Viewing threat protection metrics
The metrics that your user pool publishes have statistical information about the effect that your threat protection settings have on user authentication activity. You might want to know how many users are attempting to sign in with compromised credentials. You can also find out what percentage of sign-in activity was evaluated to have some level of risk. Amazon Cognito publishes metrics for threat protection features to your account in Amazon CloudWatch. Amazon Cognito groups the threat protection metrics together by risk level and also by request level.
To add context to your risk analysis, you can view information about individual user sign-in attempts, either in your user pool or in an exported data source.
To view metrics in the CloudWatch console
-
Open the CloudWatch console at https://console.aws.amazon.com/cloudwatch/
. -
In the navigation pane, choose Metrics.
-
Choose Amazon Cognito.
-
Choose a group of aggregated metrics, such as By Risk Classification.
-
The All metrics tab displays all metrics for that choice. You can do the following:
-
To sort the table, use the column heading.
-
To graph a metric, select the check box next to the metric. To select all metrics, select the check box in the heading row of the table.
-
To filter by resource, choose the resource ID, and then choose Add to search.
-
To filter by metric, choose the metric name, and then choose Add to search.
-
|
Metric |
Description |
Metric Dimensions |
|---|---|---|
|
CompromisedCredentialRisk |
Requests where Amazon Cognito detected compromised credentials. |
Operation: The type of operation. UserPoolId: The identifier of the user pool. RiskLevel: high (default), medium, or low. |
|
AccountTakeoverRisk |
Requests where Amazon Cognito detected account take-over risk. |
Operation: The type of operation. UserPoolId: The identifier of the user pool. RiskLevel: high, medium, or low. |
|
OverrideBlock |
Requests that Amazon Cognito blocked because of the configuration provided by the developer. |
Operation: The type of operation. UserPoolId: The identifier of the user pool. RiskLevel: high, medium, or low. |
|
Risk |
Requests that Amazon Cognito marked as risky. |
Operation: The type of operation, such as UserPoolId: The identifier of the user pool. |
|
NoRisk |
Requests where Amazon Cognito did not identify any risk. |
Operation: The type of operation, such as UserPoolId: The identifier of the user pool. |
Amazon Cognito offers you two predefined groups of metrics for ready analysis in CloudWatch. By Risk Classification identifies the granularity of the risk level for requests that Amazon Cognito identifies as risky. By Request Classification reflects metrics aggregated by request level.
|
Aggregated Metrics Group |
Description |
|---|---|
|
By Risk Classification |
Requests that Amazon Cognito identifies as risky. |
|
By Request Classification |
Metrics aggregated by request. |
