ingestlayer/recipes

Monitor failed logins

Catch the login failures that look like an attack — repeated misses from one address — with geo and network context attached before they reach you.

the event

Emit login.failed once; route it anywhere below.

  • emailstring
  • ipstring
  • reasonstringbad-password | locked | mfa
  • attemptnumberconsecutive misses
emit login.failed
import { ingest } from "@ingestlayer/sdk";

await ingest("login.failed", {
  email:   creds.email,
  ip:      req.ip,
  reason:  result.reason,
  attempt: result.consecutive,
});

send it to