Lidar

Lidar is the console module for identity threat detection. Open it from the sidebar under Lidar (/dashboard/security). The module is scoped to the currently selected environment — pick a project and environment in the top navigation before you expect live data.

Lidar detects threats inside Authdog (monitors → findings → Signals). It is separate from SIEM log streaming, which forwards the raw event trail to external tools. For the detection model, see Lidar concepts.

Tabs

Request Lidar access

Lidar is feature-gated. On Overview, the access control badge reflects the environment's status for feature slug lidar:

Until access is approved, Overview detection panels stay gated so an empty state reads as locked rather than "no threats." After approval, Signals, Dashboards, and Monitors load from the threat-detection APIs for that environment.

Overview

Overview summarizes Lidar for the environment: protection status, detection category labels (bot, brute force, impossible travel, and related buckets), and a short feature list. Category cards can stay sparse until the environment has auth traffic and Lidar is analyzing events.

Monitors

Monitors lists the detector catalog for the environment. Authdog seeds a default set the first time you open monitors for that environment (brute force, impossible travel, bot, breached password, rate limit, unrecognized device, stale account, repeat signup, credential stuffing, MFA fatigue, privilege escalation).

For each monitor you can:

• Enable / disable the detector
• Edit the query (must start with detection:<id>)
• Change severity (low, medium, high, critical)

Example queries:

detection:brute_force attempts:>100 window:5m
detection:impossible_travel distanceKm:>5000
detection:bot botScore:>0.9

Useful tokens:

Saving a monitor updates the per-environment row used by the analysis pipeline. Disabled monitors do not produce new Signals.

Signals

Signals shows live Lidar detections for the selected environment. Each row maps a finding to a console Signal: severity, title, detection type, user or IP subject, rule (lidar.<detectionType>), and status.

Use the search bar with field tokens:

detection:brute_force
ip:52.94.236.248
user:eve
detection:impossible_travel status:critical

Open a Signal to inspect confidence, model, event count, and recommended action when present. The same burst of traffic can raise multiple Signals when several detectors match; correlate by user, IP, and time.

Select a time range before expecting a full list — Signals load detections since the chosen window.

Dashboards

Dashboards charts Signal severity over the selected range (for example 1h, 4h, 24h, 7d). It uses the same Signals feed as the explorer, bucketed for a timeline view. Empty charts usually mean no approved access, no selected environment, or no detections in range.

Practical limits

• A selected environment is required for Signals, Dashboards, and Monitors.
• Access must be approved before protection is considered active.
• Numeric monitor thresholds are often soft (prompt + floor), not hard batch gates.
• Breached-password policy enforcement in Authentication remains a separate prototype; Lidar can still raise breached-password Signals when those attributes appear on events.
• Overview marketing stats may not mirror every live Signal until traffic and analysis catch up.

Related