---
title: "Watch for security events"
description: "Write the app's own security events, listen for the ones the SDK writes, detect brute force and probing, and send them to your own SIEM."
section: "guides"
status: "Building for 0.3"
spec: "security-events"
canonical: "https://mainsdk.dev/docs/guides/watch-for-security-events"
updated: "2026-10-28"
---

# Watch for security events

> Write the app's own security events, listen for the ones the SDK writes, detect brute force and probing, and send them to your own SIEM.

Status: Building for 0.3 · Canonical: https://mainsdk.dev/docs/guides/watch-for-security-events · Updated: 2026-10-28

You will turn on the detectors, send events to your collector and add one event of your own. It takes about 15 minutes.

## You need

- A MainSDK app with `auth` set up.
- An OpenTelemetry collector, if you want events outside the app.

## 1. Choose where events go and what detects

```yaml title="main.yaml"
security:
  events:
    to: [log, otel]
    min: low
  detect:
    brute-force: { failures: 10, window: 5m }
    stuffing: { accounts: 20, window: 5m }
    probing: { denials: 20, window: 1m }
```

`log` is always on. Read it with `mainsdk logs --security`. The detectors report and never block.

## 2. Add an event of your own

```ts title="app/refunds.ts"
import { security } from "mainsdk";

security.emit({ type: "app.refund_spike", severity: "medium", message: "Refunds above the daily norm", attrs: { count: 41 } });
```

The type must start with `app.`, or the call is refused with `MAIN-SECURITY-0005`. The SDK writes the catalogue events itself.

## 3. Listen

```ts title="app/alerts.ts"
import { security } from "mainsdk";

const stop = security.on("auth.*", (e) => console.log(e.type, e.severity));
```

## Check that it works

- Fail a sign-in ten times: `mainsdk logs --security` shows `auth.brute_force`.
- Every event holds a keyed user hash and a trimmed address, never the raw values.

## Next

- [Security events reference](https://mainsdk.dev/docs/interfaces/security)
- [Raise and route alerts](https://mainsdk.dev/docs/guides/raise-and-route-alerts)