Security Events

140 vues Markdown

Review the incidents the account protection engine opened, see the accounts and IP addresses involved, and shut an attacker out with one click.

Opening the Screen

Open Tools → Audit Logs → Security Events, or go to {admin}/tools/actions/security-events. The screen arrives with 5.0-beta.4. The buttons in the Suspected Account Takeover (Administrator) alert e-mail open this screen too. The confirmation window of that action is already on top, and nothing happens until you confirm it.

What Is on the Screen

One table lists every event, newest first. Unlike the bell notice, a row does not disappear once it is read. It stays until you resolve or ignore it. The search box matches the IP address, the network number (ASN), the city and the account IDs. The download button beside the search box exports the filtered list as CSV, JSON or XML.

Date of Login When the event was opened. The list starts sorted on this column, newest first, and you can reverse it.

Type Which situation opened the event. The types are described below.

Severity Info, Warning or Critical.

IP Address The address the incident came from, with its country and city underneath when known. The lookup button beside it finds the other records from the same address. This column is sortable; attack mode events carry no address.

ASN The network the address belongs to, such as AS64496. A dash means it is not known.

Accounts How many client accounts are involved, with the first five names linked to their client records. Hover a name to see its e-mail; a +N badge lists the rest.

Risk Score The risk score of the sign-in that opened the event. A score of 40 or more is red. A dash means no sign-in was scored.

Status Open, Resolved or Ignored, followed by a badge for each action already taken: Accounts Locked, IP Address Blocked, ASN Watched or Sessions Ended Automatically. Hover a badge to read when it happened.

Event types

Suspected Account Takeover One address signed in to five unrelated client accounts within an hour. The address is already shut out of the password and JetPass doors for 60 minutes. The event is critical, the bell shows a notice and administrators receive the alert e-mail with the three action buttons.

Unverified Risky Sign-in A password or JetPass sign-in scored 40 or more, but no e-mail or SMS module could deliver the one-time code, so the sign-in went through. One event per account per day.

Attack Mode On / Off Attack mode was switched on because failed and multi-account attempts rose far above the usual level, or switched off because the wave passed. Administrators receive the Attack Mode Changed (Administrator) e-mail.

Canary Account Hit Someone signed in with the credentials of a canary account, which means a leaked copy of your client list is in use.

The Advanced Filter button sits next to the search box and carries a counter for how many filters are active. It opens a panel with five filters. A choice narrows the list right away and is written into the address. A reload or a shared link then opens the list narrowed.

Type One event type. All is the default and applies no filter.

Severity One severity. All is the default.

Status Open, Resolved or Ignored. All is the default.

IP Address Free text. It matches any address containing what you type, so a partial address is enough.

Date of Login A date range picked from the calendar. Pick one day to see that day only.

Tasks

Sign the accounts out and reset their passwords

On an open Suspected Account Takeover row, click Sign Out and Reset Password at the end of the row.
Read the confirmation window and click Sign Out and Reset.
Every client account in the event loses its password, its sessions and its trusted devices. Each owner receives a password reset e-mail. Staff accounts are skipped. The row gains the Accounts Locked badge; the action stays in the row menu in case a new account joins the event.

Block the IP address or watch its network

Open the row menu of an open event.
Choose Block IP Address for 24 Hours and confirm with Block IP Address. Password and JetPass sign-ins from that address are refused for 24 hours, and the row gains the IP Address Blocked badge.
Or choose Watch ASN and confirm with Watch ASN. Every later sign-in from that network counts as risky and is asked for a one-time code. The row gains the ASN Watched badge.

Each entry appears only while the row is open and carries an address or a network. It leaves the menu once it has run.

Close or reopen an event

Open the row menu and choose Mark as Resolved when you handled the event, or Ignore when it needs nothing.
Confirm. The row leaves the open list; the badges of the actions taken stay on it.
On a resolved or ignored row the same menu offers Reopen, which lists the event among the open ones again.

Things to Watch

Locking cannot be undone

The old password stops working the moment you confirm. The owner sets a new one from the reset e-mail or from Forgot Password? on the sign-in page. Without an active mail module the account is still locked but no e-mail goes out, so tell the client yourself.

The block ends on its own, watching does not

The address block lifts after 24 hours. A watched network stays watched and keeps asking its sign-ins for a code; this screen cannot remove it from the list.

The engine acted before you read the alert

By the time a Suspected Account Takeover row appears, the address is already shut out for 60 minutes. The buttons extend that protection to the accounts and to the longer term; they do not create it. Passkey, social and staff sign-ins are never scored, so they open no event.

Required Privileges

The screen and all six actions need TOOLS_ACTIONS. A name in the Accounts column opens the client record only with USERS_LOOK. The download button beside the search box follows the panel-wide TABLE_EXPORT; an account without that privilege never sees the button.

Cet article vous a-t-il été utile ?

Merci pour votre retour !

Besoin d'aide supplémentaire ?

Notre équipe d'assistance est disponible 24h/24 pour tout ce que vous ne trouvez pas ci-dessus.

Nous contacter Ouvrir un ticket