Stop MFA fatigue

Cap MFA push bombing. An attacker with a user's password triggers repeated second-factor prompts, hoping the user approves one to stop the noise. Lidar's mfa_fatigue monitor surfaces this against a single subject so you can step in before a prompt is approved.

What you use

• The Lidar mfa_fatigue monitor (detection:mfa_fatigue challenges:>4 window:30m), correlated by subject.
• Optional: Bot protection v3 on mfa_verify to add a silent score to the challenge step.

Setup

1. Confirm Lidar access is approved for the environment.
2. Under Lidar > Monitors, enable mfa_fatigue. The default challenges:>4 window:30m is a starting point; lower challenges: for sensitive accounts or raise it if your UX legitimately retries MFA several times.
3. If you want a bot score on the challenge itself, enable reCAPTCHA v3 on mfa_verify under Authentication > Add-ons. v3 only; mfa_verify cannot render a visible checkbox.

Verify

• In dev, trigger MFA for one user more times than the challenges: floor within the window: a Signal appears against that subject, deduped by ai:mfa_fatigue:<subject>:<windowStart>.
• Confirm a user retrying MFA two or three times does not fire; the monitor keys on volume, not single retries.
• Triage the Signal in Lidar > Signals; suspending the user or rotating keys invalidates outstanding sessions on the next userinfo check.

Related

• MFA: the TOTP second factor this recipe protects.
• Lidar concepts: subject-keyed correlation and dedup.
• Security: session revocation and key rotation.