Auth0 Logs

Auth0 records every authentication event in your tenant: successful and failed logins, signups, token exchanges, password resets, MFA, blocked accounts and Management API calls. With an Auth0 Custom Webhook log stream, Auth0 pushes these events to KubeSense within seconds. They are stored with your other logs, so you can search them on the Logs page, alert on failed logins and put them next to your application logs.

Auth0 posts straight to your KubeSense endpoint. You don't need to run any relay function or extra service.

How it flows

Auth0 tenant (Monitoring > Streams > Custom Webhook)
   │  POST https://<KUBESENSE_INGEST_HOST>/auth0logs   (JSON Array, batched every few seconds)
   │  Authorization: Basic <token>
   ▼
KubeSense
   │  checks the token, turns each Auth0 event into a log
   ▼
Logs page

Events usually show up in KubeSense a few seconds after they happen in Auth0.

Before you start

You need:

• An Auth0 plan that includes log streaming. Not every Auth0 plan does. If creating the stream fails with Your current subscription plan does not support log streams, the tenant's plan has to be upgraded first.
• A dashboard admin on the Auth0 tenant, to create the stream.
• Two values from KubeSense. Ask your KubeSense contact for them. KubeSense sets up the endpoint on its side.

1. Create the log stream in Auth0

Auth0 Dashboard

1. Go to Monitoring → Streams and click Create Stream.
2. Choose Custom Webhook and give the stream a name, for example KubeSense.
3. Fill in the settings:

4. Click Save. Auth0 starts sending with the next log events in the tenant.

Auth0 CLI (alternative)

auth0 logs streams create http \
  --name "KubeSense" \
  --endpoint "https://<KUBESENSE_INGEST_HOST>/auth0logs" \
  --type "application/json" \
  --format JSONARRAY \
  --authorization "Basic <token>"

If you already have a Custom Webhook stream that sends to another destination, you can repoint it instead of creating a new one. Change its Payload URL, Authorization Token and Content Format to the values above.

Check that logs arrive

Sign in to one of your Auth0 applications, or trigger a failed login. Within a minute, the event shows up on the KubeSense Logs page with Source = auth0.

2. Name the cluster and add tags (optional)

On the Logs page, every log belongs to a cluster. Auth0 logs use your Auth0 tenant name as their cluster unless you set one. To set the cluster, the environment type or extra tags, add them to the stream's Payload URL as query parameters. Each one is optional. Each stream can use its own values, so several tenants or environments can send to the same endpoint and still be told apart.

https://<KUBESENSE_INGEST_HOST>/auth0logs?kubesense.cluster=auth0-prod&kubesense.env_type=auth0&kubesense.tags=team:iam,region:us-east-1

URL-encode values that contain spaces or &, for example %20 for a space. A change takes effect from the next batch Auth0 sends. Nothing needs to be restarted.

3. Where the logs show up

Auth0 logs appear on the Logs page next to your other logs. Filter on Source = auth0 to see only them.

Attributes

Each log carries these attributes, so you can filter, group and alert on them:

The complete Auth0 event, including details, user_agent and location_info, is kept with the log too.

Levels

Common event types

An event type that isn't in this list keeps its Auth0 code as its event_name. New Auth0 event types are still stored and searchable.

Things to try

• All failed logins: filter Source = auth0 and Level = ERROR.
• One user's activity: filter on the user_name attribute.
• Logins from an unexpected country: group by the country attribute.
• Brute-force alerts: alert when event_name = failed_login_incorrect_password exceeds a threshold for one user_name or ip. See Alerts.

4. Troubleshooting

To see Auth0's side of delivery, go to Monitoring → Streams, open the more options menu (…) of the stream and click Health. It lists the last ten delivery errors from the past five days.

Changing the token

If the token has to be changed, for example after it was shared by mistake:

1. Ask your KubeSense contact for a new token.
2. Paste the new token into the stream's Authorization Token in Auth0 and save.

Auth0 retries deliveries that fail, so events sent while the token is being changed are delivered once the new token is in place.