Credential Stuffing Logs

Knowledge Articles
1

Overview

This article explains the associated log types and how to export the logs related to credential stuffing.

Applies To

  • Logs
  • Credential Stuffing Attack

Solution

1. Utilizing monitoring log search query syntax:

Auth0 supports a subset of Lucene query syntax to refine log searches.

  • By constructing queries with specific date ranges and criteria, logs can be filtered effectively. See Log Search Query Syntax
  • For instance, to search for logs with the specific log types(Credential stuffing) and within a desired date range, the following query can be used:
    • date:[2025-04-30 00:00:00.000 TO 2025-04-30 23:59:59.000]AND (type:f OR type:fu OR type:fp OR type:pwd_leak OR type:limit_wc OR type: limit_sul OR type:limit_mu)

2. Export logs from the Auth0 Management API:

The Auth0 Management API provides an endpoint to retrieve logs.

  • By utilizing the GET /api/v2/logs endpoint, logs can be fetched programmatically.
  • It is important to note that the Auth0 Management API has rate limits and pagination, so retrieving a large number of logs may require handling paginated responses.
    • Detailed information on retrieving logs using the Management API can be found at Search log events

3. Exporting logs to external services via Log Stream

For more control and comprehensive analysis, exporting logs to external services is recommended.

  • Auth0 offers log streaming capabilities that allow logs to be sent to third-party services such as Splunk, Datadog, or Azure Monitor. See Log Streams
  • NOTE: Auth0’s log retention period varies depending on the subscription plan.