Why aren't user.login.suspicious webhook events firing despite emails being sent?

[FASupportBot]

After upgrading FusionAuth, we're seeing suspicious login emails being sent to end users, but we're not receiving user.login.suspicious webhook events in our webhook logs. We've confirmed:

• The webhook has user.login.suspicious set to true in eventsEnabled
• The webhook is scoped to the specific tenant where logins are occurring
• Other webhook events (like user.action, user.password.reset.success, etc.) are working correctly
• Reactor license is activated
• Users are definitely receiving suspicious login emails, confirming the events are being triggered

Our webhook configuration shows:

{
  "eventsEnabled": {
    "user.login.suspicious": true,
    // ... other events
  },
  "tenantIds": ["<your-tenant-id>"],
  "global": false
}

What configuration might we be missing to receive these webhook events?

[FASupportBot]

The user.login.suspicious webhook event requires the Client Risk Configuration to be enabled at the tenant level. Even though Risk Signals are evaluated by default, the webhook event itself won't fire unless this configuration is explicitly turned on.

To enable it:

1. Navigate to Tenants → Select your tenant → Edit → Security tab
2. Find the Client Risk Configuration section
3. Ensure it's enabled for your tenant

Additionally, verify that the user.login.suspicious event is enabled in the tenant's webhook settings:

1. Go to Tenants → Select your tenant → Edit → Webhooks tab
2. Confirm user.login.suspicious is checked/enabled

Once both are configured, your webhook should start receiving user.login.suspicious events along with details about which Risk Signals triggered the suspicious login determination.

About Risk Signals and Email Volume

If you're seeing a significant increase in suspicious login emails after upgrading to 1.68.0 or later, this is because FusionAuth introduced comprehensive Risk Signals in version 1.68.0. Previously, only Impossible Travel was tracked. Now additional signals are evaluated including:

• Untrusted Device
• Unrecognized Device
• Recent Password Change
• Recent Identity Change
• Dormant Password
• Suspicious Agent

All Risk Signals are enabled by default without any configuration changes.

Managing Email Volume

You can tune which Risk Signals trigger suspicious login alerts:

1. Go to Tenants → Select tenant → Edit → Security tab → Client Risk Configuration
2. Disable specific Risk Signals that are generating too many false positives for your use case

Monitoring Without Sending Emails

You can monitor webhook events while tuning your Risk Signals without sending emails to users:

1. Go to your tenant/application settings → Identities tab
2. Change the Suspicious Login template to "No Template Selected"
3. Monitor your webhook endpoint to see which Risk Signals are triggering
4. Fine-tune your Risk Signal configuration
5. Re-enable the email template once you're satisfied with the detection accuracy

The webhook fires whenever a Risk Signal threshold is met, independent of whether an email template is configured. This allows you to observe and tune the system before alerting end users.