Monitoring OpenBAS with Vigilmon

OpenBAS is an open source breach and attack simulation (BAS) platform developed by Filigran — the same team behind OpenCTI. It lets security teams continuously run automated, MITRE ATT&CK-mapped attack simulations against their own infrastructure to validate that SIEM rules, EDR alerts, and IR playbooks actually fire when they should. When you self-host OpenBAS, you're running a Java Spring Boot server, a PostgreSQL database, and a collection of injectors that reach out to target systems to execute simulated attack techniques. Any component failing silently means your scheduled simulations stop running — and you lose visibility into whether your security controls are actually working. Vigilmon monitors every layer of the OpenBAS stack: server availability, database connectivity, injector health, and simulation execution rates.

What You'll Set Up

OpenBAS server HTTP health monitor
PostgreSQL connectivity check via heartbeat
Injector health monitors per injector type
Simulation completion rate heartbeat
Report generation health check
API response time monitoring
Alert channels for the security operations team

Prerequisites

OpenBAS self-hosted instance running (OpenBAS 1.x or later)
OpenBAS web API accessible (default port 8080 or via reverse proxy)
PostgreSQL database accessible from monitoring host
A free Vigilmon account

Step 1: Monitor the OpenBAS Server

OpenBAS exposes a Spring Boot Actuator health endpoint at /api/health. This endpoint checks internal application state including database connectivity — a 200 response confirms the BAS orchestration engine is fully operational.

Log in to vigilmon.online and click Add Monitor.
Set Type to HTTP / HTTPS.
URL: https://openbas.yourdomain.com/api/health (or http://your-server-ip:8080/api/health).
Set Check interval to 1 minute.
Set Expected HTTP status to 200.
Under Keyword check, enter UP to verify the Spring Boot actuator reports the application as up, not just that the port is open.
Enable Monitor SSL certificate and set the expiry alert to 21 days if you're running HTTPS.
Click Save.

If the /api/health endpoint requires authentication in your deployment, use the root API endpoint instead:

URL: https://openbas.yourdomain.com/api/
Expected status: 200

Step 2: Monitor PostgreSQL Connectivity

OpenBAS stores all simulation scenarios, exercise results, and historical reporting data in PostgreSQL. A database failure stops simulation scheduling, result collection, and report generation simultaneously.

On the OpenBAS host (or a host with access to the PostgreSQL port), create a health-check script:

#!/bin/bash
# /usr/local/bin/openbas-db-check.sh

DB_HOST="localhost"
DB_PORT="5432"
DB_NAME="openbas"
DB_USER="openbas"
HB_URL="https://hb.vigilmon.online/YOUR_DB_HB_ID"

# Test connectivity and a simple query
RESULT=$(PGPASSWORD="${OPENBAS_DB_PASSWORD}" psql \
  -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER" -d "$DB_NAME" \
  -c "SELECT 1;" -t 2>/dev/null | tr -d ' ')

if [ "$RESULT" = "1" ]; then
  curl -fsS --retry 3 "$HB_URL" > /dev/null 2>&1
fi

Store the database password in an environment variable or /etc/openbas-monitor.env (chmod 600, readable only by root). Create a heartbeat monitor in Vigilmon named OpenBAS PostgreSQL with a 60-second interval and schedule the script:

* * * * * root . /etc/openbas-monitor.env && /usr/local/bin/openbas-db-check.sh

Step 3: Monitor Active Simulation Execution

OpenBAS schedules and executes breach and attack simulations on a defined schedule. Simulations stuck in a running state past their expected duration indicate an injector hang or orchestration bug — and no new results are being collected.

