alexa-bio

Alexa is a Product Marketing Manager on the Auth0 platform team. With a partner and product marketing background, she is focused on growing our marketplace ecosystem working closely with new and existing partners.

Product Marketing Manager

Alexa Jacky

Flexible streaming directly to your tools powered by Auth0 Marketplace integrations.

No matter industry or size, data collection and analysis can play a critical role in the success of your business. Without the right data or tools in place, it can be impossible to fully analyze performance and make the right user optimizations. The inability to monitor and react to security incidents can set organizations up for risk and brand consequences - [with the average cost of a data breach rising to $4.35 million in 2022.](https://www.ibm.com/security/data-breach) But while real-time data monitoring and alerting is important, it can be difficult to scale - especially if you’re not in the business of data ingestion. 

That’s where log streaming comes in. Log streaming allows you to ingest activity data and receive real-time monitoring and alerts, enabling you to react to security events, analyze performance, and understand user behaviors. We first introduced [Auth0’s log streaming integrations](https://marketplace.auth0.com/features/log-streaming) in 2020, allowing you to easily integrate log streaming into your applications to monitor and keep track of events occurring within your Auth0 tenants. For a bit of a deeper dive into log streaming and our past log streaming integrations, be sure to check out our [log streaming overview blog](https://auth0.com/blog/log-streaming--what-it-is-and-why-it-matters/). 

## Investing in Log Streaming to Enable Rapid Customer Response

[Account takeover attacks increased by approximately 90% from 2020 to 2021](https://www.forbes.com/sites/forbescommunicationscouncil/2022/07/18/the-account-takeover-epidemic-a-wake-up-call-for-chief-digital-officers/?sh=4eb245354196), adding pressure on IT admins to present better account monitoring and protection solutions for their users. Organizations need to be able to quickly see and react to abnormal events within their applications and find areas to improve efficiencies for better user experiences. 

We’ve been offering both log streaming and log extensions as a monitoring solution, but as pressures to react and respond to real-time streaming data grows, we’ve decided to [move away from log extensions](https://community.auth0.com/t/log-extension-deprecation/83017) and fully invest in log streaming. Log extensions delivered a once-viable solution, but we’ve found them difficult to scale to meet the growing needs. By refocusing our efforts, we’re able to launch custom log streaming solutions that are not bound by global management API endpoint limits and rate limits and, ultimately, deliver scalability. For users, this allows you to better react to real-time monitoring and alerts, analyze application performance, and understand your customer behaviors with real-time activity data. 

## Log Streaming Flexibility: Connect Directly to Your Third-Party Data Tools

We’re excited about our new launches for a few reasons. We’ve created a more efficient solution to export log events to your third-party data tools. By shifting our focus to only log streaming, we can continue to enhance our log stream features to make them more customizable for unique use cases. 

A feature we recently implemented, Log Streaming Flexibility, allows users to select which log-type categories they want to stream. This means that instead of filtering the data you want to see at the end of the stream, you can now filter exactly what you want to see directly at the source. The result is better-defined log streams that only send relevant data and easier adoption of log streams with less volume to manage. This functionality also serves as one of the alternatives to the soon-to-be deprecated log extensions functionality. 

## Meet Our Log Streaming Partners

As we continue to fully invest in log streaming, we’ve partnered with Mixpanel and Segment to create custom log streaming integrations built on APIs for two-way communication between applications.

#### [Segment](https://marketplace.auth0.com/integrations/segment-log-streaming)

Built by Auth0, the Twilio Segment integration is a Customer Data Platform (CDP) log streaming solution that provides companies with the data foundation to help build complete customer profiles. Twilio Segment allows companies to collect, unify, and route customer data into any system to better understand their customers and create seamless, compelling experiences in real time. 

#### [Mixpanel](https://marketplace.auth0.com/integrations/mixpanel-log-streaming)
The Mixpanel integration gets engineering, product, and data teams the tools they need by providing fast, flexible, and easy-to-use product analytics. This custom log streaming integration allows you to create behavioral cohorts that can be routed to Mixpanel to create robust data profiles. Mixpanel’s reporting makes it easy to find root causes of user drop-off and growth in order to better serve your customers. 

