moai-adk 0.35.1__py3-none-any.whl

moai_adk/templates/.claude/skills/moai-security-auth0/modules/security-center.md

@@ -0,0 +1,325 @@
+# Security Center
+
+Auth0 Security Center provides real-time observability and threat response capabilities within the Management Dashboard for monitoring CIAM anomalies and configuring attack mitigation.
+
+## Overview
+
+Security Center is a centralized dashboard for:
+- Real-time threat monitoring
+- Attack protection configuration
+- Security metrics visualization
+- Threat pattern analysis
+
+Access: Dashboard > Security > Security Center
+
+## Key Monitoring Features
+
+### Real-Time Visibility
+
+Total Traffic Monitoring:
+- Authentication attempts
+- Signup requests
+- Password reset requests
+- Overall request volume
+
+Threat Counting:
+- Detected threats by category
+- Threat trends over time
+- Comparative analysis
+
+Application-Specific:
+- Per-application metrics
+- Identify targeted applications
+- Focus security efforts
+
+### Filtering and Aggregation
+
+Time Period Selection:
+- Up to 14 days of data
+- Custom date ranges
+- Trend analysis
+
+Filter Options:
+- By application
+- By connection
+- By threat type
+- Combined filters
+
+Auto-Aggregation:
+- Per minute (short periods)
+- Per hour (medium periods)
+- Per day (longer periods)
+
+## Threat Detection Categories
+
+### Credential Stuffing
+
+Detection: Behavioral patterns indicating machine-driven credential submission attempts.
+
+Characteristics:
+- Automated login attempts
+- Multiple credentials tested
+- Bot-like behavior patterns
+- Account compromise attempts
+
+Metrics Shown:
+- Detection count
+- Trend over time
+- Affected applications
+- Source analysis
+
+### Signup Attacks
+
+Detection: Patterns indicating automated account creation attempts.
+
+Characteristics:
+- High-velocity signups
+- Bot-driven registration
+- Fake account creation
+- Spam account patterns
+
+Metrics Shown:
+- Attack frequency
+- Volume trends
+- Target applications
+- Success/failure rates
+
+### MFA Bypass
+
+Detection: Patterns indicating attempts to circumvent multi-factor authentication.
+
+Characteristics:
+- Repeated MFA failures
+- Unusual MFA patterns
+- Potential social engineering
+- Session manipulation attempts
+
+Metrics Shown:
+- Bypass attempt count
+- Challenge/response patterns
+- Affected users
+- Method analysis
+
+## Attack Protection Integration
+
+### Bot Detection
+
+Monitoring:
+- Detection counts
+- 7-day rolling view
+- Trigger frequency
+- Response effectiveness
+
+Configuration Access:
+- Quick settings access
+- Enable/disable
+- Sensitivity adjustment
+
+### Suspicious IP Throttling
+
+Monitoring:
+- Throttling events
+- Blocked IP count
+- Rate limit triggers
+- Geographic distribution
+
+Configuration Access:
+- Threshold adjustment
+- AllowList management
+- Response settings
+
+### Brute Force Protection
+
+Monitoring:
+- Account protection triggers
+- Blocked login attempts
+- Notification frequency
+- Unblock events
+
+Configuration Access:
+- Threshold settings
+- Notification options
+- AllowList management
+
+### Breached Password Detection
+
+Monitoring:
+- Detection alerts
+- Blocked credential usage
+- User notifications sent
+- Admin alert frequency
+
+Configuration Access:
+- Detection settings
