You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: main/docs/secure/security-center.mdx
+8-18Lines changed: 8 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,7 +10,7 @@ title: Security Center
10
10
'twitter:description': Learn about Security Center, which provides observability tools
11
11
that empower you to see potential attack trends and quickly respond to them in real-time.
12
12
'twitter:title': Security Center
13
-
---
13
+
---
14
14
Security Center provides observability tools that allow you to see potential attack trends and quickly respond to them in real-time. Security Center provides real-time monitoring that allows you to observe your own Customer Identity and Access Management (CIAM) anomaly detection metrics, and lets you configure attack mitigation features from within the same space.
15
15
16
16
## Real-time monitoring
@@ -27,13 +27,11 @@ Security Center provides you with an overview of your tenant’s security pulse
27
27
28
28
Security Center allows you to filter available data to your needs.
29
29
30
-
You can filter data based on a time period, including:
30
+
You can filter data based on the following fields:
31
31
32
-
* Last hour
33
-
* Last 12 hours
34
-
* Last day
35
-
* Last 7 days
36
-
* Last 14 days
32
+
* Time period (up to the last 14 days)
33
+
* Applications
34
+
* Connections
37
35
38
36
Depending on the time period you select, the data is automatically aggregated per minute, per hour, or per day.
39
37
@@ -73,46 +71,38 @@ We will identify patterns that are usually an indicator of known attack types an
73
71
74
72
</Callout>
75
73
74
+
<Frame></Frame>
75
+
76
76
#### Bot detection
77
77
78
78
<Tooltip tip="Bot Detection: Form of attack protection in which Auth0 blocks suspected bot traffic by enabling a CAPTCHA during the login process." cta="View Glossary" href="/docs/glossary?term=Bot+detection">Bot detection</Tooltip> mitigates scripted attacks by detecting when a request is likely to be coming from a bot. Bot detection includes the number of bots detected over the last seven days.
79
79
80
-
<Frame></Frame>
81
-
82
80
To learn more about this feature, read [Bot Detection](/docs/secure/attack-protection/bot-detection).
83
81
84
82
#### Suspicious IP throttling
85
83
86
84
<Tooltip tip="Suspicious IP Throttling: Form of attack protection that protects your tenant against suspicious logins targeting too many accounts from a single IP address." cta="View Glossary" href="/docs/glossary?term=Suspicious+IP+throttling">Suspicious IP throttling</Tooltip> blocks traffic from any IP address that rapidly attempts too many logins or signups. Suspicious IP throttling includes the number of suspicious IPs blocked over the last seven days.
87
85
88
-
<Frame></Frame>
89
-
90
86
To learn more about this feature, read [Suspicious IP Throttling](/docs/secure/attack-protection/suspicious-ip-throttling).
91
87
92
88
#### Brute-force protection
93
89
94
90
<Tooltip tip="Brute-force Protection: Form of attack protection that safeguards against brute-force attacks that occur from a single IP address and target a single user account." cta="View Glossary" href="/docs/glossary?term=Brute-force+protection">Brute-force protection</Tooltip> safeguards against a single IP address attacking a single user account. Brute-force protection includes the number of blocked brute-force attempts over the last seven days.
95
91
96
-
<Frame></Frame>
97
-
98
92
To learn more about this feature, read [Brute-Force Protection](/docs/secure/attack-protection/brute-force-protection).
99
93
100
94
#### Breached password detection
101
95
102
96
<Tooltip tip="Breached Password Detection: Form of attack protection in which Auth0 notifies your users if they use a username/password combination that has been compromised in a data leak on a third-party website or app." cta="View Glossary" href="/docs/glossary?term=Breached+password+detection">Breached password detection</Tooltip> protects your applications from <Tooltip tip="Breached Password Detection: Form of attack protection in which Auth0 notifies your users if they use a username/password combination that has been compromised in a data leak on a third-party website or app." cta="View Glossary" href="/docs/glossary?term=bad+actors">bad actors</Tooltip> signing up or logging in with stolen credentials. Breached password detection includes the number of breached credentials detected in login and signup flows over the last seven days.
103
97
104
-
<Frame></Frame>
105
-
106
98
To learn more about this feature, read [Breached Password Detection](/docs/secure/attack-protection/breached-password-detection).
107
99
108
100
#### Multi-factor authentication
109
101
110
102
Multi-factor authentication (MFA) verifies users by requiring more than one type of user validation. MFA includes the number of MFA challenges detected and the number of MFA challenges passed or failed over the last seven days.