In addition to the above custom log streaming integrations built in collaboration with Mixpanel and Segment, some of our other partners have launched log streaming integrations in the [Auth0 Marketplace](http://marketplace.auth0.com/). These partner-built integrations are built with custom webhooks to allow you to ingest and track event data within your Auth0 tenants. 

#### [Elastic](https://marketplace.auth0.com/integrations/elastic-security)
[Elastic Security](https://www.elastic.co/security) combines SIEM threat detection features with endpoint prevention and response capabilities in one solution. The Elastic Security log streaming integration for Auth0 uses custom webhooks to enable easy ingestion of Auth0 events to aid with threat detection and incident response. All Auth0 events are mapped to the Elastic Common Schema, allowing you to easily analyze, correlate, and visualize events right away.

#### [Logz.io](https://marketplace.auth0.com/integrations/logz-io)
The [Logz.io](https://logz.io/) Cloud SIEM integration for Auth0 allows you to centrally monitor your workflow logs to help rapidly identify, investigate, and remediate emerging threats. Combining the open-source visualization from Kibana with advanced security analytics backed by AI and Machine Learning, Logz.io enables you to inspect and investigate all of your relevant Auth0 event data. Using custom webhooks, Logz.io allows your team to quickly drill down into granular user data while inferring critical security intelligence to inform decision-making.

#### [MDR ONE](https://marketplace.auth0.com/integrations/mdr-one)
[Kudelski Security’s](https://kudelskisecurity.com/services/mdr-one/) MDR ONE integration uses an advanced set of detection rules to provide widely recognized threat hunting, detection, and response capabilities for Auth0. By offering a unique combination of consulting, technology, and managed services, the MDR ONE integration enables organizations to continuously evaluate security posture and recommends solutions that will address business risk and compliance needs and assist with overall security effectiveness.

## What’s Next for Log Streaming on Auth0?

We’re just at the beginning of our custom log streaming integrations. With the launch of our Auth0-built integrations, we’ll soon be opening up the opportunity for partners to build their own custom log streaming integrations on our Marketplace, in addition to the webhooks-based integrations our partners are already building. 

As we move away from extensions entirely, be on the lookout in the coming months for documentation and announcements on this opportunity, and be sure to check out [auth0.com/integrate](https://auth0.com/integrate) to learn more about the process of building and launching an integration on the [Marketplace](http://marketplace.auth0.com/).



Custom Log Streaming Integrations

shafiq-shivji

Shafiq leads Product Marketing for Auth0's Ecosystem and Extensibility domains. He brings vast experience from previous roles as a Product Manager and Sales Engineer working in adjacent SaaS industries like machine learning, web/mobile apps, and communications. He especially enjoys the creative process of conceiving and taking high-impact products to market.

Shafiq Shivji

Log streaming helps you respond to incidents in near real-time



You've probably heard the expression, "You don't know what you don't know." In other words, if you don't have access to all the usable data you need to inform business decisions, you won't even realize how much is missing from the equation. You need timely insights to empower your teams to work more effectively and deliver more value to users.

People around the world are spending an unprecedented amount of time working remotely and online. We use our personal devices to check in with work; we use our work devices in our homes. Considering all this, real-time monitoring and alerting is more critical than ever. In today's cloud-centric world, it's essential that engineering, architecture, and security teams have the tools they need to monitor their environments consistently, so they can respond to incidents and adapt to trends as close to real-time as possible.

## What Is Log Streaming?

A [log streaming service like Auth0's](https://auth0.com/docs/logs/streams) automatically saves logs to a third-party tool for storage and analysis, so you have the data you need to respond in near real-time to security threats, performance outages, and other issues. Event logs contain valuable insights about user activity, which makes them an important resource for improving operational health and security. Here are some key functionalities enabled by event logs:

* Troubleshooting connectivity problems
* Identifying configuration areas that could use performance improvements
* Identifying where and why service disruptions occurred
* Exposing metrics to identify a target audience
* Pinpointing prime usage times by region
* Identifying bad actors by IP address
* Detecting and optimizing user behavior patterns
* Enabling debugging and integration setup by exposing where customers are experiencing pain and where the flow may be broken

Auth0's log streaming service lets you stream events to a host of integration partners, such as Amazon EventBridge, or any given URL. Log streaming allows you to:

* Export logs to a tool or service you already use
* React to events, such as changed passwords or new registrations, with your own business logic by sending events to custom webhooks (for instance, you can use log streaming to drive automated marketing campaigns upon signup)
* Send events to Amazon EventBridge for processing with AWS Lambda or additional data pipelines

Without log streaming, you don't have the information you need to respond promptly when intervention is called for.

