> ## Documentation Index
> Fetch the complete documentation index at: https://auth0-feat-docs-5564-security-agent.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Auth0 Security Agent

> Learn how the Security Agent monitors your Auth0 tenant for identity attacks and surfaces remediation recommendations in Slack.

export const ReleaseStageNotice = ({feature, stage, plans, contact, terms}) => {
  const stageTextMap = {
    "beta": "Beta",
    "ea": "Early Access"
  };
  const stageText = stageTextMap[stage] || "a product release stage";
  const prsLink = "/docs/troubleshoot/product-lifecycle/product-release-stages";
  const linkify = (text, url) => {
    return <a href={url} target="_blank" rel="noreferrer" class="link">{text}</a>;
  };
  const includeDetails = (plans, contact, terms) => {
    const hasDetails = terms || plans || contact;
    if (!hasDetails) return null;
    return <span data-as="p">
            {plans && <>This feature is available for {linkify(`${plans} plans`, "https://auth0.com/pricing")}. </>}
            {contact && "To participate, contact " + contact + ". "}
            {terms && <>By using this feature, you agree to the applicable Free Trial terms in Okta's {linkify("Master Subscription Agreement", "https://www.okta.com/legal")}.</>}
        </span>;
  };
  return <Warning>
            <span data-as="p">
                <strong>The {feature} feature is in {linkify(stageText, prsLink)}.</strong>
            </span>

            {includeDetails(plans, contact, terms)}
        </Warning>;
};

<ReleaseStageNotice feature="Security Agent" stage="ea" contact="Auth0 Support or your Technical Account Team" terms={true} />

<Callout icon="file-lines" color="#0EA5E9" iconType="regular">
  The Security Agent requires an Auth0 Enterprise plan with the Attack Protection add-on.
</Callout>

The Security Agent monitors your Auth0 tenant for identity-based attacks, analyzes anomalous activity, and delivers remediation recommendations to your security team. When the agent detects an attack, your team can investigate, review recommendations, and apply configuration changes in Slack.

All changes the agent applies are logged in your tenant logs under the approving administrator's identity. No configuration changes are made to your tenant without explicit approval from an authenticated Auth0 administrator.

## How it works

Security Agent is powered by Auth0 [Attack Protection](/docs/secure/attack-protection) and runs a continuous detection and response cycle:

| **Stage** | **Description** |
| - | - |
| Detect | Security Agent monitors your tenant's rate limit responses (`HTTP 429` errors). When the rate exceeds the threshold continuously for 15 minutes, the agent posts an alert to your designated Slack channel. |
| Investigate | Investigation is initiated from Slack. Security Agent analyzes your tenant's authentication logs, IP addresses, JA4 fingerprints, user agent strings, and traffic patterns to classify the attack and generate a triage report. |
| Recommend | Based on the triage report and your current tenant configuration, Security Agent surfaces up to three prioritized remediation options. |
| Action | An authenticated Auth0 administrator, a human-in-the-loop, reviews and applies recommendations directly from Slack. Every applied action is logged in your tenant logs under the administrator's identity. |

The Security Agent detects rate limit anomalies and distributed credential stuffing attacks that deliberately stay below rate limit thresholds. From Slack, the Security Agent reviews accessible data types you allow the agent to access, like tenant logs and traffic signals.

## Security Agent recommendations

When the agent identifies a threat, it can recommend the following configuration changes based on your current tenant setup:

* [Bot Detection](/docs/secure/attack-protection/bot-detection): Enable and adjust challenge policy and sensitivity.
* [Breached Password Detection](/docs/secure/attack-protection/breached-password-detection): Enable and set block responses.
* [Suspicious IP Throttling](/docs/secure/attack-protection/suspicious-ip-throttling): Enable and set shields to block.
* [Brute Force Protection](/docs/secure/attack-protection/brute-force-protection): Enable and set shields to block.
* [Tenant ACL](/docs/secure/tenant-access-control-list): Create custom rules to block specific IP addresses or JA4 fingerprints identified as attack sources.

<Warning>
  Before applying Tenant ACL recommendations, confirm your proxy configuration preserves the original client IP address. Blocking a proxy IP address stops all traffic routed through it, not just attack traffic.
</Warning>

## Data access

Security Agent accesses the following data from your Auth0 tenant. Data access is scoped to your own tenant only.

| **Data type** | **Purpose** |
| - | - |
| Authentication event logs | Baseline comparison and anomaly detection from the last 28 days. |
| Traffic signals | Attack classification and scope analysis of IP data, JA4 fingerprints, geographic data, user agent data |
| Tenant configuration | Generating accurate, context-aware recommendations based on Attack Protection settings and your Tenant ACL rules |
| Rate limit data | Anomaly detection of `HTTP 429` error counts and rates |

## Roles

| **Capability** | **Anyone in the channel** | **Authenticated Auth0 administrator** |
| - | - | - |
| View alert cards and investigation threads | ✓ | ✓ |
| Apply recommendations | | ✓ |

Any team member with access to the Slack channel can follow an active incident in real time. Only authenticated Auth0 administrators can apply configuration changes.

## Limitations

* Detection covers rate limit anomalies and distributed credential stuffing attacks.
* Alert cards show absolute traffic levels, not deviation from your historical baseline.
* Security Agent supports one Auth0 tenant per Slack workspace installation.
* Security Agent is available in Slack only.
* Only users with the Auth0 Tenant Administrator role can authenticate in Slack and apply recommendations.

## Learn more

* [Configure Security Agent](/docs/secure/security-ai-agent/configure-security-agent)
* [Attack Protection](/docs/secure/attack-protection)
* [Tenant Access Control List](/docs/secure/tenant-access-control-list)