Monitoring Faraday Security with Vigilmon

Faraday is an open-source collaborative vulnerability management and penetration testing platform used by security teams to consolidate findings from dozens of scanners, track remediation, and coordinate assessments. It runs a Python/Flask API backend with a PostgreSQL database, Elasticsearch search index, and real-time WebSocket collaboration — and when any layer fails, your security pipeline goes dark. Vigilmon gives you external uptime monitoring for Faraday's web server, API, database, and background services so you know before your pentesters do when the platform is unavailable.

What You'll Set Up

• Faraday web server availability (port 5985)
• Flask API endpoint health checks
• PostgreSQL database connectivity probe
• Elasticsearch search backend availability
• WebSocket real-time collaboration service health
• Agent connectivity and pipeline execution heartbeat
• Plugin import pipeline health
• Report generation service probe
• Scheduled scan trigger health

Prerequisites

• Faraday Community or Professional running and accessible (default port 5985)
• PostgreSQL and Elasticsearch running in your environment
• A free Vigilmon account

Step 1: Monitor the Faraday Web Server

Faraday's web interface and API both run on port 5985. The /status endpoint returns a lightweight JSON health payload:

1. Log in to vigilmon.online and click Add Monitor.
2. Set Type to HTTP / HTTPS.
3. Enter: http://faraday.internal:5985/
4. Set Check interval to 1 minute.
5. Set Expected HTTP status to 200.
6. Click Save.

Faraday's root path serves the single-page frontend and returns 200 when the Flask server is alive. A 502 or timeout indicates the process has crashed or the reverse proxy (nginx/Apache, if deployed) has lost its upstream.

Step 2: Monitor the Flask API Health Endpoint

Faraday exposes a /_api/v3/info endpoint that returns server version and status:

1. Add an HTTP monitor for:

   http://faraday.internal:5985/_api/v3/info
   

2. Set Expected HTTP status to 200.
3. Set Expected response body contains to "Faraday".
4. Set Response time alert to 3000 ms.
5. Set Check interval to 1 minute.

This endpoint queries the database for server configuration, making it a proxy check for both Flask and PostgreSQL connectivity in a single probe.

Also monitor the login endpoint to confirm authentication is functional:

http://faraday.internal:5985/_api/v3/login

Expected status: 405 (GET on a POST-only route) — which confirms the endpoint is routed and reachable without requiring valid credentials in the probe.

Step 3: Monitor PostgreSQL Database Connectivity

Faraday stores all workspaces, vulnerabilities, and host data in PostgreSQL. A database outage makes Faraday return 500 errors on every authenticated request.

Create a minimal health endpoint in Faraday's configuration or a sidecar script:

#!/usr/bin/env python3
# /opt/scripts/faraday-db-probe.py
import psycopg2
import sys

try:
    conn = psycopg2.connect(
        host="localhost",
        database="faraday",
        user="faraday_user",
        password=os.environ["FARADAY_DB_PASS"]
    )
    conn.close()
    print("ok")
    sys.exit(0)
except Exception as e:
    print(f"error: {e}")
    sys.exit(1)

Wrap this in a cron heartbeat:

#!/bin/bash
python3 /opt/scripts/faraday-db-probe.py \
  && curl -s https://vigilmon.online/heartbeat/FARADAY_DB_KEY

Set the Vigilmon heartbeat interval to 5 minutes and schedule the script every 2 minutes. A PostgreSQL failure shows up within 5 minutes.

Alternatively, add a TCP port monitor directly:

1. Click Add Monitor → TCP Port.
2. Enter localhost:5432 (or your PostgreSQL host/port).
3. Set Check interval to 1 minute.

Step 4: Monitor Elasticsearch

Faraday uses Elasticsearch (or OpenSearch) to index vulnerabilities for full-text search. When Elasticsearch goes down, search is unavailable and vulnerability imports may queue or fail silently.

Add an HTTP monitor for the Elasticsearch cluster health API:

1. Add a Vigilmon HTTP monitor for:

   http://elasticsearch.internal:9200/_cluster/health
   

2. Set Expected HTTP status to 200.
3. Set Expected response body contains to "status":"green" or "status":"yellow" — red indicates at least one primary shard is unassigned.
4. Set Response time alert to 2000 ms.

For a simple availability check without authentication requirements, use:

http://elasticsearch.internal:9200/

Expected status: 200, expected body contains: "tagline":"You Know, for Search".

Step 5: Monitor WebSocket Real-Time Collaboration

Faraday's collaborative features — live vulnerability updates across team members — run over WebSocket. A WebSocket failure degrades the experience without causing obvious errors in the UI.