## See Critical Identity Information in Near Real-Time

Auth0's log streaming service gives you access to mission-critical information &mdash; identity activity, identity security, account operations, and more &mdash; in near real-time. With log streaming, you can continuously export tenant log events to your existing monitoring and alerting dashboards, streamlining operations, and realizing deeper insights into user behavior.

Auth0 log streaming works by sending micro-batches of streaming events as they are generated in Auth0, giving customers up-to-date information about their Auth0 tenant. Implementing log streaming delivers scalable, resilient, and low-latency access to your Auth0 events.

### Make informed development decisions

Tracking trends over time allows you to make informed decisions about product development and system architecture. For example, authentication data can be used to determine how to prioritize development resources: If more users are authenticating from mobile devices, mobile development goes to the top of your priority list.

Another example is tracking peak login times by geographic location to help system architecture teams determine when and where to scale up resources. The ability to scale rapidly allows you to change your IT deployments to support your current needs, so your developers can focus on adding value instead of tinkering endlessly with your infrastructure. Fast scalability is also crucial for delivering a smooth user experience in response to short-term events like Election Day or the World Cup.

### Respond to performance and security incidents immediately

Tracking identity information helps you detect and respond to security incidents and performance issues before they do too much damage. Equipped with the right information, your security team can configure thresholds and set up alerts to notify them when suspicious events or patterns are detected, enabling faster response times.

Whether it's general operational health or security, teams often rely on a rapid visual analysis to differentiate between normal and abnormal states and determine when they need to deep-dive to investigate and resolve potential issues. For instance, a massive spike in the number of unsuccessful login attempts could indicate an ongoing [credential stuffing attack](https://auth0.com/blog/what-is-credential-stuffing/) &mdash; one of the most common and damaging ways you can expect attackers to target your infrastructure.

Event logs also yield insights into performance issues and outages, so you can understand what went wrong, who's affected, and how to fix things before your customers experience pain.

## Manage Log Streaming With Auth0 Marketplace

An inherently extensible platform like Auth0 enables users to customize identity flows and integrate with third-party solutions to meet specific business needs &mdash; now and in the future. [Extensibility](https://auth0.com/resources/whitepapers/tao-of-extensibility) describes a system's capacity to support future growth via new functionalities and use cases, as well as the level of effort required to implement those extensions. 

Opening up our platform to third-party, partner-built integrations via [Auth0 Marketplace](https://marketplace.auth0.com/) accelerates innovation for Auth0, our customers, and our partners. The ecosystem gives our customers the tools they need to solve the range of use cases they encounter. With [Marketplace](https://auth0.com/blog/introducing-auth0-marketplace/), developers get more integrations to support more use cases, and vendors have more opportunities to capture business and deliver value. For vendors who haven't yet built integrations with Auth0, Marketplace creates that opportunity.

To provide our customers with enhanced security and operational and monitoring insights, Auth0 has partnered with the [following companies](https://marketplace.auth0.com/features/log-streaming):

### Amazon EventBridge

[Amazon EventBridge](https://marketplace.auth0.com/integrations/amazon-log-streaming) makes it easy to connect applications using data from your own apps, integrated SaaS apps, and AWS services. EventBridge delivers a stream of real-time data from event sources like Datadog, Pagerduty, or Zendesk, then routes that data to targets like AWS Lambda.

With EventBridge, you can set up routing rules to determine where to send your data to build application architectures that react in real-time to all of your data sources. EventBridge takes care of event ingestion and delivery, security, authorization, and error handling for you, making it easy to build event-driven applications.

### Azure Event Grid

[Azure Event Grid](https://marketplace.auth0.com/integrations/azure-log-streaming) simplifies event-based apps by providing a single service for managing routing of all events from any source to any destination. Designed for high availability, consistent performance, and dynamic scale, Event Grid lets you focus on your app logic rather than your infrastructure.

