Hub rules-prometheus

rules-prometheus

v3 public Verified

Prometheus

Prometheus is an open-source monitoring and alerting toolkit originally built at SoundCloud. These rules govern metrics collection, PromQL query optimization, and system observability for AI agents.

@sigmashakeinc 2 pulls 5 rules published Apr 8, 2026 synced Oct 11, 2026 sigmashakeinc/rules/rulesets/rules-prometheus →
Severity
2 error 3 warn 0 info
demo.cast
Prometheus is an open-source monitoring and alerting toolkit originally built at SoundCloud. These rules govern metrics collection, PromQL query optimization, and system observability for AI agents.

Rules index

5 governance rules

Indexed from the repository's .rules files, grouped by technology. Expand any rule to read the raw source.

prometheus

no-prometheus-admin-api-enabled warning log

The Prometheus admin API (--web.enable-admin-api) exposes /api/v1/admin/tsdb/delete_series, /clean_tombstones, and snapshot endpoints. Without network-level authentication an attacker can permanently delete time-series data. Protect with a reverse proxy that requires authentication before enabling this flag.

Rule source requires an active Pro or Enterprise subscription.
no-prometheus-hardcoded-bearer error block

Hardcoded bearer_token in a Prometheus scrape config or remote_write block commits a live credential to VCS. Use bearer_token_file pointing to a file outside the repository, or inject the value via an environment variable reference.

Rule source requires an active Pro or Enterprise subscription.
no-prometheus-hardcoded-password error block

Plaintext password in a Prometheus configuration file will be committed to VCS. Use password_file pointing to a secrets file that is git-ignored, or inject via environment variable substitution.

Rule source requires an active Pro or Enterprise subscription.
no-prometheus-lifecycle-api-enabled warning log

The Prometheus lifecycle API (--web.enable-lifecycle) exposes unauthenticated /-/reload and /-/quit HTTP endpoints. Anyone who can reach the Prometheus port can reload configuration or shut down the process. Enable only behind an authenticated reverse proxy.

Rule source requires an active Pro or Enterprise subscription.
prometheus-remote-write-no-auth warning log

remote_write ships all scraped metrics to an external endpoint. Confirm the URL is your own infrastructure, the connection uses TLS (url: https://...), and credentials are loaded from a file reference or environment variable rather than inlined plaintext.

Rule source requires an active Pro or Enterprise subscription.

Version metadata

Published metadata

The hash-locked record of this published ruleset. When source contents change, the maintainer resyncs and the version bumps.

Version
v3
Published
Apr 8, 2026
Source commits
0
Synced
Oct 11, 2026
Hash
33b9ed212ca095d8988a0df30f088320ee5d781dd0906a0a226acf5c1839dc03
Signature
Verified (publisher key)
Tested with
claude-code@current
Plan
Starter (free)
Visibility
Public

Source history

Recent commits

Latest commits touching rulesets/rules-prometheus/.sigmashake/rules in sigmashakeinc/rules/rulesets/rules-prometheus. The published version only bumps when a maintainer resyncs.

No commit history available.