Clarification on Logging for Access Control List (ACL) Logs

This article addresses common questions related to Auth0 tenant logs and the Tenant Access Control List feature. 

• Attack Protection
• Access Control List
• Tenant Logs

How to determine the number of requests blocked by ACL?

• The match.success attribute in the acls_summary log has this information.

Does Auth0 provide default logs for requests blocked by ACL? 

• The acls_summary log is the default log used for this purpose. 

Is it possible to identify which rule and source IP were blocked?

• The acl_id in tenant's acls_summary log has the information. If multiple IPs are blocked with a single ACL, there will be only one acl_id associated with those IPs, and the acls_summary log will not show details about which of the IPs caused the block. If the tenant has the Attack Protection add-on, then up to 10 tenant ACLs can be created. If an ACL rule is created for blocking a single IP,  it is possible to find the source IP in the acls_summary log acl_id details.