Event Grid simplifies event delivery by allowing you to build scalable serverless applications, microservices, and distributed systems. By using Event Grid to capitalize on guaranteed event delivery and high availability on the cloud, you can build better-performing, more reliable applications through reactive programming. Finally, Event Grid allows you to focus more resources on innovation: Connecting multiple possible sources and destinations of events helps you develop richer application scenarios.

### Datadog

[Datadog](https://marketplace.auth0.com/integrations/datadog-log-streaming) (NASDAQ: DDOG) is a monitoring and analytics platform for cloud applications that has become a critical enabler for many companies. Engineering, infrastructure, and security teams use Datadog to unify data from servers, containers, databases, and third-party services to make the stack entirely observable.

With this integration, Auth0 and Datadog combine resources to deliver mission-critical identity information to our joint customers. The integration allows customers to incorporate Auth0 logs into their existing monitoring and alerting dashboards without additional engineering work. Users can collect and visualize Auth0 data in order to identify trends &mdash; all without extra development time.

With Auth0-Datadog integration, engineering teams can visualize error rates and traffic data. Security teams can visualize authorization traffic and set up alerts for high-risk actions. Infrastructure teams can ensure stability by visualizing performance metrics and traffic data. For all of these use cases, identity data furnishes crucial insights, and the Auth0-Datadog integration helps you make full use of that information.

## Perch Security

[Perch Security](https://marketplace.auth0.com/integrations/perch-security-log-streaming) allows you to add managed threat detection and SIEM (security information and event management) without changing your existing stack. Perch Security is fast and simple to deploy, supports multitenancy and third-party integrations, and is backed by a 24/7 U.S.-based security operations center. 

With Perch, you receive alerts about atypical and potentially malicious events that happen within your Auth0 environment. You can also generate reports based on the log data collected from your Auth0 environment and retain those logs for future reference and to help satisfy auditory or regulatory requirements.

### Splunk

[Splunk](https://marketplace.auth0.com/integrations/splunk-log-streaming) is a data platform that allows companies to analyze data in any structure, from any source, across any timescale. Not only does Splunk make it easy for companies to understand the health of their operating system in terms of performance and traffic, but it also offers robust SIEM and SOAR (security orchestration, automation, and response) capabilities via Splunk Enterprise Security and Splunk Phantom. These capabilities encompass monitoring, detection, security, threat detection, and workflow automation.

Auth0's event data provides rich contextual information to help our customers make informed decisions about system architecture and development. The Splunk integration enables Auth0 to deliver mission-critical identity information in a fast, scalable way. Our shared customers can easily leverage this information to make more informed decisions. The integration also allows for easy visualization of security and operational signals from Auth0 within Splunk Cloud and Splunk Enterprise since customers can now incorporate Auth0 event logs into their existing Splunk environments with minimal engineering work.

In addition, the integration allows customers to build workflows to improve security posture by leveraging Auth0's event logs and Splunk's SOAR capabilities. For example, security teams can create a playbook within Splunk Phantom for Auth0's breached password detection event logs to automatically block an account and force the user to reset their password, all without any manual interaction. Security teams can also leverage security-specific events to automatically trigger proactive investigation and mitigation. 

As part of this integration, Auth0 has created a custom Splunk dashboard that automatically visualizes critical security signals coming from Auth0. This allows security teams to monitor authorization traffic, analyze anomalies, and set up alerts for high-risk actions with greater confidence.

## Meeting Tomorrow’s Identity Needs

With Auth0 Marketplace, we're recruiting best-in-class technology partners to innovate on our platform because we know that's the best way to give you the tools you need to solve whatever identity puzzles lie ahead.

To learn how to integrate with our log streaming partners, [start here](https://marketplace.auth0.com/features/log-streaming).

<include src="asides/AboutAuth0" />


Log Streaming: What It Is and Why It Matters

adeel-mustafa

I am passionate about making products work for our users instead of expecting users to adapt to make things work for themselves. Amongst many hard-earned lessons over a career in product and services, the two things that I have held most dear have been the importance of empathy and the value of why and how we can effectively use these to generate value. And I look forward to continuing to put these to effect and make a lasting difference here at Auth0.

