---
name: cloud-logs-extensions-mongodb
title: MongoDB extension
description: In IBM Cloud Logs, you can use the MongoDB extension to gain security insights using the logs that are generated in an IBM Cloud account.
last-updated: 2025-11-13
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/cloud-logs?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# MongoDB extension
{: #extensions-mongodb}

In IBM Cloud Logs, you can use the MongoDB extension to gain security insights using the logs that are generated in an IBM Cloud account.
{: shortdesc}

MongoDB is a source-available, cross-platform, document-oriented database program. Classified as a NoSQL database product, MongoDB utilizes JSON-like documents with optional schemas.

## What this extension deploys
{: #extensions-mongodb-deploys}

This extension includes one or more items.

| Includes | Number |
|----------|--------|
| [Alerts](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-alerts&format=markdown) | 8 |
| [Dashboards](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-about_dashboards&format=markdown) | 5 |
| [Enrichments](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-enriching-data&format=markdown) | 0 |
| [Events to metrics](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-configure-event2metrics&format=markdown) | 5 |
| [Rules](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-log_parsing_rules&format=markdown) | 1 |
| [Views](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-custom_views&format=markdown) | 0  |
{: caption="Items included when extension is deployed" caption-side="bottom"}

Before deploying this extension, make sure that deploying the extension will not cause you to exceed [limits for your IBM Cloud Logs instance](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-limits&format=markdown). If deploying the extension results in limits being exceeded, the deployment will fail.
{: tip}

## Deploying the extension
{: #extensions-mongodb-deploy}

You can deploy this extension in any IBM Cloud Logs instance that collects MongoDB logs. The MongoDB extension includes security alerts and custom dashboards that provide insights into various components of MongoDB.

For more information about deploying the extension, see [Deploying, managing, and removing IBM Cloud Logs extensions](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-extensions-mgmt&format=markdown).


After deploying, verify that the extension configuration handles data in a way that matches your IBM Cloud Logs instance TCO configuration. Alerts, dashboards, and events to metrics are features available for data handled through the Analyze and alert and the Priority insights data pipelines. After you deploy the extension, make sure the configuration meets your needs. For example, if you have [TCO policies](https://cloud.ibm.com/docs/cloud-logs?topic=cloud-logs-tco-optimizer&format=markdown) sending data to the Analyze and alert pipeline, you will need to change the dashboard configured by this extension to use **Analyze and Alert** data instead of **Priority insights**.
{: note}


## Dashboard
{: #extensions-mongodb-dashboards}

Five dashboards are provided providing data about MongoDB logs.

### MongoDB - Client Metadata Overview
{: #extensions-mongodb-db1}

This dashboard provides an overview of MongoDB client metadata. The dashboard includes:

* Client metadata connections over time by context
* Total unique client metadata connections
* Latest activity
* Top source IPs
* Source country distribution
* Top application names
* Driver names and versions
* Platform distribution
* OS architecture distribution


### MongoDB - Access Overview
{: #extensions-mongodb-db2}

This dashboard provides an overview of the access component, authentication, and authorization activity in MongoDB. The dashboard includes:

* Access activity over time by message
* Successful authentication
* Failed authentication
* Failed authorization
* Authentication DB distribution
* Authentication mechanism distribution
* Speculative authentication status distribution
* Latest successful authentication events
* Latest failed authentication events

### MongoDB - General Overview
{: #extensions-mongodb-db3}

This dashboard provides a general overview of MongoDB activity over all components. This dashboard includes:

* Events by components
* Last activity
* Top-10 messages
* Top source IPs
* Distribution of source countries
* Distribution of events per component

### MongoDB - Network Overview
{: #extensions-mongodb-db4}

This dashboard provides an overview of network component activity. The dashboard includes:

* Network events over time
* Connection count over time
* Connection count
* Source country distribution
* Latest activity
* Top source IPs
* Top-10 messages


### MongoDB - Other Components Overview
{: #extensions-mongodb-db5}

This dashboard provides an overview of the `SHARDING`, `STORAGE`, and `CONTROL` MongoDB components. The dashboard includes:

* Events over time by component
* `SHARDING` events by context
* Last `SHARDING` messages
* Top `SHARDING` messages
* `STORAGE` events by context
* Last `STORAGE` messages
* Top `STORAGE` messages
* `CONTROL` events by context
* Last `CONTROL` messages
* Top `CONTROL` messages

## Alerts
{: #extensions-mongodb-alerts}

You can deploy any of the following alerts:

* `MongoDB - Possible Brute Force Detected`: This alert will trigger when receiving a MongoDB `ACCESS` log indicating a series of failed authentication attempts originating from different users in a short period of time.

* `MongoDB - Authentication Succeeded for Same User from different IPs`: This alert will trigger when receiving a MongoDB `ACCESS` log indicating a successful authentication was made for the same user from different IP in a short period of time (impossible traveler scenario).

* `MongoDB - Authentication Succeeded from Public IP`: This alert will trigger when receiving a MongoDB `ACCESS` log indicating a successful authentication being made from a public IP.

* `MongoDB - Authentication Failed`: This alert will trigger when a MongoDB `ACCESS` log indicating a failed authentication attempt is receive.

* `MongoDB - Checking Authorization Failed`: This alert will trigger when a MongoDB `ACCESS` log indicating a that an authorization check failed is detected.

* `MongoDB - Fatal Event Detected`: This alert will trigger when a MongoDB log with a `Severity level` of `Fatal` is detected. See the [MongoDB documentation](https://www.mongodb.com/docs/manual/reference/log-messages/#std-label-log-severity-levels){: external} for information about the MongoDB log severity levels.

* `MongoDB - Error Event Detected`: This alert will trigger when a MongoDB log with a `Severity level` of `Error` is detected. See the [MongoDB documentation](https://www.mongodb.com/docs/manual/reference/log-messages/#std-label-log-severity-levels){: external} for information about the MongoDB log severity levels.

* `MongoDB - Warning Event Detected`: This alert will trigger when a MongoDB log with a `Severity level` of `Warning` is detected. See the [MongoDB documentation](https://www.mongodb.com/docs/manual/reference/log-messages/#std-label-log-severity-levels){: external} for information about the MongoDB log severity levels.

## Rules
{: #extensions-mongodb-rules}

One rule is provided to extract IP and port information from the log message.

## Events to metrics
{: #extensions-mongodb-e2m}

You can deploy any of the following events to metrics configurations. For details about the created metrics, see the events to metrics definitions.

These events to metrics configurations are used by the extension dashboards. If a dashboard is missing data, make sure the event to metrics configuration is deployed and working correctly for your environment.

* `MongoDB_Access_Metrics`
* `MongoDB_General_Metrics`
* `MongoDB_Client_Metadata_Metrics`
* `MongoDB_Network_Metrics`
* `MongoDB_Other_Component_Metrics`