Immuta is the data access governance and security platform purpose-built for cloud data platforms — providing automated policy enforcement, attribute-based access control, data masking, and privacy compliance monitoring across Snowflake, Databricks, BigQuery, Redshift, and other modern data warehouses without requiring data movement or copying. Immuta sits in the data access path as the policy enforcement layer that intercepts queries, applies row-level security, column masking, and purpose-based access restrictions, and audits every data access event for compliance reporting. When the Immuta platform becomes unavailable, the query interceptors that enforce data access policies can enter a fail-open or fail-closed state depending on configuration — either allowing unrestricted access to sensitive data or blocking all queries from reaching the warehouse. When the Immuta policy API degrades, data platform engineers cannot deploy updated access policies, privacy teams cannot revoke access in response to a security event, and the automated provisioning workflows that onboard new data products lose their policy enforcement backend. Vigilmon gives you external visibility into Immuta's critical services: the web application, REST API, and native integration health endpoints, so you know the moment the data access governance layer needs attention before a policy enforcement gap or access blockage affects your entire data platform.
What You'll Build
- An HTTP monitor on the Immuta platform application to detect availability failures
- A health-check monitor on the Immuta REST API to catch policy engine degradation
- A monitor on the Immuta native integration status endpoint to verify warehouse connectivity
- A monitor on your audit log delivery webhook to verify compliance event streaming is intact
- An SSL certificate monitor for your Immuta domain
- Alerting that distinguishes application outages from policy engine degradation and integration failures
Prerequisites
- An Immuta deployment (Immuta Cloud SaaS or self-managed)
- At least one native integration configured between Immuta and a cloud data warehouse
- An audit log delivery endpoint or SIEM integration receiving Immuta compliance events
- A free account at vigilmon.online
Step 1: Understand Immuta's Service Architecture
Immuta's architecture places the platform directly in the data access path, which makes availability a higher-stakes concern than typical governance tools:
| Component | Surface | Role | |---|---|---| | Immuta platform application | HTTPS | Web UI for policy authoring, data product management, user provisioning, and compliance reporting | | REST API | HTTPS | Programmatic access to policies, data products, purposes, user attributes, and audit data | | Native integration endpoints | Per-warehouse | Policy enforcement hooks within Snowflake, Databricks, BigQuery, and Redshift | | Audit log delivery | Outbound HTTPS / SIEM | Streams data access events to SIEM, S3, or webhook endpoints for compliance recording | | Identity provider integration | HTTPS | Syncs user attributes from LDAP, Okta, or Azure AD for attribute-based access control |
External monitoring focuses on the application, REST API, and integration health endpoints — the surfaces that data platform teams, privacy officers, and automated provisioning workflows interact with daily. Native integration failures are the most operationally critical: when the Snowflake or Databricks integration breaks, Immuta can neither enforce policies nor grant access, leaving data teams unable to run queries against governed datasets.
Step 2: Monitor the Immuta Platform Application
The Immuta web application is where data stewards author policies, privacy teams review access subscriptions, engineers configure data products, and compliance officers run audit reports. When the application is unavailable, the entire governance workflow for onboarding new data consumers, responding to access requests, and reviewing policy coverage comes to a halt:
curl -I https://your-immuta-instance.immuta.com
# Returns HTTP 200 when the platform is accessible
- Log in to Vigilmon → Add Monitor → HTTP.
- URL:
https://your-immuta-instance.immuta.com(your Immuta Cloud or self-managed URL). - Check interval: 60 seconds.
- Response timeout: 15 seconds.
- Expected status:
200. - Keyword:
Immuta(present in the application page content). - Click Save.
This monitor catches:
- Immuta platform application server failures or cloud infrastructure outages
- Failed Immuta upgrades that leave the platform returning 5xx errors
- Load balancer or reverse proxy misconfigurations that block access to the Immuta application
- DNS resolution failures for the Immuta hostname
Alert sensitivity: Set to trigger after 1 consecutive failure. When Immuta is unavailable, privacy teams cannot revoke compromised access subscriptions, data stewards cannot respond to pending access requests, and automated onboarding workflows that rely on the Immuta API for policy-based provisioning fail immediately.
