Integrations: OCI, AWS, Prometheus and Grafana

Oracle Cloud Infrastructure

Every compartment and region, read-only

A connection wizard tests access live, shows exactly which permissions are missing and generates a least-privilege OCI policy. Sign in with an instance principal or an API key, with the secret stored encrypted.

OCI service	What VIREOPS reads	Used for
Resource Search and service APIs	Every compartment and region, plus the types Search misses (DHCP options, Functions apps, dynamic groups, notification subscriptions). Each resource enriched with its details and relationships.	Inventory, Asset 360, applications, network map
Usage API	Daily billed cost, with a 365-day backfill and the last 5 days re-read	Cost and usage, cost explorer, savings
Monitoring	14 days of daily CPU mean and p95 and memory per instance; live five-minute metrics kept 8 days; alarm states	Health, alerts, Optimize, Operations
Logging Search	The audit log, with VIREOPS's own reads filtered out; every OCI log in scope for log search	Changes, log search
Cloud Guard	Status and open problems	Security, Fix these first
Vulnerability Scanning	Worst finding per instance and open CVEsNeeds the `read vss-family` grant	Vulnerabilities, Fix these first
Ops Insights	CPU and storage trends over 30 days; top 200 SQL by database time over 7 days. Statistics and SQL IDs only, never SQL text.	Databases
Full Stack DR and backups	FSDR groups, plans and runs; DB system backups and Data Guard; MySQL; file systems; volume groups; backup policies	Resilience and DR
Networking	NSG rules (narrow read-only grant) and cross-region remote peering connections	Network answers, topology
OS Management Hub	OS updates: security, bug fixes or all, started by a personOpt-in operations policy	Cloud actions
Email Delivery	Sends your notifications through your own tenancy	Email notifications
Generative AI	Your chosen model in any subscribed region, when an admin turns AI on	Ask VIREOPS

Live metrics every five minutes

Instances: CPU, memory and OCI infrastructure health (unhealthy, maintenance scheduled)
Autonomous Database: CPU, storage, sessions, active and blocking sessions, queued statements, query latency, failed logons
DB systems: CPU, storage, sessions
OCI PostgreSQL: CPU, memory, connections, active sessions, blocked queries, deadlocks, queries over 5 minutes
Volumes: throttled I/O. Load balancers: unhealthy backends, 5xx responses, response time

Collection you control

Scheduled every 1, 3, 6, 12 or 24 hours (default 6), or manual only with a "Collect now" button
Measured: about 5,900 resources in 4 to 5 minutes, with live progress on first collection
Renaming a resource keeps it the same asset; evidence is stored immutably with a SHA-256
Anything not collected says so, with the reason. Missing data is never treated as zero or "all clear"

Not yet: Kubernetes (OKE) and file-system metrics.

Amazon Web Services Built

One estate across clouds

An AWS account sits next to your OCI tenancies under the same entity. Inventory, Cost, Changes, Compliance and reports cover both, under the same contract as OCI.

Access through a read-only IAM user, or a role it assumes in each account of an organisation, with ViewOnlyAccess, SecurityAudit and a small inline policy
Never ReadOnlyAccess, which can read your data. The secret is stored encrypted
Security groups, S3 bucket policies and RDS settings feed the shared compliance checks. OCI-only checks never judge AWS resources

Tested read-only against a real AWS account. Ships in Release 2. Not yet: CIS AWS, AWS resilience checks, per-resource AWS cost and operations on AWS (AWS stays read-only).

AWS source	What VIREOPS reads
Service APIs	EC2, EBS, snapshots, AMIs, VPC networking, load balancers, RDS, EFS, Lambda, EKS, AWS Backup, IAM, S3 configuration
Cost Explorer	Daily cost by service and region
CloudWatch	CPU and alarms
CloudTrail	Changes
Security Hub	Findings
Inspector	Vulnerabilities

Prometheus and Grafana

Your metrics, in your dashboards

VIREOPS publishes what it has stored as a Prometheus text exposition endpoint. Your own Prometheus, Grafana Agent, VictoriaMetrics or any OpenMetrics scraper can read it, and Grafana can chart it. A scrape never calls the cloud and never runs AI: every value is a gauge from the VIREOPS database.

