# User Login Suspicious Event Learn about the User Login Suspicious event. > For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt) ## User Login Suspicious > **PLAN:** This feature requires [an Enterprise plan](https://fusionauth.io/docs/concepts/plans-and-limits/plans-features.md#enterprise-features). Available since `1.30.0` This event is generated when a user logs in and FusionAuth has considered them to be a potential threat. Event type user.login.suspicious ### Event Scope This is a tenant-scoped event. Prior to version `1.37.0` this event was sent to all webhooks, and it was a webhook's responsibility to filter on the **tenantId** field. In version `1.37.0` and later, this event will only be sent to tenants for which webhooks for this event are enabled. ### Transaction Compatibility This event is transactional. The final state of the operation which caused the webhook is not persisted to FusionAuth until after the webhook finishes; [learn more](https://fusionauth.io/docs/events/webhooks/writing-a-webhook.md#calling-fusionauth-apis-in-webhooks) ### Event Body `event.applicationId` * Type: `UUID` The unique Id of the Application for which the user has requested login. If the login request omits the **applicationId** or the user is not registered for the requested **applicationId** this value will not be returned in the event. `event.cimdDomainId` * Type: `UUID` * Available since `1.70.0` The unique Id of the [CIMD domain](https://fusionauth.io/docs/concepts/types/cimd-domains.md) when the user logged in through a [CIMD client](https://fusionauth.io/docs/authentication/oauth/client-registration.md#client-id-metadata-documents). For these logins, **applicationId** is not returned. FusionAuth includes **cimdDomainId** whether or not the user is registered. `event.authenticationType` * Type: `String` The type of authentication used in the login request. The possible values are: * `APPLE` - The user was authenticated using Apple. * `APPLICATION_TOKEN` - The user was authenticated using an Application Authentication Token. * `EpicGames` - The user was authenticated using Epic Games. * `FACEBOOK` - The user was authenticated using Facebook. * `FEDERATED_JWT` - The user was authenticated using a JWT from an external source. * `GENERIC_CONNECTOR` - The user was authenticated using a generic connector. * `GOOGLE` - The user was authenticated using Google. * `HYPR` - The user was authenticated using HYPR. * `JWT_SSO` - A valid JWT associated with one application was exchanged for another JWT associated with a different application. * `LDAP_CONNECTOR` - The user was authenticated using an LDAP connector. * `LINKEDIN` - The user was authenticated using LinkedIn. * `Nintendo` - The user was authenticated using Nintendo. Available since `1.36.0` * `ONE_TIME_PASSWORD` - The user was authenticated using a one-time password. * `OPENID_CONNECT` - The user was authenticated using OIDC. * `PASSWORD` - The user was authenticated using a loginId and password combination. * `PASSWORDLESS` - The user was authenticated using a passwordless login link. * `PING` - The user was authenticated using a `PUT` request on the Login API. This is used to record a login event without prompting for credentials, such as when the FusionAuth SSO session is used. * `REFRESH_TOKEN` - The user requested a new JWT using a refresh token. * `REGISTRATION` - The user was created using the Registration API. * `SAMLv2` - The user was authenticated using SAMLv2. * `SAMLv2IdpInitiated` - The user was authenticated using SAMLv2 IdP Initiated login. * `SonyPSN` - The user was authenticated using Sony. * `Steam` - The user was authenticated using Steam. * `TWITTER` - The user was authenticated using Twitter. * `Twitch` - The user was authenticated using Twitch. * `USER_CREATE` - The user was created using the User API. * `WebAuthn` - The user was authenticated using a passkey. Available since `1.41.0` * `Xbox` - The user was authenticated using Xbox. `event.connectorId` * Type: `UUID` The unique Id of the connector used to complete the login. `event.createInstant` * Type: `Long` The [instant](https://fusionauth.io/docs/apis/data-types.md#instants) that the event was generated. `event.id` * Type: `UUID` The unique Id of the event. You may receive an event more than once based upon your transaction settings. This Id may be used to identify a duplicate event. `event.identityProviderId` * Type: `UUID` The unique Id of the identity provider used to complete the login. This value will be omitted from the event if an identity provider was not used. `event.identityProviderName` * Type: `String` The name of the identity provider used to complete the login. This value will be omitted from the event if an identity provider was not used. `event.info.data` * Type: `Object` * Available since `1.30.0` An object that can hold any information about the event that should be persisted. `event.info.deviceDescription` * Type: `String` * Available since `1.30.0` The description of the device associated with the event. `event.info.deviceName` * Type: `String` * Available since `1.30.0` The device name associated with the event. `event.info.deviceType` * Type: `String` * Available since `1.30.0` The type of device associated with the event. `event.info.ipAddress` * Type: `String` * Available since `1.27.0` The source IP address of the event. `event.info.location.city` * Type: `String` * Available since `1.30.0` The city where the event originated. **Enterprise plan** To use event location data, you'll need [an Enterprise