Auth0 insights

Elevated mfa_failure rates combined with unusual login patterns suggest attackers attempting to circumvent multi-factor authentication. This represents a sophisticated threat targeting account security beyond simple credential theft.

Auth0 Actions, Hooks, Rules, and Custom Database Connections share a tenant-wide concurrency limit. Exceeding this limit causes new requests to fail until in-flight requests complete, directly impacting authentication success rates.

Authentication API rate limits approaching capacity indicate potential service degradation or denial of service for legitimate users. Auth0 enforces token bucket-based rate limits that vary by subscription tier and endpoint, with automatic tenant disabling at critical thresholds.

Slow response times from external social identity providers (Google, Facebook, etc.) cause authentication delays that cascade through Auth0 and into application experience. External services status page may not reflect degraded performance.

Legitimate user traffic triggers attack protection mechanisms (bot detection, suspicious IP throttling, brute-force protection) causing blocked authentications and poor user experience. Security Center shows spike in detected threats without corresponding security incident.

Actions, Hooks, Rules, or Custom Database connections hit concurrency limits (250 for public cloud, varying for private) causing request failures. Long-running external API calls or lack of timeouts in extensibility code can exhaust available concurrency slots.

Authentication API requests exceed tenant rate limits causing login failures and degraded user experience. Rate limits vary by subscription tier and can be exhausted through legitimate traffic spikes, inefficient authentication flows, or attacks.

Credential Stuffing Volume Anomaly

Detect credential stuffing attacks through abnormal bursts of failed login events from single IPs, surges in total failed events, or spikes in unique source IP addresses indicating distributed botnets.

Compromised Account via TLS Fingerprint Correlation

Confirm account compromise by detecting successful logins sharing JA4 TLS fingerprints with high-volume failed login attempts, indicating the same automated tool breached an account.

Authorization Request Probing and DoS

Detect attack surface mapping, vulnerability probing, or denial-of-service attempts through surges in malformed authorization requests with invalid OAuth 2.1 parameters.

Canonical Tenant URL Security Bypass

Identify potential security control bypass or attacker reconnaissance through authentication attempts using the canonical Auth0 tenant URL instead of the configured custom domain.

MFA Push Fatigue Attack

Detect MFA push fatigue attacks where attackers flood users with rapid MFA push notifications hoping the user will approve to stop the harassment.

MFA Factor Reuse for Account Compromise

Identify potential mass account compromise through detection of a single phone number or Guardian app installation registered across multiple user accounts, indicating a single attacker controlling many accounts.

Authentication delays impact overall application performance but root cause is unclear without correlating Auth0 authentication latency with downstream application metrics and user experience. Teams troubleshoot in silos without unified observability.

Sudden increases in breached_password, brute_force, or suspicious_ip events indicate active credential-based attacks. These attacks consume rate limits and can mask legitimate authentication failures while generating high log volumes.

Authentication response time degradation often precedes or indicates broader application performance issues. Slow login_time can result from backend service dependencies in extensibility code (Rules, Actions) that also affect post-authentication application behavior.

Unusual signup volume spikes could indicate either organic growth or automated attack (credential stuffing, fake account creation). Without proper correlation, teams may misinterpret attack traffic as user growth or miss legitimate scaling needs during actual growth.

Excessive token_refresh requests indicate client-side token management issues, such as aggressive refresh logic, lack of token caching, or failure to handle token expiry properly. This consumes rate limits and can trigger throttling that affects legitimate authentication.

Authentication failure spikes indicating security or integration issues

Sudden increases in authentication failures (login, MFA, password reset) may indicate security attacks, integration misconfigurations, or provider outages. Without correlation to application performance, these appear as isolated auth service issues.

Log Stream Delivery Failure Data Gap

Failed log delivery to external analytics platforms (Datadog, Splunk, etc.) creates blind spots in security monitoring, compliance auditing, and performance analysis. Failures may go unnoticed until needed for incident investigation.

Auth0 Event Streams auto-disable after 500 consecutive failures or 5000 total failures, halting observability and potentially breaking downstream automation. Once disabled, manual redelivery is required before re-enabling, creating operational blind spots.