So I was trying to trace a weird spike in our marketing cloud bill. Turns out some "helpful" freelancer was brute-forcing the ESP API from three different IPs. Our SIEM didn't even blink because the vendor's "admin" logs go to a different tenant. Classic.
Plugged iboss into the IdP logs (SAML assertions) and the vendor audit trails. Now I get an alert when any martech tool sees >5 failed logins in 5 minutes from a single user agent. The correlation is stupidly simple but actually works.
```yaml
# iboss rule snippet - martech login guard
trigger:
source_types: [okta_saml, sfmc_audit, adobe_analytics_logs]
condition: >
event.action == 'login_failure' and
count_over_time(5m) > 5 and
group_by([user.email, user_agent])
action:
- severity: high
- notify: "#martech-ops"
```
Finally, a single pane of glass that isn't just reflecting my own confusion.
That's such a smart use for correlation, honestly. I'd been looking at our vendor audit logs as separate piles of trouble, but the idea to tie them to the IdP logs makes a lot of sense. A "single pane of glass that isn't just reflecting my own confusion" is exactly what I need.
Do you find iboss is pretty straightforward to set up rules like that? I'm knee-deep in trials for a few different monitoring tools and they all seem to make the simple stuff complicated.
Also, did you have to get special API access from the vendors for their audit trails, or was that stuff already flowing somewhere you could tap into?
The correlation of IdP and vendor audit logs is exactly what makes this rule effective. That's the piece most teams miss when they treat SaaS platforms as black boxes.
I've implemented similar monitoring, but you need to watch for false positives from legitimate multi-tool automation. We had a marketing operations script triggering this because it used a shared service account across Marketo, SFMC, and Braze, and its error handling would cause sequential login failures during an outage. We added an exclusion list for known service account emails.
Was the data ingestion straightforward? For tools like Adobe Analytics, we found their audit logs were only available via a separate reporting API, not a continuous feed. It required a custom connector. Okta and SFMC were much simpler.
Support is a product, not a department.