New Relic Insights Integration


Sqreen can send attacks information to NewRelic Insights.

Configuring the integration

Configuring the New Relic Insights integration is very easy, you can follow the NewRelic Insights documentation to register a new Insert Key.

Once you've retrieved your API key, visit your application integrations settings section to complete the Sqreen setup.

You're all set! You can now customise your own Dashboards at NewRelic.

Data sent to NewRelic Insights

The attacks will be pushed with the eventType sqreen_attacks with the following fields:

Field Description Example value
path Targeted app path /admin.php
ip_address Attacker's IP address 172.17.3.46
type Attack type bot_scanning, xss_injection, sql_injection, ...
verb HTTP verb used GET, POST, PROPFIND, UNCHECKOUT, ...
user_agent Attacker user agent Arachni, Mozilla/4.0, ...
scheme Attack origin scheme http or https
geo_country Attacker IP country MYS, USA, ...
geo_city Attacker IP city Dublin, Paris, ...
geo_latitude Attacker IP latitude 9.51
geo_longitude Attacker IP longitude 51.1

You can start making your own dashboards using NRQL queries.

For example, to visualize the top attacked paths on your application, you would do:

SELECT count(*) FROM sqreen_attacks FACET path SINCE 1 week AGO

The resulting dashboard would look like:

Insights_by_New_Relic.png