+- Response configuration
+- Notification settings
+
+### Multi-Factor Authentication
+
+Monitoring:
+- MFA challenge count
+- Success rates
+- Failure rates
+- Factor usage distribution
+
+Configuration Access:
+- Factor management
+- Policy settings
+- Enrollment status
+
+## Authentication Event Tracking
+
+### Login Metrics
+
+Over Past 7 Days:
+- Total login attempts
+- Successful logins
+- Failed logins
+- Success rate percentage
+
+Breakdown Available:
+- By application
+- By connection
+- By time period
+
+### Signup Metrics
+
+Tracking:
+- Total signup attempts
+- Successful signups
+- Failed signups
+- Conversion rates
+
+Analysis:
+- Growth trends
+- Failure patterns
+- Spam detection
+
+## Using Security Center
+
+### Daily Monitoring
+
+Recommended Checks:
+- Review threat counts
+- Check for unusual patterns
+- Verify protection triggers
+- Monitor success rates
+
+Quick Actions:
+- Adjust thresholds
+- Enable/disable features
+- Investigate anomalies
+
+### Threat Investigation
+
+When Threat Detected:
+1. Review threat category
+2. Analyze affected scope
+3. Check source patterns
+4. Verify protection response
+5. Adjust settings if needed
+
+### Configuration Workflow
+
+From Security Center:
+1. Identify protection needs
+2. Click through to settings
+3. Configure appropriate protection
+4. Return to monitor effect
+
+## Metrics Interpretation
+
+### Understanding Counts
+
+Threat Counts:
+- Number of detected threats
+- Not necessarily attacks stopped
+- Indicates protection activity
+
+Traffic Counts:
+- Total authentication requests
+- Context for threat ratio
+- Baseline for comparison
+
+### Trend Analysis
+
+Increasing Trends:
+- May indicate attack increase
+- Could be traffic growth
+- Compare with baseline
+
+Decreasing Trends:
+- Protection effectiveness
+- Attack subsiding
+- Configuration changes
+
+Spikes:
+- Sudden attack activity
+- System issues
+- Investigate promptly
+
+## Best Practices
+
+### Regular Review
+
+Daily:
+- Quick overview of threats
+- Check for spikes
+- Verify normal patterns
+
+Weekly:
+- Trend analysis
+- Configuration review
+- Threshold assessment
+
+Monthly:
+- Comprehensive review
+- Policy adjustments
+- Documentation update
+
+### Alert Response
+
+When Threats Spike:
+1. Assess threat type
+2. Check protection status
+3. Verify blocking active
+4. Adjust if needed
+5. Monitor resolution
+
+### Threshold Optimization
+
+Balance:
+- Security vs. user experience
+- False positive rate
+- Attack prevention
+- Business requirements
+
+Process:
+1. Monitor current performance
+2. Identify issues
+3. Adjust incrementally
+4. Verify improvement
+
+## Integration
+
+### Log Export
+
+For Advanced Analysis:
+- Export to SIEM
+- Custom dashboards
+- Long-term storage
+
+### Alerting
+
+Configure Notifications:
+- Threshold-based alerts
+- Email notifications
+- Integration with monitoring
+
+### Reporting
+
+Generate Reports:
+- Security posture
+- Threat trends
+- Protection effectiveness
+- Compliance evidence

moai_adk/templates/.claude/skills/moai-security-auth0/modules/security-guidance.md

@@ -0,0 +1,277 @@
+# Security Guidance
+
+Auth0 security guidance provides best practices, security bulletins, and recommendations for building secure identity implementations.
