Vendors / Okta / Auth0 / Auth0 wrong-password authentication

Event type

Auth0 wrong-password authentication

Auth0 database authentication failure caused by a wrong password; registry identities and application, fresh UTC time and synthetic log identifiers.

JSON 19 fields Generator

auth0 authentication database fp

Preview Sample View Schema

CLI Install

meltr templates install okta

Overview

What this event covers

One documented fp scenario, with required registry fixture relationships. Requires source-specific entities: entities/okta/auth0/authentication.yaml; example configuration: configs/okta/auth0/authentication.yaml. Tested with MELTr rc3 commit 1e14e5defb66f6ac24decbe59c1c4f4e64877618. Entity fixtures must be selected per source; generic registry preview entities are not sufficient.

When generated

›A known database user supplies an incorrect password.

Security relevance

Informational

Frequency notes

Local test rate of 3600 events/hour. Example generator stops after five events.

Resources

Docs and tools

Auth0 log structure and failed-login example official

Generation

Configuration

Base frequency: 3600 events/hour
Business hours: 1.0x
Night hours: 1.0x
Weekend: 1.0x

Schema

Field definitions

Field reference for this event type — types, requirements, examples, and allowed values.

date

String Optional

Jinja: one `now()` value, serialized with MELTr `iso8601_utc` and sliced to milliseconds Fresh UTC ISO timestamp with milliseconds; test clock injection is confined to validation.

Source: Jinja: one `now()` value, serialized with MELTr `iso8601_utc` and sliced to milliseconds Fresh UTC ISO timestamp with milliseconds; test clock injection is confined to validation.

Example 2026-10-01T22:48:18.924Z

type

String Optional

Fixed `fp` Only the documented wrong-password branch.

Source: Fixed `fp` Only the documented wrong-password branch.

Example fp

description

String Optional

Fixed `Wrong email or password.` Same message as details.error.message.

Source: Fixed `Wrong email or password.` Same message as details.error.message.

Example Wrong email or password.

connection

String Optional

Fixed `Username-Password-Authentication` One database connection in this profile.

Source: Fixed `Username-Password-Authentication` One database connection in this profile.

Example Username-Password-Authentication

connection_id

String Optional

Fixed `con_ExampleLab01` Synthetic fixture identity for that connection.

Source: Fixed `con_ExampleLab01` Synthetic fixture identity for that connection.

Example con_ExampleLab01

client_id

String Optional

Registry: named service.service_id Stable per application; local alphanumeric/underscore/hyphen constraint.

Source: Registry: named service.service_id Stable per application; local alphanumeric/underscore/hyphen constraint.

Example ExampleLabClient01

client_name

String Optional

Registry: same service.description Nonempty display name; JSON escaping preserves special characters.

Source: Registry: same service.description Nonempty display name; JSON escaping preserves special characters.

Example Example Customer Portal

ip

String Optional

Registry: selected user’s named browser device.ip_address IPv4; fixtures use documentation addresses.

Source: Registry: selected user’s named browser device.ip_address IPv4; fixtures use documentation addresses.

Example 192.0.2.21

user_agent

String Optional

Fixed documented Chrome/macOS string Historical profile, not a current-browser claim; fixture device must match.

Source: Fixed documented Chrome/macOS string Historical profile, not a current-browser claim; fixture device must match.

Example Chrome 86.0.4240 / Mac OS X 10.15.6

details

Object Optional

Jinja dictionary Contains only error for this scenario.

Source: Jinja dictionary Contains only error for this scenario.

Example {"error":{"message":"Wrong email or password."}}

details.error

Object Optional

Jinja dictionary Contains only message for this scenario.

Source: Jinja dictionary Contains only message for this scenario.

Example {"message":"Wrong email or password."}

details.error.message

String Optional

Fixed wrong-password message Agrees with description.

Source: Fixed wrong-password message Agrees with description.

Example Wrong email or password.

user_id

String Optional

Jinja: `auth0|` plus registry user.user_id Stable across events for the selected user; synthetic mapping, not a provisioned Auth0 account.

Source: Jinja: `auth0|` plus registry user.user_id Stable across events for the selected user; synthetic mapping, not a provisioned Auth0 account.

Example auth0|37f967cdbf8ebf2727378558

user_name

String Optional

Registry: same user.email MELTr-valid email; no example.com-only restriction.

Source: Registry: same user.email MELTr-valid email; no example.com-only restriction.

Example ben.rivera@example.com

strategy

String Optional

Fixed `auth0` Database connection profile.

Source: Fixed `auth0` Database connection profile.

Example auth0

strategy_type

String Optional

Fixed `database` Paired with strategy and connection.

Source: Fixed `database` Paired with strategy and connection.

Example database

log_id

String Optional

Faker: `fake.numerify`, one call/event 57-digit synthetic value starting with 9; local test representation, not Auth0’s ID algorithm. Randomness is not a global uniqueness guarantee.

Source: Faker: `fake.numerify`, one call/event 57-digit synthetic value starting with 9; local test representation, not Auth0’s ID algorithm. Randomness is not a global uniqueness guarantee.

Example 976779132038249620293929323493172846334245207770795734897

_id

String Optional

Reuse event log_id Identical to log_id; included only because the reference example includes it.

Source: Reuse event log_id Identical to log_id; included only because the reference example includes it.

Example 976779132038249620293929323493172846334245207770795734897

isMobile

Boolean Optional

Fixed Jinja `false` Desktop browser profile; emitted as a JSON boolean.

Source: Fixed Jinja `false` Desktop browser profile; emitted as a JSON boolean.

Example false