plan](https://fusionauth.io/docs/concepts/plans-and-limits/plans-features.md#enterprise-features). `event.info.location.country` * Type: `String` * Available since `1.30.0` The country where the event originated. **Enterprise plan** To use event location data, you'll need [an Enterprise plan](https://fusionauth.io/docs/concepts/plans-and-limits/plans-features.md#enterprise-features). `event.info.location.latitude` * Type: `Double` * Available since `1.30.0` The latitude where the event originated. **Enterprise plan** To use event location data, you'll need [an Enterprise plan](https://fusionauth.io/docs/concepts/plans-and-limits/plans-features.md#enterprise-features). `event.info.location.longitude` * Type: `Double` * Available since `1.30.0` The longitude where the event originated. **Enterprise plan** To use event location data, you'll need [an Enterprise plan](https://fusionauth.io/docs/concepts/plans-and-limits/plans-features.md#enterprise-features). `event.info.location.region` * Type: `String` * Available since `1.30.0` The geographic location where the event originated. **Enterprise plan** To use event location data, you'll need [an Enterprise plan](https://fusionauth.io/docs/concepts/plans-and-limits/plans-features.md#enterprise-features). `event.info.location.zipcode` * Type: `String` * Available since `1.30.0` The zip code where the event originated. **Enterprise plan** To use event location data, you'll need [an Enterprise plan](https://fusionauth.io/docs/concepts/plans-and-limits/plans-features.md#enterprise-features). `event.info.os` * Type: `String` * Available since `1.30.0` The operating system associated with the event. `event.info.userAgent` * Type: `String` * Available since `1.30.0` The user agent associated with the event. `event.linkedObjectId` * Type: `UUID` * Available since `1.53.0` The Id of the user related to this event. `event.tenantId` * Type: `UUID` The unique tenant identifier. This value may not be returned if not applicable. `event.threatsDetected` * Type: `Array` The types of potential threats that have been flagged for this event. For a full list of potential threats, see [risk signals](https://fusionauth.io/docs/security/account-protection/risk-signals.md); FusionAuth fires this event whenever any enabled risk signal returns a `HIGH` value. `event.type` * Type: `String` The event type, this value will always be `{eventType}`. `event.user` * Type: `Object` The user that completed the login request. See the [Users API](https://fusionauth.io/docs/apis/users.md) for property definitions and example JSON Example Event JSON ```json { "event": { "applicationId": "134f7157-0252-4100-889e-8b3084b85660", "authenticationType": "PASSWORD", "connectorId": "e3306678-a53a-4964-9040-1c96f36dda72", "createInstant": 1630383272048, "id": "0f2a3e31-d7c9-48dc-841a-b47ca4830773", "info": { "ipAddress": "42.42.42.42", "location": { "city": "Denver", "country": "US", "displayString": "Denver, CO, US", "latitude": 39.77777, "longitude": -104.9191, "region": "CO" }, "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36" }, "ipAddress": "127.0.0.1", "tenantId": "30663132-6464-6665-3032-326466613934", "threatsDetected": [ "ImpossibleTravel" ], "type": "user.login.suspicious", "user": { "active": true, "birthDate": "1981-06-04", "connectorId": "e3306678-a53a-4964-9040-1c96f36dda72", "data": { "Company": "PiedPiper", "PreviousCompany": "Aviato", "user_type": "iconclast" }, "email": "example@fusionauth.io", "firstName": "Erlich", "id": "00000000-0000-0000-0000-000000000001", "insertInstant": 1630083026349, "lastLoginInstant": 1630383233716, "lastName": "Bachman", "lastUpdateInstant": 1630083026349, "memberships": [], "passwordChangeRequired": false, "passwordLastUpdateInstant": 1630083026431, "preferredLanguages": [], "registrations": [], "tenantId": "30663132-6464-6665-3032-326466613934", "twoFactor": { "methods": [], "recoveryCodes": [] }, "usernameStatus": "ACTIVE", "verified": true } } } ``` Related [Events User Login Failed Event Learn about the User Login Failed event. fusionauth authenticationwebhook event](https://fusionauth.io/docs/events/reference/user/login/user-login-failed.md) [Events User Login New Device Event Learn about the User Login New Device event. fusionauth authenticationwebhook event](https://fusionauth.io/docs/events/reference/user/login/user-login-new-device.md) [Events User Login Success Event Learn about the User Login Success event. fusionauth authenticationwebhook event](https://fusionauth.io/docs/events/reference/user/login/user-login-success.md) [Events Audit Log Create Event Learn about the Audit Log Create event. webhook event](https://fusionauth.io/docs/events/reference/audit-log-create.md) --- ## Other pages in Login > For the full index of this section, see [Events](https://fusionauth.io/docs/llms-events.txt). - [User Login Failed Event](https://fusionauth.io/docs/events/reference/user/login/user-login-failed.md): Learn about the User Login Failed event. - [User Login Id Duplicate Create Event](https://fusionauth.io/docs/events/reference/user/login/user-login-id-duplicate-create.md): Learn about the User Login Id Duplicate Create event. - [User Login Id Duplicate Update Event](https://fusionauth.io/docs/events/reference/user/login/user-login-id-duplicate-update.md): Learn about the User Login Id Duplicate Update event. - [User Login New Device Event](https://fusionauth.io/docs/events/reference/user/login/user-login-new-device.md): Learn about the User Login New Device event. - [User Login Success Event](https://fusionauth.io/docs/events/reference/user/login/user-login-success.md): Learn about the User Login Success event.