Use the OpenBAS API to check for stuck simulations:

#!/bin/bash
# /usr/local/bin/openbas-sim-check.sh

OPENBAS_API="https://openbas.yourdomain.com/api"
API_TOKEN="YOUR_OPENBAS_API_TOKEN"
MAX_STUCK_HOURS=2  # alert if simulation has been running longer than 2 hours
HB_URL="https://hb.vigilmon.online/YOUR_SIM_HB_ID"

# Get currently running exercises
RUNNING=$(curl -fsS \
  -H "Authorization: Bearer $API_TOKEN" \
  -H "Content-Type: application/json" \
  "${OPENBAS_API}/exercises?status=RUNNING" 2>/dev/null)

if [ $? -ne 0 ]; then
  # Can't reach API — don't send heartbeat
  exit 1
fi

# Check for exercises running longer than expected
NOW=$(date +%s)
STUCK=0
while IFS= read -r START_TIME; do
  if [ -n "$START_TIME" ]; then
    START_EPOCH=$(date -d "$START_TIME" +%s 2>/dev/null || echo 0)
    HOURS_RUNNING=$(( (NOW - START_EPOCH) / 3600 ))
    if [ "$HOURS_RUNNING" -gt "$MAX_STUCK_HOURS" ]; then
      STUCK=1
      break
    fi
  fi
done < <(echo "$RUNNING" | python3 -c "
import sys, json
data = json.load(sys.stdin)
exercises = data if isinstance(data, list) else data.get('content', [])
for e in exercises:
    print(e.get('exercise_start_date', ''))
" 2>/dev/null)

if [ "$STUCK" -eq 0 ]; then
  curl -fsS --retry 3 "$HB_URL" > /dev/null 2>&1
fi

Create a heartbeat monitor OpenBAS Simulation Status with a 5-minute interval (simulations run longer than a minute by design).

Step 4: Monitor Simulation Completion Rate

Simulations that start but don't complete indicate injector failures — the simulated attack couldn't reach the target system. A completion rate below 90% over a rolling window is a strong signal that one or more injectors are broken.

#!/bin/bash
# /usr/local/bin/openbas-completion-check.sh

OPENBAS_API="https://openbas.yourdomain.com/api"
API_TOKEN="YOUR_OPENBAS_API_TOKEN"
MIN_COMPLETION_PCT=90
LOOKBACK_DAYS=7
HB_URL="https://hb.vigilmon.online/YOUR_COMPLETION_HB_ID"

# Get exercises from the past N days
SINCE=$(date -d "-${LOOKBACK_DAYS} days" --iso-8601=seconds 2>/dev/null || \
        date -v-${LOOKBACK_DAYS}d +%Y-%m-%dT%H:%M:%S 2>/dev/null)

EXERCISES=$(curl -fsS \
  -H "Authorization: Bearer $API_TOKEN" \
  "${OPENBAS_API}/exercises?start_date=${SINCE}" 2>/dev/null)

if [ $? -ne 0 ]; then
  exit 1
fi

COMPLETION_PCT=$(echo "$EXERCISES" | python3 -c "
import sys, json
data = json.load(sys.stdin)
exercises = data if isinstance(data, list) else data.get('content', [])
if not exercises:
    print(100)
    sys.exit(0)
total = len(exercises)
completed = sum(1 for e in exercises if e.get('exercise_status') in ('FINISHED', 'CANCELED'))
print(int((completed / total) * 100))
" 2>/dev/null)

if [ "${COMPLETION_PCT:-0}" -ge "$MIN_COMPLETION_PCT" ]; then
  curl -fsS --retry 3 "$HB_URL" > /dev/null 2>&1
fi

Schedule this check every 15 minutes and create a heartbeat monitor OpenBAS Completion Rate with a 15-minute interval, alerting after 2 missed.

Step 5: Monitor Injector Connectivity

Injectors are the OpenBAS components that actually execute simulated attack techniques — email injectors send phishing payloads, endpoint injectors execute commands on target machines. If an injector loses connectivity to OpenBAS, all simulations requiring that injector will silently fail.

#!/bin/bash
# /usr/local/bin/openbas-injectors-check.sh

OPENBAS_API="https://openbas.yourdomain.com/api"
API_TOKEN="YOUR_OPENBAS_API_TOKEN"
HB_URL="https://hb.vigilmon.online/YOUR_INJECTORS_HB_ID"

INJECTORS=$(curl -fsS \
  -H "Authorization: Bearer $API_TOKEN" \
  "${OPENBAS_API}/injectors" 2>/dev/null)

if [ $? -ne 0 ]; then
  exit 1
fi

ALL_HEALTHY=$(echo "$INJECTORS" | python3 -c "
import sys, json
data = json.load(sys.stdin)
injectors = data if isinstance(data, list) else data.get('content', [])
if not injectors:
    print(1)
    sys.exit(0)
all_ok = all(i.get('injector_connected', False) for i in injectors)
print(1 if all_ok else 0)
" 2>/dev/null)

if [ "${ALL_HEALTHY:-0}" -eq 1 ]; then
  curl -fsS --retry 3 "$HB_URL" > /dev/null 2>&1
fi

Create a heartbeat OpenBAS Injectors Healthy with a 2-minute interval. If any injector loses connectivity for more than 4 minutes, Vigilmon alerts.

