​
Overview

The Auth0 integration polls the Auth0 Management API and ingests events covering:
  • User logins (successful and failed) and signups
  • Token issuance, refresh, and revocation
  • MFA enrollment and challenge outcomes
  • Tenant configuration changes (rules, hooks, applications, connections)

​
Prerequisites

  • An Auth0 tenant with permission to create Machine-to-Machine applications.
  • The full Auth0 domain (for example, dev-example.us.auth0.com).

​
Step 1: Create a Machine-to-Machine application in Auth0

  1. Sign in to the Auth0 Dashboard.
  2. Go to Applications → Applications and click Create Application.
  3. Name it atatus-siem, select Machine to Machine Applications, and click Create.
  4. When prompted, authorize the application to use the Auth0 Management API.
  5. Grant the following scopes (read-only):
    • read:logs
    • read:logs_users
  6. Click Authorize.
  7. Open the application’s Settings tab and copy the Client ID and Client Secret.

​
Step 2: Connect Auth0 in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the Auth0 card and click Connect.
  3. Fill in the form:
  1. Click Connect.

​
Verification

  • The Auth0 card shows Configured.
  • Events with source auth0 appear in Security → Cloud SIEM → Audit Logs → Events.