Test WebSocket availability with an HTTP Upgrade probe script:

#!/bin/bash
# Check that the WebSocket upgrade is accepted
STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  -H "Connection: Upgrade" \
  -H "Upgrade: websocket" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  -H "Sec-WebSocket-Version: 13" \
  http://faraday.internal:5985/ws)

# 101 Switching Protocols = WebSocket accepted
if [ "$STATUS" = "101" ]; then
  curl -s https://vigilmon.online/heartbeat/FARADAY_WS_KEY
else
  echo "WebSocket probe returned: $STATUS"
fi

Set the Vigilmon heartbeat interval to 5 minutes and schedule the script every 2 minutes.

Step 6: Monitor Faraday Agent Connectivity

Faraday agents (faraday-agent-dispatcher) run on scanner hosts and push findings to the Faraday server. When an agent disconnects, scan results stop arriving.

Create a heartbeat that confirms the agent is connected and processing:

#!/bin/bash
# Check agent status via Faraday API
AGENT_STATUS=$(curl -s \
  -H "Authorization: Bearer $FARADAY_API_TOKEN" \
  "http://faraday.internal:5985/_api/v3/agents" \
  | python3 -c "import sys,json; agents=json.load(sys.stdin); active=[a for a in agents if a.get('active')]; print(len(active))")

if [ "$AGENT_STATUS" -gt 0 ]; then
  curl -s https://vigilmon.online/heartbeat/FARADAY_AGENT_KEY
else
  echo "No active agents connected"
fi

Set the heartbeat interval to 15 minutes — agents reconnect automatically after brief network issues, so a 15-minute window avoids false positives while still catching a permanently disconnected agent.

Step 7: Monitor Plugin Import Pipeline Health

Faraday's plugin system imports vulnerability data from scanner output files (Nessus, Burp Suite, Nmap, etc.). A broken plugin pipeline means scan results are uploaded but never parsed into the database.

Add a probe that checks for recent import activity:

#!/bin/bash
# Check that at least one import succeeded in the last 24 hours
RECENT_IMPORT=$(curl -s \
  -H "Authorization: Bearer $FARADAY_API_TOKEN" \
  "http://faraday.internal:5985/_api/v3/workspaces/$WORKSPACE/bulk_create" \
  -o /dev/null -w "%{http_code}")

# If the endpoint is responsive, pipeline is available
if [ "$RECENT_IMPORT" = "405" ] || [ "$RECENT_IMPORT" = "200" ]; then
  curl -s https://vigilmon.online/heartbeat/FARADAY_IMPORT_KEY
fi

For production environments with regular scans, set the heartbeat interval to 24 hours and schedule the check every 12 hours to catch a day where no imports succeeded.

Step 8: Monitor Report Generation

Faraday generates PDF and DOCX vulnerability reports. The report generation service depends on the database, file system permissions, and (for some installations) WeasyPrint or LibreOffice.

Add an HTTP monitor for the report endpoints:

http://faraday.internal:5985/_api/v3/workspaces

Expected status: 200, expected body contains: "rows". This confirms the API layer that feeds report generation is functional.

For a full report generation probe, trigger a lightweight test report via the API:

#!/bin/bash
curl -s -X GET \
  -H "Authorization: Bearer $FARADAY_API_TOKEN" \
  "http://faraday.internal:5985/_api/v3/workspaces/$WORKSPACE/reports/generate" \
  -o /dev/null -w "%{http_code}" \
  | grep -q "200\|202" \
  && curl -s https://vigilmon.online/heartbeat/FARADAY_REPORT_KEY

Step 9: Configure Alert Channels

1. Go to Alert Channels in Vigilmon and add Slack, email, or a webhook targeting your security team's channel.
2. Set Consecutive failures before alert to 2 on HTTP monitors — Flask restarts after deployment take a few seconds.
3. For Elasticsearch, set Response time alert to 2000 ms.
4. For the API, set Response time alert to 3000 ms.
5. Add a dedicated Security alert channel so Faraday outages page the security team directly, not just the operations team.

Summary

| Monitor | Target | What It Catches | |---|---|---| | Web server | :5985/ | Flask process down | | Flask API info | /_api/v3/info | API errors, DB connectivity | | PostgreSQL | :5432 TCP | Database down | | Elasticsearch | :9200/_cluster/health | Search backend failure | | WebSocket | Heartbeat URL | Real-time collaboration broken | | Agent connectivity | Heartbeat URL | Scanner agents disconnected | | Import pipeline | Heartbeat URL | Scan results not parsing | | Report generation | Heartbeat URL | Report service failure |

Faraday sits at the center of your vulnerability management program — when it's unavailable, findings go untracked, remediations stall, and your security team loses visibility across every active engagement. With Vigilmon watching the full stack from web server to database to agent pipeline, you get independent uptime verification that keeps your security operations running even when the platform itself is struggling to report its own health.