Settings → Metrics export → New token. A token reads the whole account or one entity only
Shown once; VIREOPS keeps only its SHA-256 hash. One token per scraper, each revocable on its own
"Last used" shows whether a scraper is still reading. Creating and revoking are audited
Live values change every five minutes, so a 60 s scrape interval is plenty

prometheus.ymlGET /api/v1/export/prometheus

scrape_configs:
  - job_name: vireops
    scheme: https
    metrics_path: /api/v1/export/prometheus
    scrape_interval: 60s
    authorization:
      type: Bearer
      credentials_file: /etc/prometheus/vireops.token
    static_configs:
      - targets: ["vireops.example.com"]

Prometheus

Grafana

Series

Series	Labels	Meaning
`vireops_up`		1 when VIREOPS answered
`vireops_compute_cpu_percent`, `vireops_compute_memory_percent`, `_unhealthy`, `_maintenance`	connection, resource, resource_id, asset_id, region	Newest five-minute value from OCI Monitoring (last 30 min). `unhealthy` and `maintenance` are OCI infrastructure health, 1 or 0
`vireops_database_cpu_percent`, `_memory_percent`, `_storage_percent`, `_sessions`, `_active_sessions`, `_blocking_sessions`, `_queued_statements`, `_query_latency_milliseconds`, `_failed_logons`, `_blocked_queries`, `_deadlocks`, `_long_queries`	same	Databases: session metrics from Autonomous Database; memory, blocked queries, deadlocks and queries over five minutes from OCI PostgreSQL
`vireops_load_balancer_unhealthy_backends`, `_http_5xx`, `_response_time_milliseconds`	same	Load balancers
`vireops_block_volume_throttled_ios`	same	Block and boot volumes: I/O throttled in the five minutes
`vireops_alerts_firing`	rule, severity	Alert events open now
`vireops_compliance_failing_resources`, `vireops_compliance_evaluated_resources`	check, title, severity	Latest compliance result per check
`vireops_vulnerable_instances`	severity	Scanned instances by worst finding
`vireops_resources`	type	Collected resources by type
`vireops_cost_last_day`	connection, currency, day	Cost of the newest complete billing day
`vireops_collection_last_success_timestamp_seconds`	connection	When the last good collection finished

Missing is not zero. A resource with no recent point has no series: missing data is never reported as zero. A ready-made Grafana dashboard is not yet available.

Identity, email and AI

Your providers, your keys, your servers

Sign-in, notifications and AI run through services you already own. Nothing goes through NotionAce.

OIDC single sign-on

PKCE, with signatures checked against the provider's published keys
Group-to-role mappings with an optional entity, and auto-provisioning
A user with no mapped role is refused

Not yet: SAML.

Your own mail server Built

OCI Email Delivery, Microsoft 365, Amazon SES or your own SMTP server
"Send a test email" shows the server's real answer, plus a delivery log
Each message sent once, retried up to 5 times while the server is down, kept 30 days

Bring your own AI

OCI Generative AI in any subscribed region
Or your own Anthropic API key
Off until an admin enables it, with a daily token ceiling. No silent fallback

OCI Email DeliveryNotifications sent from your tenancy

Microsoft 365SMTP relay for notifications

Amazon SESSMTP relay for notifications

AnthropicYour own API key for Ask VIREOPS

CMDB export

Take the inventory with you

Export the inventory to CSV for your CMDB or a spreadsheet. The export escapes formula cells so it is safe to open, and every export is audited.

One click from the Inventory screen: "Export CMDB (CSV)"
Measured on our demo estate: about one second for a full export
Executive reports add frozen, branded A4 PDFs on demand or on a schedule

Inventory with the Export CMDB (CSV) button

Integration questions

Does a Prometheus scrape call OCI or AWS?

No. Every value is a gauge from the VIREOPS database. A scrape never calls the cloud and never runs AI.

Can my scraper sit behind the demo front-door password?

A scraper cannot send both that password and the bearer token. Scrape from inside the network, or without the front door.

Does VIREOPS change anything in my cloud while collecting?

Collection is read-only. Cloud actions are separate, need their own opt-in OCI policy, are started by a person and never delete, terminate or detach anything.

Which permissions does the OCI connection need?

The connection wizard generates a least-privilege policy and tests it live, showing exactly which permissions are missing. Some features need an extra narrow grant: read vss-family for vulnerabilities, read opsi-family for top SQL, read log-content for service and custom logs, and a grant for NSG rules.

Connects to your clouds. Plugs into your stack.