Lidar

Lidar is Authdog's native identity threat detection. It watches the authentication event stream for each environment, correlates related activity, and surfaces Signals operators can triage in the console.

Lidar is not the same as SIEM log forwarding. Lidar detects threats inside Authdog. SIEM channels stream the raw event trail to Datadog, Splunk, Sentinel, and similar tools. Most teams use both: Lidar for identity-aware detections, SIEM for long-term correlation outside Authdog.

For the operator walkthrough, see Lidar in the console.

How it works

Lidar runs as parallel correlating slices over auth events:

1. Monitors define which detectors run and how they are tuned (query, severity, enabled).
2. Auth events are classified into classes such as authn.failure or authn.success.
3. Events are grouped by IP, subject (user), or environment, depending on the detector.
4. Matching detectors produce a finding when the analysis marks the group suspicious.
5. Findings appear in the console as Signals.

monitor.query  →  detector + thresholds (per environment)
events         →  classify
groupBy        →  correlate (subject | ip | environment)
finding        →  threats row (deduped)
console Signal →  SecOps UI over that row

Findings are environment-scoped and stored in the platform threats store, so the same detection is readable from Lidar Signals and from the threats API.

Monitors and detectors

Every environment seeds a default monitor catalog. Operators can enable or disable monitors and edit the query string and severity. A monitor query always starts with detection:<id> and may add threshold tokens:

Some tokens change analysis windows or minimum event floors in code (window:, attempts:, priorAccounts:, dormantDays:). Others are advisory text injected into the detector prompt (botScore:, distanceKm:, observed:, action:). Treat high numeric thresholds as guidance for the model, not a hard in-batch count gate.

Findings and deduplication

When a detector returns a suspicious verdict, Authdog upserts a finding keyed by:

ai:<detectorId>:<subject>:<windowStart>

Redelivery of the same analysis window refreshes the verdict instead of creating a duplicate alert. Operator triage fields (status, assignee, resolution) survive re-analysis.

A single burst of auth traffic can produce multiple Signals when several detectors match different correlation keys. Triage joins on user, IP, and time — not a single combined row.

Lidar vs audit logs vs SIEM

Audit data alone is not a threat decision. Lidar findings are derived detections; they can be wrong or incomplete if history or queue processing is degraded. Always correlate with neighboring audit events before remediating.

Access and environment scope

Lidar is gated per environment. Until access is approved, the Overview shows a request flow rather than live protection. Monitors, Signals, and Dashboards require a selected environment and approved Lidar access to show meaningful data.

Related