Protection & Policy Metrics

Mobile Rejection Policy Metric

The policy metric is prefixed policy- with the remainder of the metric name providing the name of the rejection policy that is being applied to the device. This will typically be the default policy for the account, but may be a device specific policy.

Mobile Device Filter Metrics

Filter metrics are prefixed filter- with the remainder of the metric name as defined using the approov filter -add command. Thus these are user defined labels reporting the associated filter matches. Please see the Device Filters section for a complete explanation as well as instructions to add, modify, and remove filters using the Approov CLI.

Web Protection Metrics

Web protection metrics are generated after integrating a web protection service with one of your web apps; see Web Protection Integration. The metrics are prefixed pass-web-, fail-web-, or error-web as appropriate. The metrics summarise the activity and failure reasons for your integrated web-protections.

Metric Name	Description
pass-web	Indicates that a valid Approov token was issued in response to a web protection request. This reports the sum total of passing web protection requests across all web-protection integrations. Note that, if a single request contains more than one integrated web protection result, then all those results will need to pass in order to obtain valid Approov tokens and to add one to this metric.
fail-web	Indicates that an invalid Approov token was issued in response to a web protection request because a criteria was not met, depending on the configuration for your web protection services. If a single request contains more than one integrated web protection result, then only one such result needs to fail to cause the issuance of invalid approov tokens and to add one to this metric.
error-web	Indicates that an error was issued in response to a web protection request. This may indicate genuine errors received by your web app or a failed attempt to spoof requests. Error details are not available from Grafana, see the Troubleshooting Web Protection Errors section if this represents responses to legitimate requests.
pass-web-fpjs	A valid Approov token was issued for a web protection request requiring a FingerprintJS check
pass-web-hcap	A valid Approov token was issued for a web protection request requiring an hCaptcha check
pass-web-recap	A valid Approov token was issued for a web protection request requiring a Google reCAPTCHA check
fail-web-aprv-rate-limit-exhausted	An invalid Approov token was issued because a rate limit was triggered for one or more of the integrated web protections
fail-web-fpjs-vis-or-rqst-id-unknown	An invalid Approov token was issued because the FingerprintJS lookup failed to recognise the specified VisitorID or RequestID
fail-web-fpjs-timestamp-too-old	An invalid Approov token was issued because the timestamp for the FingerprintJS request happened too far into the past. This may indicate a malicious attempt to reuse RequestIDs or that the current Max Elapsed Time setting for the Subscription is too short. See the section on FingerprintJS configuration.
fail-web-fpjs-bot-probability	An invalid Approov token was issued because the BotProbability score returned by the FingerprintJS lookup was higher than the configured maximum for the subscription. See the section on FingerprintJS configuration.
fail-web-hcap-request-invalid	An invalid Approov token was issued because the hCaptcha lookup responded with the Success property set to false
fail-web-hcap-domain-not-found	An invalid Approov token was issued because the hCaptcha lookup responded with a domain that is not in the configured set of acceptable domains. This only triggers if the hCaptcha site in Approov has been configured with a set of domains to check. See the section on hCaptcha configuration.
fail-web-hcap-bad-score	An invalid Approov token was issued because the hCaptcha lookup responded with a score that was below the minimum configured for the site. See the section on hCaptcha configuration.
fail-web-recap-request-invalid	An invalid Approov token was issued because the reCAPTCHA lookup responded with the Success property set to false
fail-web-recap-action-not-found	An invalid Approov token was issued because the reCAPTCHA lookup responded with an action that is not in the configured set of acceptable actions. This only triggers if the reCAPTCHA site in Approov has been configured with a set of actions to check. See the section on reCAPTCHA configuration.
fail-web-recap-domain-not-found	An invalid Approov token was issued because the reCAPTCHA lookup responded with a domain that is not in the configured set of acceptable domains. This only triggers if the reCAPTCHA site in Approov has been configured with a set of domains to check. See the section on reCAPTCHA configuration.
fail-web-recap-bad-score	An invalid Approov token was issued because the reCAPTCHA lookup responded with a score that was below the minimum configured for the site. See the section on reCAPTCHA configuration.
error-web	An invalid web protection request was made and the Approov service generated an error response. The generated response includes more detail on the cause of the error which is not reported in the metrics. See the section on Troubleshooting Web Protection Errors.