FedRAMP-compliant endpoints

New Relic is FedRAMP Authorized Moderate for accounts that meet specific criteria. As a cloud service provider, we are committed to ensuring our compliance with FedRAMP's requirements for the confidentiality, integrity, and availability of your data. Please ensure that you comply with the requirements for using our FedRAMP environment, then use our FedRAMP-compliant endpoints to get your data into New Relic via your agent configuration or API.

Customer FedRAMP obligations

New Relic customers must meet all of the following requirements for our FedRAMP environment:

1. New Relic-approved customers: Our FedRAMP-Moderate authorized environment is only available for New Relic-approved customers. For more information, contact your New Relic account representative.
2. Subscription level: Customer must have a current and valid subscription for our Enterprise edition with the Data Plus option, or have an alternative New Relic-approved subscription.
3. Authorized New Relic endpoints: Customer must configure their applicable agents to send their data only to our FedRAMP-designated endpoints.
4. Authorized services and features: Customer must use only FedRAMP audited and authorized New Relic services and features.

FedRAMP inheritance

A customer can have FedRAMP and non-FedRAMP enabled accounts as required by their business needs. To add accounts, talk to your New Relic account representative.

Note: If FedRAMP is enabled on a parent account (the recommended configuration), then all its child accounts are FedRAMP. In this configuration, newly created child accounts are FedRAMP by default. FedRAMP cannot be “removed” from child accounts when the parent is FedRAMP. This option ensures compliance by default.

Overview of FedRAMP-compliant endpoints

There are multiple ways to get data into New Relic, including:

• Agent settings for our APM agents, infrastructure monitoring agent, browser monitoring agent, and mobile monitoring agent
• Data-ingest APIs for our Metric API, Event API, Log API, and Trace API, as well as the integrations that use those APIs

This document provides information on FedRAMP-compliant endpoints in New Relic. For more information about our security accreditation for the Federal Risk and Authorization Management Program (FedRAMP), see our data encryption documentation. For further information on New Relic networks, domains, and ports, see our networking documentation.

Agent and ingest API endpoints

To send FedRAMP-compliant data with our agents, integrations, and APIs, adjust their configuration settings to use the relevant FedRAMP endpoint. Below this table are some more details about implementation for specific New Relic solutions.

APM agents

To ensure FedRAMP compliance, all APM agent configurations must report to gov-collector.newrelic.com rather than the default. Depending on the agent, you can either use code-based configuration or an environment variable to enable the FedRAMP-compliant endpoint.

app, err = newrelic.NewApplication(
  newrelic.ConfigAppName("App Name"),
  newrelic.ConfigLicense(os.Getenv("NEW_RELIC_LICENSE_KEY")),
  func(cfg *newrelic.Config) {
    cfg.Host = "gov-collector.newrelic.com"
  },
)

common: &default_settings
  host: gov-collector.newrelic.com

newrelic.config.host

<service licenseKey="YOUR_LICENSE_KEY"
  host="gov-collector.newrelic.com"/>

host: 'gov-collector.newrelic.com'

newrelic.daemon.collector_host = gov-collector.newrelic.com

[newrelic]
host = gov-collector.newrelic.com

common: &default_settings
  host: gov-collector.newrelic.com

config :new_relic_agent,
  host: "gov-collector.newrelic.com"

Infrastructure monitoring

If you have infrastructure agent version 1.15.0 or higher, simply enable the FedRAMP configuration option. This enables FedRAMP compliancy for data reported by the infrastructure agent.

This also enables FedRAMP compliancy for any on-host integrations that work with the infrastructure monitoring agent to report data.

https://gov-infra-api.newrelic.com

https://gov-identity-api.newrelic.com

https://gov-infrastructure-command-api.newrelic.com

https://gov-infra-api.newrelic.com

https://gov-identity-api.newrelic.com

https://gov-infrastructure-command-api.newrelic.com

Browser monitoring agent

Browser monitoring agents will automatically update your account information to use the correct endpoints.

Mobile monitoring agents

To ensure FedRAMP compliance when using our mobile monitoring agents, all agent configurations must report to gov-mobile-collector.newrelic.com rather than the default. You must use code-based configuration. Environment variables are not available.

Framework-specific configurations:

NewRelic.withApplicationToken({APP_TOKEN})
    .usingCollectorAddress("gov-mobile-collector.newrelic.com")
    .usingCrashCollectorAddress("gov-mobile-crash.newrelic.com")
    .start(this.getApplication());

[NewRelic startWithApplicationToken:@"{APP_TOKEN}"
    andCollectorAddress:@"gov-mobile-collector.newrelic.com"
    andCrashCollectorAddress:@"gov-mobile-crash.newrelic.com"];

Data-ingest APIs

Follow these instructions as applicable to set the FedRAMP endpoint for a specific API or the integration that uses the API.

OTLP API

To ensure FedRAMP compliance when using the OpenTelemetry API, only send data to https://gov-otlp.nr-data.net with the appropriate port chosen from the OTLP integration support matrix. See that page for more details on FedRAMP compliance with OTLP.

Metric API

To ensure FedRAMP compliance when using the Metric API, do not send metric data to the default Metric API endpoint of https://metric-api.newrelic.com/metric/v1. Instead, send metric data to https://gov-metric-api.newrelic.com/metric/v1.

The Metric API can be used directly, but it's mainly used by various New Relic tools. Follow these instructions as applicable to edit the configuration for setting the FedRAMP endpoint.

Telemetry integrations for metric data

Here are instructions for our open source telemetry integrations that report metric data:

Telemetry SDKs for metric data

Here are instructions for our Telemetry SDKs that report metric data:

Event API

To ensure FedRAMP compliance for the Event API, all traffic reporting to insights-collector.newrelic.com must instead report to gov-insights-collector.newrelic.com.

The Event API endpoint is configurable for the following Telemetry SDKs. The Telemetry SDKs are used by our open-source telemetry integrations.

SenderConfiguration configuration = SenderConfiguration
  .builder(
    "gov-insights-collector.newrelic.com",
    EventBatchSender.EVENTS_PATH)
  .build();

EventBatchSender eventBatchSender = EventBatchSender.create(configuration);

event_client = EventClient(host="gov-insights-collector.newrelic.com")

Log API

To ensure FedRAMP compliance for data sent via the Log API, the solution for almost all of our log forwarders is to replace the https://log-api.newrelic.com/log/v1 endpoint with https://gov-log-api.newrelic.com/log/v1. Or, to use the Log API directly, edit the Log API endpoint configuration.

Here are details on changing the endpoint for our log forwarders. If a log forwarder is not listed, FedRAMP endpoint configuration is not available.

Trace API

To ensure FedRAMP compliance for data sent via the Trace API (including telemetry integrations that use this API), replace the https://trace-api.newrelic.com/trace/v1 endpoint with https://gov-trace-api.newrelic.com/trace/v1.

Notes about FedRAMP compliance for other trace data:

• Trace data is reported by some of our agents for APM, infrastructure monitoring, browser monitoring, and mobile monitoring. To enable FedRAMP compliance for trace data, follow the procedures for the applicable agent.
• To enable FedRAMP compliance for Infinite Tracing, create a new FedRAMP-compliant trace observer in Infinite Tracing settings.