Auth0 Logs

Auth0 is an authentication platform that makes identity management easy for developers and security personnel. You can forward your Auth0 log events to Site24x7 AppLogs. This would enable you to create monitoring, alerting, and analysis dashboards under one console.

Read on to integrate Site24x7 AppLogs with Auth0. 

Create a Log Type:

1. Log in to your Site24x7 account > Admin > AppLogs > Add Log Type.
2. Enter a Display Name.
3. Choose Auth0 from the Log Type drop-down.
   
   
4. Enter the retention period and maximum upload limit.
5. By default, this is the log pattern identified for Auth0 logs by Site24x7 AppLogs.
   • Log Pattern:

     json $data.date as DateTime:date:yyyy-MM-dd'T'HH:mm:ss.SSS'Z'$ $data.log_id as LogId$ $data.user_id as UserIid$ $data.ip as IP:ip$ $data.type as EventType$ $data.client_name as ClientName$ $data.client_id as ClientId$ $data.user_agent as UserAgent$ $data.connection as Connection$ $data.details as Details:json-object$ $data.hostname as HostName$

   • Sample Logs:

     { "log_id": "1237126387234243736127863811231231", "data": { "date": "2021-06-21T02:20:18.473Z", "type": "scoa", "connection": "TESTPROD", "connection_id": "test_VNAyqE7c5q0CCVWf", "client_id": "asdasdytyua123123asd", "client_name": "zylker.com", "ip": "149.129.19.101", "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36", "details": { "prompts": [ { "name": "coverify", "session": true, "stats": { "loginsCount": 26 }, "connection": "TESTPROD", "timers": { "rules": 16 }, "elapsedTime": null } ], "completedAt": 16111923318471, "elapsedTime": null, "stats": { "loginsCount": 26 } }, "hostname": "zylker.auth0.com", "user_id": "ad|TESTPROD|f9167b96-212c-4a99-76f5-1e465ecd6214", "user_name": "[email protected]", "strategy": "ad", "strategy_type": "enterprise", "auth0_client": { "name": "lock.js", "version": "11.6.1", "lib_version": "9.5.1" }, "log_id": "1237126387234243736127863811231231" }}

6. Copy the API endpoint URL given below as shown in the screenshot.
   
7. Click Save.

Integrate Site24x7 AppLogs with Auth0:

1. Log in to your Auth0 account > Dashboard.
2. Navigate to Monitoring > Streams.
3. Click Create Log Stream.
   
   
4. Click Custom Webhook.
   
   
5. Enter a Name.
   
   
6. Click Create.
7. Enter the API link copied from the Site24x7 console in the Payload URL field.
8. Select application/json in the Content Type field.
9. Choose JSON Lines as the content format.
10. Click Save.
    
    

View Data:

To view Auth0 logs, 

1. Login to your Site24x7 account > AppLogs
2. Enter the logtype as Auth0

The following metrics can be viewed in the dashboard for Auth0 logs:

• Successful Logons
• Failed Logons
• Failed CROS Authentication
• Failed Device Authorization
• Failed MFA
• Blocked IP
• Blocked Account
• Breached password
• Top 10 Events
• Login Trend
• Traffic Failure Trend
• MFA Stats
• Attack Protection Events
• IP's with Most Login Failures