In the last few weeks, we have seen a noticeable increase in our WPM generated alerts. As far as I can tell by looking at the screenshot errors and waterfall events, this is being caused by timeouts when trying to communicate with URLs from tracking pixels / analytics probes. Our latest one was due to a critical website we monitor starting to have linkedin related tracking pixels.
In our environment, Orion has an outbound NAT restriction in place as fallout from the Sunburst incident. When we originally set it up, all of Orion's interfaces could talk out to the internet without restriction. I think this is the root cause of the timeouts. Over time, we are working to re-IP our Orion instance to one that cannot communicate out to the internet in any circumstance, and any WPM monitors will need to go through proxy servers.
Even after we make that change, though, we find that the analytics trackers are just a bunch of noise that don't give us much benefit. The best answer would be to remove them from the websites, but that is obviously not something we are going to convince big companies to do.
So I was wondering if there was a way to tell our WPM playback servers that if they see a given DNS entry (like google, facebook, or linkedin) that they should just 100% ignore the request or fail it quickly and load the rest of the page properly.
Does anyone have any insights into ways this might be doable?