111
103
112
-
<Frame></Frame>
113
-
114
104
To learn more about this feature, read [Multi-Factor Authentication](/docs/secure/multi-factor-authentication).
Copy file name to clipboardExpand all lines: main/docs/secure/security-center/metrics.mdx
+2-44Lines changed: 2 additions & 44 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,56 +10,14 @@ title: Metrics
10
10
that are usually an indicator of known attack types.
11
11
'twitter:title': Metrics
12
12
---
13
-
Security Center uses tenant log events to identify patterns that are usually an indicator of known attack types. We classify tenant log event patterns into categories: normal traffic, credential stuffing threats, signup attack threats, and <Tooltiptip="Multi-factor authentication (MFA): User authentication process that uses a factor in addition to username and password such as a code via SMS."cta="View Glossary"href="/docs/glossary?term=MFA">MFA</Tooltip> bypass threats.
13
+
Security Center uses tenant log events to identify patterns that are usually an indicator of known attack types. We classify tenant log event patterns into categories: credential stuffing threats, signup attack threats, and <Tooltiptip="Multi-factor authentication (MFA): User authentication process that uses a factor in addition to username and password such as a code via SMS."cta="View Glossary"href="/docs/glossary?term=MFA">MFA</Tooltip> bypass threats.
14
14
15
15
<Warning>
16
16
17
17
Classification of event type codes may change. Avoid implementing solutions dependent on the current log event code definitions.
18
18
19
19
</Warning>
20
20
21
-
## Normal traffic
22
-
23
-
We use normal traffic to establish a benchmark against different threat types we may observe. Normal traffic includes all successful and failed events for a given hour, which includes the following event codes:
24
-
25
-
<tableclass="table"><thead>
26
-
<tr>
27
-
<th>Event code</th>
28
-
<th>Event</th>
29
-
</tr>
30
-
</thead>
31
-
<tbody>
32
-
<tr>
33
-
<td><code>s</code></td>
34
-
<td>Successful login</td>
35
-
</tr>
36
-
<tr>
37
-
<td><code>ss</code></td>
38
-
<td>Successful signup</td>
39
-
</tr>
40
-
<tr>
41
-
<td><code>sepft</code></td>
42
-
<td>Successful exchange of password for access token</td>
43
-
</tr>
44
-
<tr>
45
-
<td><code>f</code></td>
46
-
<td>Failed user login</td>
47
-
</tr>
48
-
<tr>
49
-
<td><code>fu</code></td>
50
-
<td>Failed user login due to invalid username</td>
51
-
</tr>
52
-
<tr>
53
-
<td><code>fp</code></td>
54
-
<td>Failed user login due to invalid password</td>
55
-
</tr>
56
-
<tr>
57
-
<td><code>pwd_leak</code></td>
58
-
<td>Attempted login with a leaked password</td>
59
-
</tr>
60
-
</tbody>
61
-
</table>
62
-
63
21
## Credential stuffing
64
22
65
23
We identify credential stuffing threats within a single hour with the following event codes:
@@ -172,4 +130,4 @@ We identify MFA bypass threats within a single hour with the following event cod
Thresholds are calculated on a weighted moving average for a given metric and are customizable in your <Tooltiptip="Auth0 Dashboard: Auth0's main product to configure your services."cta="View Glossary"href="/docs/glossary?term=Auth0+Dashboard">Auth0 Dashboard</Tooltip>. Each defined threshold is viewable on your threat monitor metric charts and aggregated on an hourly basis; if no recovery threshold is configured, the recovery default to just below the set warning or alert threshold.
40
40
41
+
<Warning>
42
+
43
+
Thresholds apply to the original metric without filters. When filters are applied, the original threshold and filtered trend lines are visible.
44
+
45
+
</Warning>
46
+
41
47
<Frame></Frame>
42
48
43
49
1. Go to [**Security > Security Center > Threat Monitoring**](https://manage.auth0.com/#/security/center/bot-detection) and choose a metric chart.
@@ -57,8 +63,6 @@ Thresholds are calculated on a weighted moving average for a given metric and ar
57
63
58
64
Thresholds can also be updated or removed in the expand view screen. Different thresholds on the same chart are behind the Threshold label carrot at the top right.
59
65
60
-
<Frame></Frame>
61
-
62
66
#### Manage notification destinations
63
67
64
68
Notification destinations are endpoints to which alert, warning, and recovery notices are delivered. Each tenant is limited to two destination endpoints, and a third-party webhook editor is recommended to personalize the notification's message.
0 commit comments