Step 6: Monitor OpenBAS API Response Time

The OpenBAS web interface is React-based and relies entirely on the Spring Boot API. High API latency (>2 seconds at p95) makes the interface unusably slow and may indicate database query performance issues or JVM garbage collection pressure.

In Vigilmon, click Add Monitor → HTTP / HTTPS.
URL: https://openbas.yourdomain.com/api/health.
Set Check interval to 1 minute.
Under Response time threshold, set the alert threshold to 2000ms.
Set the alert to fire when response time exceeds this threshold for 3 consecutive checks.
Click Save.

Vigilmon will track response time history for this endpoint and alert if the API becomes sluggish before it becomes fully unavailable.

Step 7: Monitor Report Generation

OpenBAS generates security posture reports showing detection rates, coverage gaps, and simulation trends. Report generation failures block security teams from getting the visibility data they need — even when simulations themselves run successfully.

#!/bin/bash
# /usr/local/bin/openbas-reports-check.sh

OPENBAS_API="https://openbas.yourdomain.com/api"
API_TOKEN="YOUR_OPENBAS_API_TOKEN"
HB_URL="https://hb.vigilmon.online/YOUR_REPORTS_HB_ID"
LOOKBACK_HOURS=24

# Check that at least one report was generated in the past 24 hours
SINCE=$(date -d "-${LOOKBACK_HOURS} hours" --iso-8601=seconds 2>/dev/null || \
        date -v-${LOOKBACK_HOURS}H +%Y-%m-%dT%H:%M:%S 2>/dev/null)

REPORTS=$(curl -fsS \
  -H "Authorization: Bearer $API_TOKEN" \
  "${OPENBAS_API}/reports?created_after=${SINCE}" 2>/dev/null)

if [ $? -ne 0 ]; then
  exit 1
fi

COUNT=$(echo "$REPORTS" | python3 -c "
import sys, json
data = json.load(sys.stdin)
reports = data if isinstance(data, list) else data.get('content', [])
print(len(reports))
" 2>/dev/null)

# If simulations are running, reports should be generating
if [ "${COUNT:-0}" -gt 0 ]; then
  curl -fsS --retry 3 "$HB_URL" > /dev/null 2>&1
fi

Adjust this check based on your simulation schedule. If you run daily simulations, a 24-hour window is appropriate. Schedule it hourly and create a heartbeat OpenBAS Reports Generating with a 2-hour interval.

Step 8: Configure Alert Channels

Navigate to Settings → Alert Channels in Vigilmon and configure:

Slack — for your security operations channel. BAS platform failures mean your security posture validation is dark.
Email — for the security team lead and CISO. Missed scheduled exercises and declining detection rates need human review.
PagerDuty — only for the OpenBAS server being fully unreachable; individual injector failures are not P1 incidents.

Assign channels:

| Monitor | Channel | |---|---| | OpenBAS Server | PagerDuty + Slack | | OpenBAS PostgreSQL | PagerDuty + Slack | | OpenBAS Injectors Healthy | Slack + Email | | OpenBAS Completion Rate | Slack + Email | | OpenBAS Simulation Status | Slack | | OpenBAS API Response Time | Slack | | OpenBAS Reports Generating | Email |

Conclusion

OpenBAS is the control plane for your security validation program — if it's not running, you don't know whether your detections are working. The Vigilmon setup in this guide ensures every layer of the OpenBAS stack is covered: server health, database connectivity, injector availability, simulation completion rates, and report generation. Combined, these monitors give your security team confidence that the BAS platform is continuously executing validation exercises and that declining detection rates reflect real security gaps — not a broken simulation infrastructure.

Get started at vigilmon.online.