Post Slack alerts for Auth0 login failures and lockouts

I want an agent workflow that watches my Auth0 tenant log in real time and turns login-failure signals into actionable Slack alerts in our security channel.

Trigger: use the Auth0 poll trigger with event type new_log_event so the workflow fires once per new tenant log event.

For every new log event, read the Auth0 log type code and only act on failure signals. Everything else (successful logins s, logouts slo, successful signups ss, Management API calls sapi/fapi, change-password events) should be ignored so the workflow returns quietly.

Failure codes to act on:

• f, fp, fu = failed login (generic, wrong password, invalid email or username) • fs = failed signup • limit_wc = account blocked by Auth0 brute-force protection (10 consecutive failures for the same user+IP, or 100 failures from the same IP in 24h)

Behavior for limit_wc: always post one high-severity alert per event to our Slack security channel using the Slack Bot Send a Message operation. The message must call out the affected user, source IP, geolocation (city and country from the log entry), user agent, and the event timestamp, and must include a suggested action: contact the user to confirm the attempts, and unblock the account in Auth0 if they are legitimate. Format with a red-circle severity indicator and bold labels so it stands out in the channel.

Behavior for f / fp / fu: do NOT alert on isolated events. Consolidate repeated failures inside a short window (default 5 minutes, make this configurable) that share the same user_id OR the same source IP. Post exactly ONE Slack message per consolidated group with the attempt count, the user or IP that was targeted, and a link to the Auth0 dashboard filtered by that user or IP (https://manage.auth0.com/dashboard/... with the tenant and query) so on-call can drill in with one click. Format with a warning emoji.

Behavior for fs (failed signups): consolidate the same way as f/fp/fu and post one Slack alert per burst.

Enrichment: for every alert that identifies a specific user, call the Auth0 Get User operation with the user_id from the log entry and show the user's name and email in the Slack message instead of the raw internal id (auth0|xxx, google-oauth2|xxx, etc.). Remember to URL-encode the pipe character in the user id path segment. If the log event does not carry a resolvable user_id (e.g. an unknown-email failure that only has an IP), fall back gracefully to whatever identifier the log provides and note it in the alert.

Use the Slack Bot Send a Message operation for every Slack post. During setup ask the user which Slack channel to alert (a single dedicated security channel is the intended default) and confirm the bot has been invited to it.

Reference: Auth0 brute-force protection docs at https://auth0.com/docs/secure/attack-protection/brute-force-protection describe the exact thresholds behind the limit_wc event.