Overview

The Auth0 integration polls the Auth0 Management API and ingests events covering:

  • User logins (successful and failed) and signups
  • Token issuance, refresh, and revocation
  • MFA enrollment and challenge outcomes
  • Tenant configuration changes (rules, hooks, applications, connections)

Prerequisites

  • An Auth0 tenant with permission to create Machine-to-Machine applications.
  • The full Auth0 domain (for example, dev-example.us.auth0.com).

Step 1: Create a Machine-to-Machine application in Auth0

  1. Sign in to the Auth0 Dashboard.
  2. Go to Applications → Applications and click Create Application.
  3. Name it atatus-siem, select Machine to Machine Applications, and click Create.
  4. When prompted, authorize the application to use the Auth0 Management API.
  5. Grant the following scopes (read-only):
    • read:logs
    • read:logs_users
  6. Click Authorize.
  7. Open the application's Settings tab and copy the Client ID and Client Secret.

Step 2: Connect Auth0 in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the Auth0 card and click Connect.
  3. Fill in the form:
Field Description Example
Client ID Client ID from the M2M app. abc123...
Client Secret Client Secret from the M2M app. ••••••••
Auth0 Domain Your tenant domain (no scheme). dev-example.us.auth0.com
API Audience Management API audience URL. https://dev-example.us.auth0.com/api/v2/
Poll Interval (minutes) How often to fetch new events. 5
Enabled Turn collection on. true
  1. Click Connect.

Verification

  • The Auth0 card shows Configured.
  • Events with source auth0 appear in Security → Cloud SIEM → Audit Logs → Events.