Monitoring

What monitoring is

Monitoring watches an organization you define: a name plus one or more domains and IP or CIDR blocks. Efflux then runs captures, surveys, permutation checks, and scans on the cadence you set, and keeps the history on the link.

Frequencies are daily, weekly, monthly, or disabled.

Create an organization

monitoring fields are capture, survey, and permutation. ip_monitoring.scan is required when you send CIDRs, and it cannot be disabled. ip_monitoring.additional_ports adds ports to that scan.

curl -sS -X POST "https://api.efflux.io/v3/monitoring/organizations" \
  -H "Authorization: Bearer $EFFLUX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Acme",
    "domains": ["example.com"],
    "monitoring": {
      "capture": "weekly",
      "survey": "weekly",
      "permutation": "monthly"
    },
    "cidrs": ["203.0.113.0/28"],
    "ip_monitoring": {
      "scan": "weekly",
      "additional_ports": ["8443"]
    }
  }'

Rename sends { "name": "Acme Holdings" }.

Domains and IPs after create

Add a domain or CIDR to an existing organization, or change its plan, with the link routes.

The single-link GET accepts include=report or include=all when you want the latest artifacts inline.

Domain link updates send monitoring and optional notifications. IP link updates send monitoring only. Notification fields match certificate monitoring, plus a tasks object (capture, survey, permutation) for which completions should notify.

History

Each domain link keeps history for the work its plan runs:

• capture/history and capture/history/{event_id}
• survey/history and survey/history/{event_id}
• permutation/history and permutation/history/{event_id}
• certificates, certificates/count, certificates/{hash}
• capture/image and capture/network-logs

Hosts observed for the organization:

Organization, domain, and IP lists default to limit 20 (max 200).