# NautheraThreatSignalElevated

A threat signal for one organization is at or above its elevated rate.

## Meaning

For one organization, the hourly rate of a threat signal over the last hour reached the
elevated rate in `nauthera_threat_threshold_per_hour`, but not the critical one, for
fifteen minutes. It is the same measure as NautheraThreatSignalCritical at its lower
threshold. The dashboard's Threats page can also show a signal elevated because it is
several times the period before; the alert uses only the published rates.

## Impact

Possibly an attack starting, or a relying party or user population misbehaving: for
example a client with a rotated secret failing client authentication, or a mistyped
redirect URI causing refused authorization requests. Who is affected depends on the
`signal`, as for the critical alert.

## Diagnosis

1. The organization and signal from the labels; the slug as for the critical alert.
2. The Threats page for that organization (`/admin/orgs/<slug>/threats`), and the audit
   records it links to.
3. The trend: `sum by (signal) (rate(nauthera_threat_signals_total\{job="&lt;name&gt;",
   organization="&lt;organization&gt;"\}[1h])) * 3600` over the last day. A steady rise toward
   the critical rate is worth acting on now.

## Mitigation

- A broken integration: contact the client's owner.
- An attack: apply the mitigation for the signal's category listed under
  NautheraThreatSignalCritical before it reaches the critical rate.

## Escalation

No page. Tell the security team in working hours, and the organization's administrators
when the records point to their users or clients.

---

[Alert runbooks](https://www.nauthera.io/docs/v1/runbooks/alerts) · Generated from [`internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/internal/runbook/alerts.yaml) and [`operator/internal/runbook/alerts.yaml`](https://github.com/nauthera/nauthera-server/blob/main/operator/internal/runbook/alerts.yaml) in nauthera-server.