Step 3: Monitor the Immuta REST API
The Immuta REST API is the backbone of every automated governance integration — CI/CD pipelines that register new data products on deployment, Terraform modules that provision policy frameworks, data mesh platforms that query Immuta for access decisions, and compliance automation scripts that pull audit summaries all rely on consistent API availability:
curl https://your-immuta-instance.immuta.com/api/health
# Returns: {"status": "ok"} when the API backend is operational
# Or check the API version endpoint
curl https://your-immuta-instance.immuta.com/api/about
# Returns platform version and connectivity status
- Add Monitor → HTTP.
- URL:
https://your-immuta-instance.immuta.com/api/health. - Check interval: 60 seconds.
- Response timeout: 10 seconds.
- Expected status:
200. - Keyword:
ok(or the health status token in your Immuta version's response format). - Label:
Immuta REST API. - Click Save.
Why monitor the API separately from the application? Immuta's web application UI may continue to load from cached assets even when the API backend is degraded or overloaded. A degraded API means policy updates cannot be persisted, access subscription state changes are lost, and automated provisioning workflows that depend on API responses for conditional logic fail in ways that can leave data consumers without access or with incorrect access levels.
Step 4: Monitor the Native Integration Status
Immuta's native integrations — the Snowflake row-access policies, Databricks Unity Catalog bindings, BigQuery authorized views, and Redshift row-level security rules — are the actual enforcement mechanisms that govern query execution. These integrations can degrade independently of the Immuta application itself, leaving a healthy-looking platform dashboard while policy enforcement has silently failed at the warehouse level:
# Immuta exposes integration health status through its API
curl -H "Authorization: Bearer $IMMUTA_API_KEY" \
https://your-immuta-instance.immuta.com/api/integrations/health
# Returns integration connectivity status for each configured warehouse
# For self-managed deployments, check the integration service endpoint directly
curl https://your-immuta-instance.immuta.com/api/integrations/status
# Returns per-integration status with last-sync timestamps
- Add Monitor → HTTP.
- URL:
https://your-immuta-instance.immuta.com/api/integrations/status. - Check interval: 2 minutes.
- Response timeout: 15 seconds.
- Expected status:
200. - Keyword:
connected(or the healthy integration state token in your Immuta version's response). - Label:
Immuta native integrations. - Click Save.
Policy enforcement gap risk: In Immuta's fail-closed configuration, an integration failure blocks all queries against governed datasets until connectivity is restored. In fail-open configurations, an integration failure removes policy enforcement from queries that should be restricted. Both outcomes are operationally severe — a monitoring gap here is equivalent to having no visibility into whether your data access governance is actually functioning.
Step 5: Monitor Your Audit Log Delivery Endpoint
Immuta records every data access event — who queried which dataset, when, under which purpose, and whether the query was masked or filtered — and delivers these events to SIEM systems, S3 buckets, or webhook endpoints for compliance recording. If the audit log delivery endpoint becomes unavailable, compliance events are lost or queued indefinitely, creating gaps in the audit trail that regulatory reviews require:
curl https://your-audit-receiver.example.com/health
# Returns: {"status": "ok"} when the audit log receiver is operational
- Add Monitor → HTTP.
- URL:
https://your-audit-receiver.example.com/health. - Check interval: 2 minutes.
- Response timeout: 10 seconds.
- Expected status:
200. - Keyword:
ok. - Label:
Immuta audit log receiver. - Click Save.
For Splunk SIEM integrations that receive Immuta audit events, verify the Splunk HEC (HTTP Event Collector) endpoint to confirm event ingestion is functional. For S3-backed audit stores, monitor a health proxy or use an S3 connectivity check from your monitoring infrastructure to verify bucket write access.
Step 6: Monitor SSL Certificates
Immuta's platform application and REST API are accessed over HTTPS by data engineers, privacy officers, automated provisioning tools, and the native integration services in each warehouse that connect back to Immuta for policy refresh. An expired certificate on the Immuta domain blocks browser access for governance teams, breaks automated CI/CD pipelines that register new data products on deployment, and causes native integration connectivity checks to fail, potentially triggering the fail-closed policy enforcement mode:
openssl s_client -connect your-immuta-instance.immuta.com:443 2>/dev/null | openssl x509 -noout -dates
- Add Monitor → SSL Certificate.
