Skip to content

The v1 docs follow nauthera-server's main branch and its 0.x releases on the way to 1.0, so fields and APIs can still change.

v1

NautheraThreatSignalElevated

Docs version v1 (main)Nauthera is pre-1.0, in a design-partner program

A threat signal for one organization is at or above its elevated rate.

Meaning

For one organization, the hourly rate of a threat signal over the last hour reached the elevated rate in nauthera_threat_threshold_per_hour, but not the critical one, for fifteen minutes. It is the same measure as NautheraThreatSignalCritical at its lower threshold. The dashboard's Threats page can also show a signal elevated because it is several times the period before; the alert uses only the published rates.

Impact

Possibly an attack starting, or a relying party or user population misbehaving: for example a client with a rotated secret failing client authentication, or a mistyped redirect URI causing refused authorization requests. Who is affected depends on the signal, as for the critical alert.

Diagnosis

  1. The organization and signal from the labels; the slug as for the critical alert.
  2. The Threats page for that organization (/admin/orgs/<slug>/threats), and the audit records it links to.
  3. The trend: sum by (signal) (rate(nauthera_threat_signals_total\{job="&lt;name&gt;", organization="&lt;organization&gt;"\}[1h])) * 3600 over the last day. A steady rise toward the critical rate is worth acting on now.

Mitigation

  • A broken integration: contact the client's owner.
  • An attack: apply the mitigation for the signal's category listed under NautheraThreatSignalCritical before it reaches the critical rate.

Escalation

No page. Tell the security team in working hours, and the organization's administrators when the records point to their users or clients.

Alert runbooks · Generated from internal/runbook/alerts.yaml and operator/internal/runbook/alerts.yaml in nauthera-server.