Skip to main content

How to integrate Auth0 with Defense.com

This guide will run you through how to get Auth0 logging to Defense.com's SIEM platform.

Written by Alan Butcher

This integration is available on our Advanced and Enterprise packages.

Auth0 allows you to send log events to Defense.com using Custom Webhooks.

With custom webhooks, Auth0 delivers events to your own API endpoint as HTTP POST requests. You can only use one payload URL per webhook configuration, but the same URL can be used across multiple log streams. Events are delivered in JSON lines format. Note: Self-signed HTTP certificates are not supported.

Before you get started

Before beginning the integration, you'll need a Defense.com Webhook URL and an Authorisation token. Please reach out to our Technical Support team via a support ticket to request these.

If you've already been provided with the Webhook URL and Authorisation token, please follow the steps outlined below.

Creating the Custom Log Stream in Auth0

  1. Go to your Auth0 Dashboard and navigate to Monitoring > Streams.

  2. Click Create Stream.

  3. Select Custom Webhook as the type.

  4. Enter a unique Name for your log stream.

  5. Configure the following settings:

Setting

Description

Name

A unique display name to help you identify this stream.

Payload URL

The full URL of your webhook endpoint provided by Defense.com.

Authorization Token

A token that will be sent in the Authorisation header of each request, this is provided by Defense.com.

Content Type

The media type of the payload (e.g., application/json).

Content Format

Choose how the data should be delivered: JSON lines, arrays, or objects.

Filter by Event Category

Select which types of log events you want to receive.

Starting Cursor

(Optional) Set a specific date and time to begin streaming events from.

6. Click Save.

Testing the configuration

  1. Switch to the Health view and confirm that the Stream Status is Active.

  2. Perform an action that creates a tenant log event, like a login, token exchange, or Auth0 Management API call.

  3. Confirm that the event was created in your tenant logs.

  4. Confirm that your API received a HTTP POST request with the event data.

  5. Go to the Health view and confirm that no errors occurred.

Once you have completed the configuration steps, please let us know via the ticket so we can confirm that Auth0 is logging.

And that's it! You've successfully integrated Auth0 🎉

Did this answer your question?