Watch for security events

You will turn on the detectors, send events to your collector and add one event of your own. It takes about 15 minutes.

You need

• A MainSDK app with auth set up.
• An OpenTelemetry collector, if you want events outside the app.

1. Choose where events go and what detects

security:
  events:
    to: [log, otel]
    min: low
  detect:
    brute-force: { failures: 10, window: 5m }
    stuffing: { accounts: 20, window: 5m }
    probing: { denials: 20, window: 1m }

log is always on. Read it with mainsdk logs --security. The detectors report and never block.

2. Add an event of your own

import { security } from "mainsdk";

security.emit({ type: "app.refund_spike", severity: "medium", message: "Refunds above the daily norm", attrs: { count: 41 } });

The type must start with app., or the call is refused with MAIN-SECURITY-0005. The SDK writes the catalogue events itself.

3. Listen

import { security } from "mainsdk";

const stop = security.on("auth.*", (e) => console.log(e.type, e.severity));

Check that it works

• Fail a sign-in ten times: mainsdk logs --security shows auth.brute_force.
• Every event holds a keyed user hash and a trimmed address, never the raw values.

Next

• Security events reference
• Raise and route alerts