Auth0 suspicious IP throttling disabled
Set up the auth0 integration.
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
Goal
Detect when Auth0 suspicious IP throttling is disabled.
Strategy
This rule allows you to monitor Auth0 logs and detect when Auth0 suspicious IP throttling is disabled. Suspicious IP throttling blocks traffic from any IP address that rapidly attempts too many logins or signups. This helps protect your applications from high-velocity attacks that target multiple accounts. Disabling this feature will degrade the security posture of your application, leaving it vulnerable to credential-based attacks like brute force attacks, credential stuffing, or bulk account creation.
Triage and response
- Investigate the client id
{{@data.client_id}} to understand if this is an expected operation. - Work with your tenant administrator to identify the owner of the application.
- Speak with the owner of the application to understand if this operation is expected and approved.
- If the owner of the application is unaware of this operation:
- Disable the application credentials if possible.
- Investigate any further activity from the IP
{{@network.client.ip}} or the client id {{@data.client_id}}. - Begin your organization’s incident response process and investigate.
