WSO2 APIM currently supports the following alert types.
...
| Reason for triggering | If there is a sudden increase in the response time of a specific API resource. |
|---|---|
| Indication | Slow WSO2 API Manager runtime, or slow backend. |
| Description | If the response time of a particular API resource (e.g., GET /API1/1.0/user/1) of a tenant, lies outside the Xth percentile value, an alert is sent. Default percentile value is 95%. Here, it is assumed that the response time of an API resource follows a normal distribution. Percentile value gets calculated daily by default. |
Abnormal backend time
| Reason for triggering | If there is a sudden increase in the backend time corresponding to a particular API resource. |
|---|---|
| Indication | Slow backend |
| Description | An alert is sent if the backend time of a particular API resource (e.g., GET /calc/1.0/numbers) of a tenant lies outside the Xth percentile value. Default percentile value is 95%. Here, it is assumed that the corresponding backend time of an API resource follows a normal distribution. The percentile value gets calculated daily by default. |
...
| Reason for triggering | If there is a change in the resource access pattern of a user who uses a particular application. |
|---|---|
| Indication | These alerts can be considered as indications of suspicious activities done by one or more users in your application. |
| Description | A Markov Chain model is built for each application to learn its resource access pattern. For the purpose of learning the resource access patterns, no alerts are sent during the first 500 (default) requests. After learning the normal pattern of a specific application, WSO2 Analytics performs a real time check on a transition done by a specific user, and sends and alert if it is identified as an abnormal transition.For a transition to be considered valid, it has to occur within 60 minutes by default, and it should be by the same user.
The above diagram depicts an example where a Markov Chain model is created during the learning curve of the system. Two states are recorded against Application A and the arrows show the directions of the transitions. Each arrow carries a probability value that stands for the probability of a specific transition taking place. Assume that the following two consecutive events are received by the application from user john@abc.com.
The above transition has happened from the |
...
| Reason for Triggering | If there is either a change in the request source IP for a specific API of an application, or if the request if from an IP used before 30 days (default). |
|---|---|
| Indication | These alerts can be considered as indications of suspicious activities carried out by a user over an API of an application. |
| Description |
The first 500 requests are used only for learning purposes by default and therefore, no alerts are sent during that time. However, the learning would continue even after the first 500 requests. This means, even if you receive continuous requests from the newly detected |
...
| Reason for Triggering | This alert is triggered in the following scenarios.
|
|---|---|
| Indication | These alerts indicate that you need to subscribe to a higher tier. |
...