The three things you should never have to go looking for — a stale/failed backup, an unreviewed security queue, or a spike that looks like abuse or exfiltration. Fuller telemetry lives on the
Metrics page.
Nightly PostgreSQL dump → local + offsite Storage Box. A backup older than the threshold, or a recorded failure, is the alarm.
Unreviewed queues that need a human. Non-zero "pending" is the signal.
Derived from login events, admin actions and signups. Brute-force = failed-login spikes across many IPs; account takeover / sharing = one account signing in from many IPs; exfiltration = unusual admin-action or signup volume.
Top IPs by failed logins (24h)
| IP address | Failed attempts |
|---|
| — |
Accounts logging in from ≥3 IPs (24h)