+
+## Security Topics
+
+### General Security Tips
+
+Foundation for secure deployments:
+- Authentication configuration
+- Authorization best practices
+- Session management
+- Error handling
+
+### Security Bulletins
+
+Official Auth0 communications about:
+- Identified security issues
+- Required actions
+- Remediation steps
+- Version updates
+
+Monitoring:
+- Subscribe to bulletins
+- Review regularly
+- Act promptly on critical issues
+
+### Data Security
+
+Storage and Protection:
+- Token storage practices
+- User data handling
+- Allow Lists and Deny Lists
+- Access control mechanisms
+
+### Threat Prevention
+
+Attack understanding and mitigation:
+- Common attack types
+- Attack signatures
+- Proactive defenses
+- Incident response
+
+## Security Best Practices
+
+### Credential Management
+
+Dashboard Access:
+- Enforce MFA for all administrators
+- Regular audit of admin list
+- Remove inactive accounts
+- Limit admin privileges
+
+Secrets:
+- Secure client secrets
+- Rotate regularly
+- Use appropriate credential type
+- Never expose in code
+
+### Connection Security
+
+Active Connections:
+- Remove unused connections
+- Verify connection configuration
+- Regular security review
+- Update deprecated features
+
+Enterprise Connections:
+- Verify IdP security
+- Review attribute mapping
+- Monitor connection usage
+
+### Application Security
+
+Configuration:
+- Proper redirect URI configuration
+- Appropriate token lifetimes
+- Secure callback handling
+- Input validation
+
+Authentication Flows:
+- Use appropriate flow for app type
+- Enable PKCE where applicable
+- Avoid implicit flow for sensitive apps
+
+### User Security
+
+Password Policies:
+- Strong password requirements
+- Breached password detection
+- Password history
+- Lockout policies
+
+Account Protection:
+- Enable MFA
+- Brute force protection
+- Suspicious activity detection
+
+## Threat Prevention
+
+### Common Attack Types
+
+Credential Stuffing:
+- Automated credential testing
+- Uses breached credentials
+- Targets many accounts
+
+Prevention:
+- Bot detection
+- Breached password detection
+- Rate limiting
+- MFA
+
+Brute Force:
+- Repeated login attempts
+- Targets specific accounts
+- Password guessing
+
+Prevention:
+- Brute force protection
+- Account lockout
+- Strong passwords
+- MFA
+
+Phishing:
+- Fake login pages
+- Credential harvesting
+- Social engineering
+
+Prevention:
+- WebAuthn/FIDO2
+- User education
+- Domain verification
+
+Session Hijacking:
+- Token theft
+- Session takeover
+- Cookie stealing
+
+Prevention:
+- Sender constraining (DPoP/mTLS)
+- Short token lifetimes
+- Session monitoring
+
+### Incident Response
+
+Using System Logs:
+- Investigate suspicious activity
+- Trace attack patterns
+- Identify affected users
+- Document incidents
+
+Response Steps:
+1. Detect anomaly
+2. Assess impact
+3. Contain threat
+4. Remediate issues
+5. Document and learn
+
+## Security Configuration Checklist
+
+### Essential Security
+
+Must Enable:
+- Bot Detection
+- Brute Force Protection
+- Breached Password Detection
+- Suspicious IP Throttling
+- HTTPS for all endpoints
+
+Recommended:
+- Multi-factor authentication
+- Token rotation
+- Appropriate token lifetimes
+- Audit logging
+
+### Enhanced Security
+
+For Sensitive Applications:
+- Adaptive MFA
+- Step-up authentication
+- Sender constraining
+- Strong customer authentication
+
+For Regulated Industries:
+- Highly Regulated Identity
+- FAPI compliance
+- mTLS authentication
+- Detailed audit trails
+
+## Monitoring and Alerting
+
+### Key Metrics
+
+Monitor:
+- Failed login rates
+- MFA challenge rates
+- Token usage patterns
+- Admin actions
+
+Alert On:
+- Unusual failure spikes
+- Mass account lockouts
+- Configuration changes
+- Security feature toggles
+
+### Log Analysis
+
+Regular Review:
+- Security events
+- Admin activities
+- User patterns
+- Error rates
+
+Incident Detection:
+- Anomaly identification
+- Pattern recognition
+- Correlation analysis
+
+## Compliance Considerations
+
+### Data Handling
+
+Requirements:
+- Data minimization
+- Proper consent
+- Retention policies
+- Deletion capability
+
+Implementation:
+- Review collected data
+- Document purposes
+- Configure retention
+- Test deletion
+
+### Audit Requirements
+
+Maintain Records:
+- Authentication events
+- Configuration changes
+- Admin actions
+- Security incidents
+
+Retention:
+- Per regulatory requirements
+- Accessible for audits
+- Protected from tampering
+
+## Staying Current
+
+### Auth0 Updates
+
+Monitor:
+- Release notes
+- Security bulletins
+- Feature announcements
+- Deprecation notices
+
+Actions:
+- Apply security patches
+- Update configurations
+- Remove deprecated features
+- Test changes
+
+### Security Landscape
+
+Stay Informed:
+- Industry security trends
+- New attack vectors
+- Best practice updates
+- Regulatory changes
+
+Apply:
+- Regular security reviews
+- Configuration updates
+- Training and awareness
+- Process improvements