56 results available
Sign in
Skills directory

app-observability

grafana

·

Last changed
Hardened

This skill has been hardened by Chainguard

Last changed

This version passed the hardening gate. Hardening updated the skill content and independently checked the resulting changes. Classified findings before hardening: 17. Classified findings closed: 3. Classified findings remaining: 14. Unclassified scanner findings remaining: 0. Review findings closed: 0. Review findings remaining: 25.


Open before hardening

1

High

9

Medium

7

Low
Open after hardening

9

Medium

5

Low

Expand
File
Group
Subtype
Severity
Status
references/frontend-observability.md

Prompt Injection

Direct prompt injection

High
Closed
references/apm-setup.md

Supply Chain & Install-Time Trust

Install-time download and execute

Medium
Open
references/apm-setup.md

Sensitive Data & Secret Exposure

Hardcoded secret

Medium
Open
SKILL.md

Sensitive Data & Secret Exposure

Hardcoded secret

Medium
Open
references/apm-setup.md

Supply Chain & Install-Time Trust

—

Medium
Open
references/apm-setup.md

Privilege Escalation & Host / Cloud Compromise

Privilege escalation

Medium
Open
references/frontend-observability.md

Sensitive Data & Secret Exposure

Hardcoded secret

Medium
Open
references/apm-setup.md

Malicious Code & Command Execution

—

Medium
Open

17 findings


SKILL.md

Grafana Cloud Application Observability

Three products that share the same OTLP + Mimir / Loki / Tempo / Pyroscope plumbing:

  1. Application Observability — APM from OTel spanmetrics
  2. Frontend Observability — Faro Web SDK, RUM + session replay
  3. AI Observability — LLM / vector-DB monitoring via OpenLIT

Prerequisites

  • Grafana Cloud stack + OTLP endpoint + numeric instance ID + API key with MetricsPublisher + LogsPublisher + TracesPublisher
  • For APM: app instrumented with OTel SDK; for Frontend: a web app + Faro app key; for AI: Python ≥ 3.10
  • Grafana Alloy as the local OTLP receiver (recommended)

Common Workflows

1. Stand up APM — Alloy receiver → Grafana Cloud + verify

# 1. Set Cloud creds + start Alloy with config from references/apm.md
export GRAFANA_CLOUD_OTLP_ENDPOINT=https://otlp-gateway-prod-us-east-0.grafana.net/otlp
export GRAFANA_CLOUD_INSTANCE_ID=123456
export GRAFANA_CLOUD_API_KEY=glc_eyJ...
alloy fmt /etc/alloy/config.alloy   # syntax check
alloy run /etc/alloy/config.alloy

# 2. Verify Alloy is receiving + forwarding
curl -s http://localhost:12345/api/v0/web/components \
  | jq '.[] | select(.id|test("otelcol\\.exporter\\.otlphttp"))
        | {id, health:.health.state}'
# Expect health.state == "healthy"
curl -s http://localhost:12345/metrics \
  | grep -E 'otelcol_(receiver_accepted_spans|exporter_sent_spans)'

# 3. Point your app at Alloy (with required attributes!)
export OTEL_SERVICE_NAME="my-api"
export OTEL_RESOURCE_ATTRIBUTES="service.namespace=myteam,deployment.environment=production"
export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
export OTEL_EXPORTER_OTLP_PROTOCOL=grpc

# 4. Verify spans landed in Tempo + spanmetrics generated
#    Tempo (TraceQL):  { resource.service.name = "my-api" }
#    Mimir (PromQL):   sum by (job) (rate(traces_spanmetrics_calls_total{service_name="my-api"}[5m]))
#    Expect > 0 within ~1 minute.

# 5. Verify it's wired to App Observability
#    Grafana → Application → Service Inventory: "my-api" should appear with RED metrics
#    Click into it → Service Map edges visible (requires span.kind on outbound calls)

Full Alloy block + required resource attributes + spanmetric names + correlation links: references/apm.md.

