Prioritized Log Streams

Prioritized Log Streams is a Dashboard feature that highlights security events. In the event of an attack or otherwise increased user activity, Prioritized Log Streams and predefined events will remain active so downstream security automation and processes aren’t impacted.

You can create a new prioritized log stream using a supported service or configure a custom webhook to stream to a service you already use, and all logs can be exported to an event analysis service. Prioritized Log streams do not count towards the log stream limit depicted in the pricing plan.

Configure a Prioritized Log Stream

1. Follow the instructions on the Log Streams page to set up a new log stream.
2. While configuring the new stream, go to the Settings tab on your Auth0 Dashboard and select the Prioritized Log checkbox to activate the predefined security events detailed below. Choose Save.
3. Go to your Stream page and navigate to the Prioritized label.

Prioritized Logs Event Types

The following event codes are classified by Auth0 as security-related events:

Event Code	Event
limit_mu	Blocked IP Address
limit_sul	Blocked Account (IP Throttling)
limit_wc	Blocked Account (Brute Force Protection)
pwd_leak	Breached password on Login
ublkdu	User login block released
signup_pwd_leak	Breached Password on Signup
reset_pwd_leak	Breached Password on Reset
gd_send_sms	MFA SMS Sent