Skip to main content
Your tenant logs contain useful data that you can use to build charts to look at the profile of the traffic going through your tenant. This is helpful when evaluating activity. For example, you can look for the following events to determine if you’re under attack:
  • Abnormal bursts in traffic to the login flow that result in errors (such as wrong username or password errors).
  • Abnormal bursts in traffic coming from IP locales that are not expected.
These events tend to happen without much change to the rate of successful logins. You can use your tenant log data event field to view tenant traffic data. We recommend building a daily histogram of failure events of the following types: These failure events depend on the flow you have set up with Auth0. The following example shows a credential stuffing attack on 02/13, with a large surge of events of type fu which is a failed username (typical of a credential stuffing attack).
Example traffic failure trends graph

​
Rate of errors in login flow

Look for a surge or an abnormal number of errors for incorrect username or password. For example: Do you expect >30,000 errors per hour? Here’s an example of what the data might look like.
Example graph of surge in login failures compared to normal traffic

​
Rate of attack protection events

Look for abnormally high traffic for attack protection events such as or brute-force attacks for multiple accounts. Here’s an example of what the data might look like.
Example graph of anomaly detection events

​
Number of IPs producing errors and their locations

Look for a high number of IPs from locales that do not make sense. For example: Do you expect traffic from 10,000 IPs from Russia every day? Observe ip address data in conjunction with fu event traffic to determine where the failure traffic is coming from. IP geolocation data isn’t available in the tenant logs unless you’re able to enrich it from another location. Here’s an example of what the data might look like:
Example graph of failed access attempts by region

​
Learn more