Every 15 minutes

Get warned when failed logins spike

Your security channel is alerted when failed sign-ins pass the limit you choose within an hour.

Runs: Every 15 minutes
Apps: Auth0
AI: Not needed
Access: read:logs

Send this to your assistant

Create a ClickRuntime automation: every 15 minutes, count failed Auth0 logins over the past hour and post to #security in Slack if there are more than 50.

Paste it into your assistant. It tells you what it will send or change before it runs live.

Add to ChatGPT Add to Claude

First time? Adding ClickRuntime to your assistant takes about two minutes.

Why use it

Why teams use this automation

A burst of failed logins is one of the earliest signs of a credential stuffing attack, where bots try stolen passwords against your Auth0 tenant. A few failures an hour are normal, since people mistype passwords. But a sudden spike to hundreds can mean accounts are about to be taken over or a customer-facing outage in a login flow. Without monitoring, the first signal is a flood of support tickets or an angry customer.

Every 15 minutes, ClickRuntime fetches Auth0 log events of the failed-login type since its last check, adds them to an hourly counter and compares the total with the threshold you set. If the count is above the threshold, it sends an alert, so someone can look at the logs before the damage spreads.

Teams without a dedicated security monitoring service use it as a basic early warning layer. A security-minded founder can set a lower threshold for high-value customer tenants.

What you get out of it

Attacks are noticed in minutes
A fifteen-minute check means a credential stuffing attempt is spotted during the attack, not the next day. Rate limits and blocks can be applied while few accounts are exposed. Blocks can be applied while few accounts are exposed.
Customer accounts are better protected
Early action, such as enabling Auth0's attack protection or forcing resets for targeted users, prevents takeovers that cost refunds, support time and trust. Prompt action, such as forced password resets, prevents costly takeovers.
Outages in the login flow show up
A misconfigured rule or an expired social connection can make every login fail. A spike in failures reveals it before customers start writing in to complain. Otherwise customers would be the ones to tell you.
Thresholds match your normal traffic
Because you set the limit, a small app and a busy one each get alerts that mean something. You avoid constant noise and still catch real anomalies. Real anomalies stand out from normal noise.
Security reviews gain evidence
Alert emails with counts and times make post-incident reviews more factual. You can show when the spike started, how fast the team responded and what changed. Incident reviews become factual.

How it works

What happens, step by step

Every 15 minutes, ClickRuntime pulls the failed sign-in attempts from your Auth0 logs since its last check.
It keeps a running count for the past hour.
When the count passes the limit you chose, a warning goes to your Slack security channel with the number of failures and your limit.

Before it runs live

Connect Auth0

What you get

RunsEvery 15 minutes

Get warned when failed logins spiketoday, 9:00Succeeded

Slack · #security212 failed Auth0 logins in the past hour (threshold 50).

Build your own

Need it to work differently?

This template is a starting point. Copy the prompt and change it, or describe a different automation from scratch, with your own conditions, more apps or an AI step. Your assistant writes it, tests it and runs it on ClickRuntime.

Your own rules
Conditions, thresholds, filters and exceptions, written the way you'd explain them to a colleague.
Any number of apps
One automation can read from one app and update several others. Over 248 apps are ready, and anything with an API works too.
AI where it helps
Summaries, classification, extraction and drafts use ClickRuntime's built-in AI, with no extra key.
On a schedule or on each event
Runs as often as every 5 minutes, or the moment an app sends an event, and keeps track of what it already handled.

Changes you can ask for

Act only on the items that match your own rules, and skip the rest
Add an AI step, for example to summarize, sort or draft a reply
Add another app, for example also send it to Slack
Combine it with other Auth0 steps into one automation

Under the hood

The code that runs this automation

This is the Python script that runs each time the automation starts. Your AI assistant writes it for you when you send the prompt, and you allow each step in your assistant. To change how the automation works, describe the change to your assistant and it updates the script for you. For every function it can use, see the script reference.

failed_login_spike_alert.pyexample

from datetime import datetime, timedelta, timezone
from clickruntime import on_trigger, credentials, http, state, notify

DOMAIN = "northwind.us.auth0.com"
THRESHOLD = 50

def auth0(path, **params):
    resp = http.get(f"https://{DOMAIN}/api/v2/{path}", params=params,
                    headers={"Authorization": f"Bearer {credentials.secret('AUTH0_MGMT_TOKEN')}"})
    resp.raise_for_status()
    return resp.json()

@on_trigger
def run(event):
    since = (datetime.now(timezone.utc) - timedelta(hours=1)).isoformat()[:23]
    logs = auth0("logs", q=f"type:f AND date:[{since} TO *]", per_page=100, include_totals="true")
    count = logs["total"] if isinstance(logs, dict) else len(logs)
    hour = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H")
    if count > THRESHOLD and state.get("alerted_hour") != hour:
        notify.slack(f"{count} failed Auth0 logins in the past hour (threshold {THRESHOLD}).", channel="#security")
        state.set("alerted_hour", hour)
    return {"failed_last_hour": count}

FAQ

Common questions

What log events count as failed logins?

Auth0 records failed login attempts under specific log event types, such as failed login due to wrong password or wrong username. ClickRuntime fetches events of the failure types and counts them. Other events, like successful logins, are not included in the count.

How do I choose a good threshold?

Look at a normal week of failures per hour and set the limit at a few times the typical peak. Many teams begin with a guess, watch the alerts for a week and adjust. Your AI assistant can change the threshold without altering anything else.

Does it block the attacker?

No. It only alerts you. Blocking is done in Auth0 through attack protection features like brute-force protection and suspicious IP throttling. The alert tells you when to check those settings and when to look more closely at the logs yourself.

What permissions does it need?

read:logs. Nothing else in your accounts is used.

Does it need AI?

No. It runs without AI, so it doesn't use your plan's AI allowance.

How many runs does it use?

One run each time it checks. Checks that find nothing new and stop right away aren't counted.

Can I change how it works?

Yes. Describe the change to your AI assistant, for example a different schedule, channel or filter. It updates the automation, tests it and tells you what changed.

Every 5 minutes