- Domain:
your-immuta-instance.immuta.com. - Alert when expiry is within: 30 days.
- Alert again: 14 days, 7 days, 3 days, 1 day.
- Click Save.
Self-managed deployment note: For Immuta deployments hosted in a customer-managed cloud VPC, TLS certificates are owned and renewed by the customer's infrastructure team. The 30-day pre-expiry alert gives enough lead time to coordinate renewal across the data platform team, network security, and the PKI team — renewal windows that are easy to miss without proactive monitoring, especially for internal certificates not managed by a commercial certificate authority.
Step 7: Configure Alerting
In Vigilmon under Settings → Notifications, configure your alert channels:
| Monitor | Trigger | Action |
|---|---|---|
| Platform application | Non-200 or Immuta missing | Check application server; governance workflows and policy authoring blocked |
| REST API | Non-200 or ok missing | API down; automated provisioning and policy updates failing |
| Native integrations | Non-200 or connected missing | Policy enforcement at warehouse level degraded or failing |
| Audit log receiver | Non-200 or ok missing | Compliance event delivery broken; audit trail gapping |
| SSL certificate | < 30 days to expiry | Renew certificate; browser access and native integration connectivity at risk |
Alert after: 1 consecutive failure for the application, API, and native integration monitors. 2 consecutive failures for the audit log receiver to reduce noise from brief transient delivery timeouts.
Common Immuta Failure Modes and What Vigilmon Catches
| Scenario | Vigilmon monitor | |---|---| | Platform application server failure | Application monitor fires; governance workflows and access reviews blocked | | REST API degradation | API monitor fires; automated provisioning and policy updates fail | | Snowflake/Databricks integration break | Integration monitor fires; policy enforcement at warehouse level degraded | | Audit log receiver crash | Audit monitor fires; compliance event delivery lost | | TLS certificate expired | SSL monitor alerts at 30-day threshold; browser and integration connectivity fail | | DNS misconfiguration | All monitors fire simultaneously | | Identity provider sync failure | User attribute data stales; attribute-based access policies apply incorrect attributes | | Database connectivity failure | Application and API monitors fire with 5xx errors | | Immuta upgrade leaves integration broken | Integration monitor fires; native policies not synced after platform update | | Network policy change blocks warehouse-to-Immuta connectivity | Integration monitor fires; native integrations cannot refresh policies |
Monitoring Data Access Quality Itself (Beyond Infrastructure)
Vigilmon monitors Immuta's infrastructure endpoints — the platform application, REST API, native integrations, and audit delivery. The quality of data access governance within a healthy Immuta deployment requires domain-specific governance processes:
- Policy coverage audits: Regularly review which data products are registered in Immuta and which tables or columns are governed by active policies. Infrastructure availability does not tell you that a new sensitive table was added to the warehouse without a corresponding Immuta policy.
- Access subscription hygiene: Use Immuta's built-in reporting to identify and revoke stale access subscriptions — consumers who have not accessed a dataset in 90 days but still hold an active subscription represent unnecessary data exposure that infrastructure monitoring cannot surface.
- Purpose validity reviews: Immuta's purpose-based access model requires that declared purposes remain accurate over time. Regularly review active purposes and their associated access policies to ensure consumers are not accessing data for purposes that have expired or changed scope.
Vigilmon catches infrastructure failures — when Immuta itself is down, its API is degraded, or native integration connectivity has broken. The quality of governance coverage, policy completeness, and access hygiene within a healthy Immuta deployment require Immuta's own governance workflows and compliance reporting tooling.
Immuta sits directly in the data access path for governed datasets — when the platform goes down, governance workflows stall and policy enforcement enters an undefined state; when native integrations fail, policy enforcement at the warehouse level degrades silently; when the audit delivery breaks, compliance event records gap. Vigilmon gives you external visibility into Immuta's availability that does not depend on Immuta self-reporting: application uptime, API health, integration connectivity, audit delivery status, and SSL certificate validity, so you know the moment the data access governance layer needs attention before a policy enforcement gap or access blockage affects your data platform's compliance posture.
Start monitoring Immuta in under 5 minutes — register free at vigilmon.online.