Proactive Auth0 Security Posture via Real-Time Audit of Management API Logs

Your identity security posture is only as strong as its current configuration. Simple-to-miss, unintentional misconfigurations or intentional risky changes by a compromised or unaware admin user can instantly introduce severe vulnerabilities. The key to maintaining high defenses is immediate awareness when critical modifications occur.

We can achieve this powerful, real-time monitoring by utilizing the sapi event emitted by Auth0 Logs upon a successful Management API request focused on destructive or modifying operations.

Combining Real-Time Visibility and Static Checks

Think of this category of log detections as the perfect complement to tools like Checkmate for Auth0, which provides a snapshot of your current configuration state. While Checkmate is excellent for security reporting and guiding tenant administrators, log detections offer a real-time security detection view for continuous Auth0 Configuration Monitoring. This approach logically shortens the time to detection when your identity security posture begins to drift.

This approach does not consume your Auth0 Management API rate limits as it relies solely on the logs streamed from Auth0 to your Security Information and Event Management (SIEM) tooling, a security best practice.

Key Objectives Achieved

By implementing these detections, your security team can:

• Be Alerted in Real-Time when critical, security-related configurations are changed.
• Review Configuration State during incident triaging (for example, "Was the bot detection feature active when the signup fraud was detected?").
• Establish a Configuration Audit Trail detailing when and by whom monitored settings were altered, which is vital for compliance and post-incident review.
• Enforce Best Security Practices by providing visibility into configuration alterations made by developers or administrators.

Real-Time Detections for Critical Configurations

In this section, we provide detections covering the following areas: Attack Protection, MFA settings, and usage of the Management API.

Attack Protection

The detection attack_protection_features_turned_off.yml focuses on Suspicious IP Throttling, Breach Password Protection, and Brute-force Protection.

index=auth0 data.tenant_name="{your-tenant-name}"
data.type=sapi data.description IN ("Update Suspicious IP Throttling settings",
    "Update Breached Password Detection settings", "Update Brute-force settings")
| eval feature_type = case(
      'data.description'="Update Suspicious IP Throttling settings", 
"Suspicious IP Throttling",
      'data.description'="Update Breached Password Detection settings", 
"Breached Password Detection",
      'data.description'="Update Brute-force settings", "Brute-force"
      )

Take only the last modifications of settings for each feature

| sort -_time
| dedup feature_type
| eval status = case ('data.details.response.body.enabled' = "false", "disabled",
'data.details.response.body.enabled' = "true", "enabled")
| fields _time, status, feature_type, data.ip
``` for reporting purposes remove the "where" clause below and it will display the current status of all three protection features```
| where status = "disabled"
`Display the results printing out timestamp, modifying IP, feature reference,and its status`
| stats by _time, data.ip,feature_type, status

This detection provides a list of disabled features. Alternatively, it can be adjusted to provide the summary whether each feature is enabled or disabled based on the last modification record by commenting out the line | where status = "disabled".

![attack_protection_features_turned_off.yml](https://images.ctfassets.net/23aumh6u8s0i/5eQ6l21rHY1hjOYKjxdSkl/73b647c65d024e107eeebe9a4cf034fb/attack_protection_features_turned_off_one.png)

Three Attack protection features — Suspicious IP throttling, Bot Detection, and Brute-force Protection — have a field where a tenant administrator can provide an IP AllowList (a list of trusted IP addresses excluded from the attack protection enforcement).

![attack_protection_features_turned_off.yml](https://images.ctfassets.net/23aumh6u8s0i/6M5fFv1eBNQAeI0AQMI1Z5/fd9533f557a1616e16991aa7bcf05445/attack_protection_features_turned_off_two.png)

While this enables certain legitimate use cases, this list should be closely monitored for unrecognized or unauthorized IPs. This misconfiguration can lead to bypassing of attack protection features for malicious purposes.

The detection [unrecognized\_ip\_in\_allowlist.yml](https://github.com/auth0/auth0-customer-detections/blob/main/detections/unrecognized_ip_in_allowlist.yml) monitors this list of allowed IPs.

    index=auth0 data.tenant_name="{your-tenant-name}"
    data.type=sapi