Auth0 app dashboards are broken
The queries behind at least some of the default dashboard panels in the Auth0 app are pretty broken. Two examples (there are more):
Top 10 Users by Successful Login
_sourceCategory = my/auth0/logs
| json "type", "user_name"
| where type matches "s*"
| where !isEmpty(user_name)
| count user_name
| top 10 user_name by _count
This query includes all log event types** that start with an "s", which includes "ssa" silent login events (user is issued a new auth token behind the scenes, not actually a "login"), and "slo" events which are successful logouts!
**every log entry has an associated type, made up of a 1-4 (1-5?) character string. The various types are documented here: https://auth0.com/docs/logs
Logins by Client per Day
_sourceCategory = my/auth0/logs
| json "client_name"
| where client_name matches "*"
| timeslice by 1d
| count by _timeslice, client_name
| transpose row _timeslice column client_name
This isn't filtering on login events at all! It is capturing all log events by client.
Please sign in to leave a comment.
Comments
5 comments