Auth0 Security Agent

The Security Agent requires an Auth0 Enterprise plan with the Attack Protection add-on.

The Security Agent monitors your Auth0 tenant for identity-based attacks, analyzes anomalous activity, and delivers remediation recommendations to your security team. When the agent detects an attack, your team can investigate, review recommendations, and apply configuration changes in Slack. All changes the agent applies are logged in your tenant logs under the approving administrator’s identity. No configuration changes are made to your tenant without explicit approval from an authenticated Auth0 administrator.

How it works

Security Agent is powered by Auth0 Attack Protection and runs a continuous detection and response cycle:

Stage	Description
Detect	Security Agent monitors your tenant’s rate limit responses (`HTTP 429` errors). When the rate exceeds the threshold continuously for 15 minutes, the agent posts an alert to your designated Slack channel.
Investigate	Investigation is initiated from Slack. Security Agent analyzes your tenant’s authentication logs, IP addresses, JA4 fingerprints, user agent strings, and traffic patterns to classify the attack and generate a triage report.
Recommend	Based on the triage report and your current tenant configuration, Security Agent surfaces up to three prioritized remediation options.
Action	An authenticated Auth0 administrator, a human-in-the-loop, reviews and applies recommendations directly from Slack. Every applied action is logged in your tenant logs under the administrator’s identity.

The Security Agent detects rate limit anomalies and distributed credential stuffing attacks that deliberately stay below rate limit thresholds. From Slack, the Security Agent reviews accessible data types you allow the agent to access, like tenant logs and traffic signals.

Security Agent recommendations

When the agent identifies a threat, it can recommend the following configuration changes based on your current tenant setup:

Bot Detection: Enable and adjust challenge policy and sensitivity.
Breached Password Detection: Enable and set block responses.
Suspicious IP Throttling: Enable and set shields to block.
Brute Force Protection: Enable and set shields to block.
Tenant ACL: Create custom rules to block specific IP addresses or JA4 fingerprints identified as attack sources.

Before applying Tenant ACL recommendations, confirm your proxy configuration preserves the original client IP address. Blocking a proxy IP address stops all traffic routed through it, not just attack traffic.

Data access

Security Agent accesses the following data from your Auth0 tenant. Data access is scoped to your own tenant only.

Data type	Purpose
Authentication event logs	Baseline comparison and anomaly detection from the last 28 days.
Traffic signals	Attack classification and scope analysis of IP data, JA4 fingerprints, geographic data, user agent data
Tenant configuration	Generating accurate, context-aware recommendations based on Attack Protection settings and your Tenant ACL rules
Rate limit data	Anomaly detection of `HTTP 429` error counts and rates

Roles

Capability	Anyone in the channel	Authenticated Auth0 administrator
View alert cards and investigation threads	✓	✓
Apply recommendations		✓

Any team member with access to the Slack channel can follow an active incident in real time. Only authenticated Auth0 administrators can apply configuration changes.

Limitations

Detection covers rate limit anomalies and distributed credential stuffing attacks.
Alert cards show absolute traffic levels, not deviation from your historical baseline.
Security Agent supports one Auth0 tenant per Slack workspace installation.
Security Agent is available in Slack only.
Only users with the Auth0 Tenant Administrator role can authenticate in Slack and apply recommendations.

Protect Your Application

Call APIs On User's Behalf

Protect Your Tenant

Auth0 Security Agent

How it works

Security Agent recommendations

Data access

Roles

Limitations

Learn more

​How it works

​Security Agent recommendations

​Data access

​Roles

​Limitations

​Learn more

How it works

Security Agent recommendations

Data access

Roles

Limitations

Learn more