<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Credential Stuffing Detection — API Reference

## Azure AD Sign-in Logs (KQL)

```kql
// Distributed authentication failures — credential stuffing indicator
SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType != 0
| summarize FailureCount=count(),
    DistinctIPs=dcount(IPAddress),
    DistinctUsers=dcount(UserPrincipalName),
    DistinctAgents=dcount(UserAgent)
    by bin(TimeGenerated, 5m)
| where DistinctIPs > 50 and DistinctUsers > 20
| order by TimeGenerated desc

// Impossible travel detection
SigninLogs
| where ResultType == 0
| project UserPrincipalName, TimeGenerated, IPAddress, Location
| sort by UserPrincipalName, TimeGenerated asc
| serialize
| extend PrevLocation = prev(Location), PrevTime = prev(TimeGenerated),
         PrevUser = prev(UserPrincipalName)
| where UserPrincipalName == PrevUser
| where Location != PrevLocation
| extend TimeDiffMinutes = datetime_diff('minute', TimeGenerated, PrevTime)
| where TimeDiffMinutes < 60
```

## Okta System Log API

```bash
# Failed login events in last hour
curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/logs?\
filter=eventType+eq+%22user.session.start%22+and+outcome.result+eq+%22FAILURE%22\
&since=$(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%SZ)" | jq .

# ThreatInsight configuration
curl -s -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  "https://${OKTA_DOMAIN}/api/v1/threats/configuration" | jq .

# Enable ThreatInsight in audit mode
curl -s -X POST -H "Authorization: SSWS ${OKTA_API_TOKEN}" \
  -H "Content-Type: application/json" \
  "https://${OKTA_DOMAIN}/api/v1/threats/configuration" \
  -d '{"action": "audit"}'
```

## Microsoft Graph — Identity Protection

```bash
# Risky sign-ins
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/identityProtection/riskyUsers?\
\$filter=riskLevel eq 'high'" | jq .

# Risk detections
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" \
  "https://graph.microsoft.com/v1.0/identityProtection/riskDetections?\
\$filter=riskEventType eq 'unfamiliarFeatures'&\$top=50" | jq .
```

## Key Detection Thresholds

| Metric | Baseline | Alert Threshold |
|--------|----------|-----------------|
| Auth failures per 5 min | < 50 | > 200 |
| Distinct source IPs per 5 min | < 20 | > 100 |
| Distinct target users per 5 min | < 10 | > 50 |
| User-agent entropy | High | Low (< 3 unique agents) |
| Success rate during spike | > 95% | < 80% |
