Blocked (Bruteforce) events not showing in Logs

Help
,
1

I am testing sending custom webhooks to our app when users are blocked due to bruteforce protection. I have a setup a custom webhook with the Login - Failure and System - Notification Event Categories selected.

After failing login 10 times the user is blocked by bruteforce protection (has the Blocked (Bruteforce) badge), but my webhook endpoint isn’t receiving the limit_wc event I’m expecting. It is receiving the fp events for each failed login. I checked the Logs page too and only see the fp events there, no limit_wc logs.

Am I looking for the wrong thing, or is there something else I need to configure?

2

I did some further testing on this and it appears the “limit_wc” is only sent on the 11th failed attempt.

After 10 failed attempts the user is shown as “block (bruteforce)” when viewing via the Auth0 console, and I can get the blocked IPs via the management API, but unless the user make an 11th attempt the “limit_wc” event isn’t sent.

I would have expected the event to be sent when the user is blocked, i.e. after the 10th attempt. Can you confirm the current behavious is intended?

Thanks.