Sr. Product Manager, Service Management

Adeel Mustafa

Auth0 extends log streaming capabilities with the new integration



Excellence in security and operational insight is not just about access to information and events; it also needs to address scalability and timely delivery and contextual depth. These challenges are further compounded by concessions made by enterprises while striving to improve their time-to-market. They often find themselves compromising on their SIEM (Security Information and Event Management) capabilities or their ability to gather and view accurate and timely insights into operational health. 
 
This is where Auth0's Log Streaming and [Splunk](https://www.splunk.com/) integration comes in. Splunk is a data platform that allows companies to analyze any structure data, from any source, across any timescale. Splunk not only makes it easy for companies to understand the health of their system in terms of performance and traffic. It also offers robust SIEM and SOAR (Security Orchestration, Automation, and Response) capabilities via [Splunk Enterprise Security](https://www.splunk.com/en_us/software/enterprise-security.html) and [Splunk Phantom](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html), covering monitoring, detection, investigation of security threats, and automation of workflows.
 
Auth0 is now a Splunk technology partner and can jointly deliver mission-critical identity information to our customers in a scalable and timely manner. This integration allows for easy visualization of security and operational signals from Auth0 within Splunk Cloud and Splunk Enterprise as customers can now incorporate Auth0 event logs into their existing Splunk environment with minimal engineering work.
 
Auth0's Log Streaming and [Splunkbase App](https://splunkbase.splunk.com/app/5193/) provide a number of essential benefits, including:
 
### Out of the box security monitoring

As part of this integration, we have created a custom Splunk dashboard that automatically visualizes critical security signals coming from Auth0. Security teams can monitor authorization traffic, analyze anomalies, and set up alerts for high-risk actions with higher confidence.

### Visual insights and faster response time

Whether its security or general operational health, teams often rely on a quick visual triage to differentiate between a normal vs. abnormal state and whether they need to dive deeper to investigate potential issues. For instance, massive spikes in unsuccessful login attempts could indicate an ongoing [credential stuffing attack](https://auth0.com/blog/what-is-credential-stuffing/), one of the most common threats targeting identity systems.
 
Auth0's Log Streaming integration with Splunk adds the ability to collect and visualize data in order to identify trends without needing any development effort, allowing for faster discovery of potential problems or risks. Moreover, operators and security teams can configure thresholds and alerts to notify them when suspicious events take place, enabling them to respond faster.
 
### Leverage Auth0's contextual depth for better decision making

Auth0's event data provides rich contextual information to help our customers make informed decisions in regards to their future system architecture and development. With Splunk integration, customers can easily leverage this information to make more informed decisions, such as using our authentication data to determine device trends and prioritize the right one for development. Another example is when architecture teams can leverage peak traffic periods and geographic context to decide where and when to scale up resources.

### Peace of mind with automated workflows

Customers can easily build workflows to improve their security posture by leveraging Auth0's event logs and Splunk's SOAR capabilities. For example, security teams can create a playbook within Splunk Phantom for Auth0's [breached password detection](https://auth0.com/breached-passwords) event logs to automatically block an account and force the user to reset their password, all without needing any manual interaction. Security professionals can also leverage security-specific events and automatically trigger their teams' cases to investigate and mitigate them proactively.

## Log Streaming enables this Integration

Auth0 Log Streaming provides customers with access to event logs covering a wide range of scenarios, including our own security-specific event logs. Customers receive prompt information for their identity, access management, and security functions, enabling them to react swiftly and appropriately. It also enables the possibility of using these event logs as extensibility points, allowing customers to customize their needs and workflows in third party tools such as Splunk Enterprise Security and [Splunk Phantom](https://www.splunk.com/en_us/software/splunk-security-orchestration-and-automation.html).

## Learn More

Using Splunk with Auth0 unlocks a variety of mission-critical use cases that enable companies to have better insights into their security and operational data. Learn how to set up the integration [here](https://auth0.com/docs/extensions/export-logs-to-splunk), or sign up for a free Auth0 trial.

## About Splunk

Splunk is the world's first Data-to-Everything Platform. Now organizations no longer need to worry about where their data is coming from, and they are free to focus on the business outcomes that data can deliver. Innovators in IT, Security, IoT, and business operations can now get a complete view of their business in real-time, turn data into business outcomes, and embrace technologies that prepare them for a data-driven future.

<include src="asides/AboutAuth0" />


"log-streaming"