Neurowall exports comprehensive Prometheus metrics — throughput, drops, rule hits, DDoS activity, threat intel health, HA status, and more — so you're never guessing what the firewall did during an incident, or whether it's healthy right now.
A firewall making silent decisions is a liability — you need to know it's actually dropping what it should, passing what it should, and staying healthy under load. Neurowall treats observability as a first-class feature, not an afterthought bolted on for compliance.
Packet-level counters for allowed/blocked/dropped traffic confirm rules are actually being enforced — not just present in the database.
Threat intel feed health, HA leader status, and database connection metrics surface subsystem issues before they become outages.
DDoS-specific counters show drop rates and threshold state in real time during an active attack, not just after the fact.
Standard Prometheus exposition format means metrics plug straight into whatever Grafana, Alertmanager, or paging setup you already run.
| Category | What you see |
|---|---|
| Firewall / data plane | Active rule count, packets processed/blocked, bytes, rule evaluation latency, flow cache size & evictions |
| DDoS protection | Drop counters by attack type, config reload events, enabled-module state, threshold values, controller poll timestamps |
| Threat intelligence | Indicator counts, match rates, feed update latency & errors, data-integrity alerts |
| HTTP API | Request rate, latency, and payload size — useful for spotting automation gone wrong |
| Database | Query count, duration, active/idle connections — early warning for capacity issues |
| High availability | Leader election state, cluster node health, failover events |
| Audit | Audit log write count, write errors, and latency — confirms the audit trail itself is healthy |
Neurowall exposes a standard Prometheus scrape endpoint — add it to your existing prometheus.yml, no custom exporter needed.
Pre-built Grafana dashboards ship with the deployment and are provisioned automatically via docker-compose — no manual panel-building required.
Use Alertmanager rules against DDoS drop rates, TI feed errors, or HA failover events to page on-call before users notice a problem.
Most firewalls technically produce some output. Whether that output is actually usable for real-time operations or incident response is a different question.
| Common approach | Where it falls short |
|---|---|
| Proprietary log format, vendor-only viewer | Logs can't be correlated with the rest of your infrastructure's Prometheus/Grafana stack without a custom parser or a separate pane of glass nobody checks |
| Aggregate throughput graphs only | Total packets/sec tells you traffic exists, not whether DDoS mitigation is engaged, whether a specific rule is misfiring, or whether the TI feed silently stopped updating three days ago |
| Health check limited to "process is running" | A process can be alive while its rule sync is broken, its threat feed is stale, or its HA state is split-brain — "up" and "healthy" are not the same claim |
| Metrics as a paid add-on tier | Observability gets treated as an upsell rather than a baseline requirement — teams either pay extra or fly blind on exactly the system meant to protect them |
All 37 metrics ship with every deployment and expose through a standard /metrics endpoint — no separate license, no proprietary viewer required.
Beyond a basic liveness check, metrics distinguish "process is running" from "TI feed is current," "HA leader is stable," and "DB connections are healthy" — the distinctions that actually matter during an incident.
Grafana dashboards are provisioned automatically via docker-compose, so day-one visibility doesn't depend on someone finding time to build panels from scratch.
No requirement to adopt a new vendor's monitoring platform — Neurowall's metrics plug into the Prometheus/Grafana/Alertmanager stack most infrastructure teams already operate.