Connect Auth0
Send an Auth0 tenant's log stream to a source with a custom webhook.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
You need admin access to the Auth0 tenant. Auth0 sends its logs through a custom webhook log stream; nothing is installed in your tenant.
1. Create the source
In ShellOrbit, Settings, Integrations, Add source, choose Auth0, and name it after the tenant. Copy the URL and the secret.
2. Create the log stream
In the Auth0 dashboard, Monitoring, Streams, Create Stream, Custom Webhook:
| Field | Value |
|---|---|
| Payload URL | The source URL, https://hooks.shellorbit.com/e/... |
| Authorization Token | The source secret |
| Content Type | application/json |
| Content Format | JSON Array |
| Filter by Event Category | Leave empty to send everything, or keep at least Login - Failure, Login - Success, and the user and admin management categories |
Save. The stream sends batches as the tenant logs events; each event in a batch is read on its own.
What the ready-made rules detect
Auth0 log events are read as sign in events, then share the same rules as your app:
| Finding | Severity | From |
|---|---|---|
| Possible credential stuffing: 10 failed sign ins on the source in 5 minutes | High | Failed login events |
| Repeated failed sign ins for one account: 5 in 10 minutes | Medium | Failed login events |
| Administrator role granted | High | Role assignment events |
| MFA turned off | Medium | MFA removal events |
| API token created | Low | Management API token events |
| Sign in from a new country for an account | Low | Successful logins that carry a location |
A whole log stream can be busy. Every event counts against your source events, so filter categories you will never act on.