Auth0

The Auth0 source is a webhook based source that uses their log stream feature.

To get started, create an auth0 source in the dashboard. The source should have a webhook URL and a Bearer Token that is available in the sources list.

Setup

Under monitoring > streams, create a new Custom Webhook log stream. Set the webhook URL to the api.runreveal.com URL provided in your auth0 source, and in Auth0 set the Bearer token value to the entirity of the bearer token string provided by RunReveal. This should include the word Bearer. Your bearer token string should look something like Bearer xxxxxxxxxxxxxxxxx.

Finally, ensure that the stream is configured as a JSON Array and click save after ensuring that all events are being sent.

Logs should begin flowing to your Auth0 source immediately!

Verify It's Working

Once added the source logs should begin flowing within a minute.

You can validate we are receiving your logs by running the following SQL query.

SELECT * FROM runreveal.logs WHERE sourceType = 'auth0' LIMIT 1

Schema

The following columns are exposed for this source. RunReveal applies schema normalization across all sources, ensuring uniform field names and data types for cross-source queries and reusable detection logic.