2. Instrument a React frontend with Faro

# 1. Install
npm install @grafana/faro-react @grafana/faro-web-tracing
// 2. initializeFaro with TracingInstrumentation + ReactIntegration (see references/faro.md)
//    Push a smoketest event so we have a known signal:
faro.api.pushEvent('faro_smoketest', { ts: Date.now().toString() });
# 3. Verify in DevTools Network — POST to /collect returns 202
#    (401 → wrong app key; 404 → wrong url region)

# 4. Verify in Grafana Cloud
#    - Frontend Observability → your app → Sessions: your session appears
#    - LogQL on Loki: {kind="event"} |= "faro_smoketest"
#    - With TracingInstrumentation: open the session → the trace ID links to Tempo

Full React example, CDN setup, session config: references/faro.md.

3. Add AI / LLM observability

pip install openlit==1.42.0
# At app startup
import openlit
openlit.init(application_name="my-ai-app", environment="production")
# Your existing OpenAI / Anthropic / Cohere calls now emit OTel spans + metrics.
# Env (same OTLP endpoint as APM)
export OTEL_SERVICE_NAME="my-ai-app"
export OTEL_EXPORTER_OTLP_ENDPOINT="https://otlp-gateway-<region>.grafana.net/otlp"
export OTEL_EXPORTER_OTLP_HEADERS="Authorization=Basic $(echo -n $ID:$KEY | base64)"

# Verify after a few LLM calls:
#   PromQL: sum by (gen_ai_request_model) (rate(gen_ai_usage_input_tokens_total[5m]))
#   Dashboard: Grafana → AI Observability → "GenAI Observability" auto-populates

Full OpenLIT install, evals/guards, GenAI metric list, dashboard names: references/ai-observability.md.

Full-stack correlation cheat sheet

SignalProductStorageQuery

RED metrics

App Observability

Mimir

PromQL

Traces

Tempo

Tempo

TraceQL

Logs

Loki

Loki

LogQL

Profiles

Pyroscope

Pyroscope

ProfileQL

Browser RUM

Frontend Observability

Loki + Tempo

LogQL / TraceQL

LLM metrics

AI Observability

Mimir

PromQL

Correlation keys: service.name joins all signals; trace exemplars embed trace IDs in metric points; traceID in logs and traceparent injected by Faro for FE → BE linking.

Troubleshooting

  • Service missing from Service Inventory → missing service.namespace (job label) or deployment.environment resource attribute
  • Service Map edges missing → span.kind not set on outbound calls (must be CLIENT) or inbound (SERVER)
  • Faro /collect returns 401 → wrong app key; 404 → region in URL doesn't match the Faro app
  • No GenAI metrics → confirm OpenLIT version matches OTel semantic-conv version expected by Cloud; verify auth with curl as in workflow #3

References

Resources

Install

Install with chainctl
chainctl skill install public/grafana/app-observability:latest
Get started with chainctl
View source

Harden your own skills

Bring Chainguard's hardening pipeline to your first-party skills — custom rulesets, automated remediation, full audit trail.

Provenance

Upstream sourcehttps://github.com/grafana/skills
Upstream commitb58376284141433f0676ae47ad651955802a922b
OCI reference

skills.cgr.dev/public/github.com/grafana/skills/grafana-cloud/app-observability:latest

License

Apache-2.0

Files

HARDENING.md

LICENSE

SKILL.md

references/ai-observability.md

references/apm-setup.md

references/apm.md

references/faro.md

references/frontend-observability.md


The trusted source for open source

Talk to an expert
PrivacyTerms

Product

Chainguard ContainersChainguard LibrariesChainguard VMsChainguard OS PackagesChainguard ActionsChainguard Agent SkillsIntegrationsPricing
© 2026 Chainguard, Inc. All Rights Reserved.
Chainguard® and the Chainguard logo are registered trademarks of Chainguard, Inc. in the United States and/or other countries.
The other respective trademarks mentioned on this page are owned by the respective companies and use of them does not imply any affiliation or endorsement.