/v1/ping route does not require authentication, making it ideal for external monitoring.

Find your Aqua Server URL

# For Kubernetes deployments, get the service IP/hostname
kubectl get svc aqua-web -n aqua
# NAME        TYPE           CLUSTER-IP     EXTERNAL-IP       PORT(S)
# aqua-web    LoadBalancer   10.0.12.34     203.0.113.55      443:30443/TCP

For docker-based deployments:

docker inspect aqua-web | grep -i port

Part 2: Set up HTTP monitoring in Vigilmon

Monitor the Aqua Server API

1. Log in to vigilmon.online and click Add Monitor.
2. Choose HTTP(S) monitor.
3. Enter: https://aqua.example.com/api/v1/ping
4. Set interval to 1 minute.
5. Add a keyword check: must contain OK.
6. Add your alert channel.
7. Click Save.

The keyword check ensures that a reverse proxy or load balancer returning a cached 200 response does not mask an actual Aqua outage. Only the real ping handler returns {"status": "OK"}.

Monitor the Aqua console login page

Add a second monitor targeting the web console itself:

1. Add another HTTP(S) monitor.
2. Enter: https://aqua.example.com/
3. Set interval to 2 minutes.
4. Add a keyword check: must contain Aqua (or whatever title text your login page shows).
5. Click Save.

This catches cases where the API layer is healthy but the frontend is broken — mismatched deployments, failed static asset builds, or NGINX misconfigurations.

Part 3: Monitor Aqua Enforcers and Gateways

Aqua Enforcers run as DaemonSets on your Kubernetes nodes and enforce runtime policies. Gateways broker communication between Enforcers and the Aqua Server. If either component loses connectivity, runtime enforcement degrades silently.

Check Enforcer connectivity via the Aqua API

Aqua Server exposes an API endpoint that reports connected Enforcers:

curl -s -H "Authorization: Bearer $AQUA_TOKEN" \
  https://aqua.example.com/api/v1/hosts | jq '.data[] | {host: .name, status: .status}'

You can wrap this in a lightweight health-check service that exposes its own /health endpoint, which Vigilmon then polls:

// enforcer-health.ts
import express from 'express';
import fetch from 'node-fetch';

const app = express();

app.get('/health', async (req, res) => {
  try {
    const response = await fetch(`${process.env.AQUA_URL}/api/v1/hosts`, {
      headers: { Authorization: `Bearer ${process.env.AQUA_TOKEN}` },
    });
    const data = await response.json() as { count: number };
    if (data.count > 0) {
      res.json({ status: 'ok', enforcers: data.count });
    } else {
      res.status(503).json({ status: 'no_enforcers' });
    }
  } catch {
    res.status(503).json({ status: 'error' });
  }
});

app.listen(3000);

Then add a Vigilmon HTTP monitor pointing at https://enforcer-health.example.com/health with a keyword check for "status":"ok".

Kubernetes readiness probes as a monitoring signal

For Kubernetes deployments, expose the readiness state of the aqua-web and aqua-gateway pods via a small proxy endpoint:

# aqua-readiness-check.yaml
apiVersion: v1
kind: Service
metadata:
  name: aqua-readiness-proxy
  namespace: aqua
spec:
  selector:
    app: aqua-web
  ports:
    - port: 8080
      targetPort: 8080
  type: LoadBalancer

Then monitor http://<external-ip>:8080/readiness — Aqua's built-in readiness probe returns HTTP 200 only when the pod is ready.

Part 4: SSL certificate monitoring

The Aqua console handles sensitive security data — tokens, policy definitions, vulnerability reports. A lapsed TLS certificate shuts down access and may trigger compliance violations.

1. In Vigilmon, click Add Monitor.
2. Choose SSL monitor.
3. Enter your Aqua console domain: aqua.example.com.
4. Set alert threshold to 14 days before expiry.
5. Add your alert channel.

If you use Aqua Gateway with a separate hostname, add a second SSL monitor for that domain as well.

Part 5: Webhook alerts for security-critical downtime

When Aqua goes down, downtime is a security event, not just an availability event. Route Vigilmon alerts directly to your security on-call rotation:

// webhook-receiver.ts
import express from 'express';

const app = express();
app.use(express.json());

app.post('/webhook/vigilmon', (req, res) => {
  const { monitor_name, status, url, checked_at, response_code } = req.body;

  if (status === 'down') {
    console.error('[SECURITY ALERT] Aqua monitor DOWN', {
      monitor: monitor_name,
      url,
      code: response_code,
      at: checked_at,
    });

    // Trigger security incident — Aqua being down may mean enforcement is degraded
    triggerSecurityIncident({
      title: `Aqua Security monitor down: ${monitor_name}`,
      severity: 'high',
      url,
    });
  } else if (status === 'up') {
    console.info('[SECURITY] Aqua monitor recovered', { monitor: monitor_name });
    resolveSecurityIncident(monitor_name);
  }

  res.sendStatus(204);
});

Vigilmon sends this payload on state transitions:

{
  "monitor_id": "mon_abc123",
  "monitor_name": "Aqua Security API",
  "status": "down",
  "url": "https://aqua.example.com/api/v1/ping",
  "checked_at": "2026-06-30T08:01:00Z",
  "response_code": 503,
  "response_time_ms": 1502
}

Part 6: Multi-region checks for distributed deployments

If you run Aqua in multiple regions or data centers, add a monitor per region:

| Region | Monitor URL | Name | |--------|-------------|------| | US-East | https://aqua-us.example.com/api/v1/ping | Aqua US-East | | EU-West | https://aqua-eu.example.com/api/v1/ping | Aqua EU-West | | AP-SE | https://aqua-ap.example.com/api/v1/ping | Aqua AP-SE |

Group them with a shared tag in Vigilmon so you get a single status page showing all Aqua instances alongside the rest of your security infrastructure.

Summary

Your Aqua Security deployment now has three layers of monitoring:

1. API health endpoint — /api/v1/ping polled every 60 seconds confirms Aqua Server is alive and connected to its database.
2. Console availability — a second HTTP monitor catches frontend failures independent of the API layer.
3. SSL monitor — alerts you 14 days before your Aqua console certificate expires, before access is blocked.
4. Webhook alerts — DOWN events route directly to your security on-call rotation since Aqua downtime is a security event.

Vigilmon handles check scheduling, multi-region polling, alert routing, and uptime history. You get notified within 60 seconds of any Aqua failure.

Monitor your Aqua Security infrastructure free at vigilmon.online

#aquasecurity #devops #monitoring #kubernetes #containersecurity