Signals
Supported signal types
FrameRadar uses these v1 signal definitions to explain events, apply default severity, and generate clearer alerts.
Auth
Login failed
auth.login_failed
A login attempt failed.
Recommendation: Review authentication activity and rate limits for the affected account or source.
Login succeeded from new location
auth.login_succeeded_from_new_location
A user signed in from a location, network, or device not previously seen by the application.
Recommendation: Ask the account owner to confirm the sign-in when the context looks unusual.
Password reset requested
auth.password_reset_requested
A password reset flow was requested for an account.
Recommendation: Review repeated reset requests for abuse or account takeover attempts.
MFA challenge failed
auth.mfa_challenge_failed
A multi-factor authentication challenge failed.
Recommendation: Review recent sign-in attempts and consider prompting the user to secure the account.
Security
Permission denied
security.permission_denied
A request was denied by authorization rules.
Recommendation: Confirm the denied action was expected and investigate repeated attempts against sensitive resources.
Suspicious request blocked
security.suspicious_request_blocked
A request was blocked because it matched a suspicious or abusive pattern.
Recommendation: Review the blocked request pattern and tighten controls if similar attempts continue.
CSRF validation failed
security.csrf_validation_failed
A request failed CSRF validation or an equivalent request-origin protection check.
Recommendation: Check whether failures are isolated client issues or repeated attempts against state-changing routes.
Rate limit exceeded
security.rate_limit_exceeded
A client exceeded a rate limit.
Recommendation: Review rate-limit thresholds and investigate repeated activity from the same source.
Application
Error rate increased
application.error_rate_increased
The application observed an elevated error rate.
Recommendation: Review recent deploys, affected routes, and error samples to identify the cause.
Background job failed
application.background_job_failed
A background job, task, or asynchronous worker operation failed.
Recommendation: Check job retries, queue health, and the failure reason for repeated or business-critical failures.
Deployment completed
application.deployment_completed
A deployment completed.
Feature flag changed
application.feature_flag_changed
A feature flag, runtime toggle, or comparable behavior switch changed.
Recommendation: Confirm the change was expected, especially for production or security-sensitive flags.
Configuration
Debug mode enabled
configuration.debug_mode_enabled
Debug or verbose error output is enabled in an environment where it may expose sensitive details.
Recommendation: Disable debug output in public or production environments and rotate exposed secrets if needed.
Security header missing
configuration.security_header_missing
An expected security header is missing.
Recommendation: Add the missing header where appropriate and verify it is present on public responses.
Secret rotation due
configuration.secret_rotation_due
A secret, token, or credential is due for rotation.
Recommendation: Rotate the credential according to policy and confirm dependent services use the new value.
Integration disconnected
configuration.integration_disconnected
An expected integration stopped sending data or failed connectivity checks.
Recommendation: Restore the integration so monitoring and security visibility remain complete.
System
Health check failed
system.health_check_failed
A health check failed for a service, endpoint, or component.
Recommendation: Investigate the failing component and confirm whether users are affected.
Resource usage high
system.resource_usage_high
A runtime resource crossed a configured threshold.
Recommendation: Review resource trends and scale or optimize the affected component if pressure persists.
Clock drift detected
system.clock_drift_detected
A system clock drifted beyond an acceptable threshold.
Recommendation: Verify time synchronization because clock drift can affect authentication, signatures, and audit trails.
Queue backlog high
system.queue_backlog_high
A queue or asynchronous work backlog exceeded an expected threshold.
Recommendation: Review worker capacity and failing jobs so queued work can drain normally.
Connector offline
system.connector_offline
A connected application has not reported a heartbeat within the expected window.
Recommendation: Check the connector process, application logs, and network access to FrameRadar.