The user.login.suspicious webhook event requires the Client Risk Configuration to be enabled at the tenant level. Even though Risk Signals are evaluated by default, the webhook event itself won't fire unless this configuration is explicitly turned on.

To enable it:

Navigate to Tenants → Select your tenant → Edit → Security tab Find the Client Risk Configuration section Ensure it's enabled for your tenant

Additionally, verify that the user.login.suspicious event is enabled in the tenant's webhook settings:

Go to Tenants → Select your tenant → Edit → Webhooks tab Confirm user.login.suspicious is checked/enabled

Once both are configured, your webhook should start receiving user.login.suspicious events along with details about which Risk Signals triggered the suspicious login determination.

About Risk Signals and Email Volume

If you're seeing a significant increase in suspicious login emails after upgrading to 1.68.0 or later, this is because FusionAuth introduced comprehensive Risk Signals in version 1.68.0. Previously, only Impossible Travel was tracked. Now additional signals are evaluated including:

Untrusted Device Unrecognized Device Recent Password Change Recent Identity Change Dormant Password Suspicious Agent

All Risk Signals are enabled by default without any configuration changes.

Managing Email Volume

You can tune which Risk Signals trigger suspicious login alerts:

Go to Tenants → Select tenant → Edit → Security tab → Client Risk Configuration Disable specific Risk Signals that are generating too many false positives for your use case Monitoring Without Sending Emails

You can monitor webhook events while tuning your Risk Signals without sending emails to users:

Go to your tenant/application settings → Identities tab Change the Suspicious Login template to "No Template Selected" Monitor your webhook endpoint to see which Risk Signals are triggering Fine-tune your Risk Signal configuration Re-enable the email template once you're satisfied with the detection accuracy

The webhook fires whenever a Risk Signal threshold is met, independent of whether an email template is configured. This allows you to observe and tune the system before alerting end users.

@saleenajohn49 said in Clicked the regenerate key button on the reactor page:

A nuclear reactor produces and controls the release of energy from splitting the atoms of certain elements. In a nuclear power reactor, the energy released is used as heat to make steam to generate electricity. (In a research reactor the main purpose is to utilise the actual neutrons produced in the core. In most naval reactors, steam drives a turbine directly for propulsion.

Ha ha.. yep, that is pretty much how the FusionAuth Reactor works too. 😆

If you are running Advanced Threat Detection, you need at least 2GB of memory for each FusionAuth node.

Here's the system requirements: https://fusionauth.io/docs/v1/tech/installation-guide/system-requirements/ which document the 2GB requirement when using this feature.

We understand that sometimes you want to "kick the tires" to ensure that a feature will work for you, especially if you are going to pay for it.

You have two main options.

The first, which gives you the most flexibility, is to do the following:

Install the FusionAuth community edition somewhere (see the installation guide for all the options) Sign up for a developer license trial. This will require you to enter your credit card, but it will not be charged for the length of the trial (2 weeks at the time I write this). Follow the directions on the reactor page to install the license and activate the features. Cancel the trial at the end of the two weeks or before, if the features don't meet your needs. (We'd love feedback on how they didn't meet your needs, too! Please file issues to help us improve.)

The second option, which requires a lot less work but will give you less control, is to use the sandbox site. This lives at https://sandbox.fusionauth.io/ . With this option, you don't need to enter your credit card, sign up for an account or remember to cancel. This instance has a valid developer license, allowing access to all the premium features.

However, there are limitations:

Any information you enter is public and can be viewed by anyone else looking at the sandbox at the same time The sandbox environment is reset regularly to a known state, so your changes will be wiped at that time.