Skip to main content
Reviewing logs to assess the impact of an attack is a crucial step in your incident response plan. On this page you’ll see how to access logs on the and some examples of log search queries to find indicators of an attack and review account activity.

​
Check Auth0 logs

  1. Login to the Auth0 Dashboard
  2. The Logs page is located under Monitoring in the menu on the left.
  3. On the Logs page, you’ll see a search bar along with a filter selection and date picker.
Dashboard Monitoring Logs
Select a log event from the list to see a Summary of the event along with further Details including the raw JSON.

​
Log structure

Each log event has the following fields:

​
Example of failed login log event

Here is an example log event for a failed login due to an incorrect password:

​
Indicators of an attack

Identifying an attack early on may be difficult, but here are some things to look for in your logs along with example search queries:
  • High numbers of failed logins with invalid usernames or login attempts for non-existent users.
    • type:"fu"
    • description:"missing username parameter"
    • description:"Wrong email or password"
  • Large number of accounts reaching the failed login attempts limit.
    • type:"limit_wc"
  • A high number of login attempts using a leaked password.
    • type:"pwd_leak"
During your investigation take note of IP addresses, applications being targeted, and connections or used.
The Log Search Query Syntax page provides details on Auth0’s log query syntax and includes more example queries.

​
Identify compromised user accounts

To identify user accounts that may have been compromised you can search for:
  • Successful login events from a suspicious IP address:
    • type:"s" AND ip:"99.xxx.xxx.xxx"

​
Check compromised user account activity

After identifying a compromised user account you’ll want to check the account’s activity:
  • Search for other log events with the same user_id: user_id:"auth0|ABC123"
  • Check the client_name or client_id log event fields to see which applications were accessed. Make a note of when access occurred.
  • Check for administration access or Auth0 configuration changes
  • Search for recent calls: type:"sapi"

​
Delete or block users from the dashboard

  1. Go to Dashboard > User Management > Users.
  2. Search for the user to delete or block.
  3. Click the ”…” button on the far right of the user.
  4. Select Block or Delete and confirm.