Lidar

Lidar is Authdog's identity SIEM. Open it from the sidebar (/dashboard/security — the route is security, the label is Lidar). The console subtitle is "Threat detection, monitoring, and security intelligence for your application". For the model, see Lidar concepts.

Per environment. A selected project and environment are required.

Lidar is sales-gated (feature slug lidar). Until access is approved, the page shows a locked landing — "Protect against bots, fraud, and abuse" — with Request access. That landing is not a tab. After approval, the default tab is Signals.

Optional notification channels copy the same trail to another SIEM if you already run one.

Signals

?tab=signals (default after approval). Live findings for the selected environment. Time range comes from the top bar. Columns: Time, Severity, Signal, User, IP, Rule (lidar.<detectionType>). Facets: Severity, Detection type, Origin, Synthetic, Country, Client IP, User.

Generate events (dev) and Clear synthetics exercise the pipeline with console fixtures. Label those rows synthetic. Do not use them in production screenshots.

Scan Logs

?tab=scan-logs. Analysis-run history for the environment: what the pipeline executed, raw events, and flags.

Scan Runs

?tab=scan-runs. Detector sweep history (queue, console analyze, or sweep). Expand a run for per-detector status and severity.

Monitors

?tab=monitors. Detector catalogue. Enable or disable each monitor, edit the detection:<id> query, set severity. Disabled monitors produce no new Signals.

Default monitors cover brute force, credential stuffing, impossible travel, MFA fatigue, bots, breached passwords, unrecognized devices, stale accounts, repeat signup, rate-limit spikes, and privilege changes. Query tokens: detection: (required), window:, attempts:, priorAccounts:, challenges:, dormantDays:, botScore:, distanceKm:, observed:, action:.

Posture

?tab=posture. Configuration posture for this environment — not behavioral detection. Score 0–100 plus category subscores (Authentication, Access Control, Secrets & Keys, Threat Protection, Monitoring). Findings are deterministic checks over the environment's own settings (password policy, redirect URIs, JWKS, rate limiting, bot/breach add-ons, webhook signing, Elevate MFA, audit forwarding). Rescan writes a history row. Acknowledge mutes a finding.

No external cloud connectors. This is Authdog-config posture only.

Limits

• Access must be approved before Signals, Scan Logs, Scan Runs, Monitors, and Posture are usable.
• Breached-password policy in Authentication is a separate control from the breached-password monitor.
• There is no Dashboards tab. Severity over time lives on Signals.

Related