Detect threats in your logs

Sazabi reads the logs you already send and opens a security issue when they show someone attacking your application, using an account in an unusual way, or writing a secret where it doesn’t belong. You write no rules. The Sazabi agent sets up and maintains the sensors that watch for these, investigates when one fires, and opens an issue when the finding is real. Sazabi reports what reached your logs. It doesn’t block traffic or change your systems.

What Sazabi catches

Detection	What it catches	Issue categories it feeds
Attack payloads	SQL injection, path traversal, SSRF or template injection attempts in requests, such as `../../etc/passwd` in a file parameter.	Active attack
Exploit attempts	Traffic that matches a known exploit against your stack.	Active attack
Authentication anomalies	Failed-login bursts, credential stuffing, impossible travel and session reuse.	Active attack, Suspicious access
Privilege changes	New admins, role escalations and new API keys.	Suspicious access
Unusual data egress	Large exports or responses to a single actor.	Suspicious access
Bots and scraping	High-rate clients, headless browsers and rotating IPs.	Abuse and fraud
Secrets or personal data in logs	Tokens, keys, emails or ID numbers written to logs, such as an API key printed in an error message.	Exposure, Observability gap

Issues from these detections carry the Security type, with the categories above where they apply. See Types and categories for what each category means. Attack detections cover traffic that reaches your application, not traffic your firewall blocks entirely.

What the detections read

Detections read the logs you send:

Privilege changes come from security log sources.
Attack payloads, exploit attempts, authentication anomalies, bots and scraping, and unusual data egress come from security log sources and from your cloud platforms’ logs.
Secrets or personal data in logs come from cloud platforms, SDKs, observability tools and telemetry pipelines.

A detection can only report what your logs contain. A login route that logs nothing can’t show a credential spray. The security log sources are AWS CloudTrail, AWS GuardDuty, AWS WAF, Auth0, Doppler, GitHub Audit Log, HashiCorp Vault, Jamf Pro, Linux auditd, Okta, osquery, Palo Alto Networks, SentinelOne, Tailscale, Unkey, WorkOS and Zscaler. Connect one from Settings > Log streams, or see How integrations work for every source.

From a detection to an issue

When a detection fires, Sazabi records a signal: what changed, where and when, with your own log lines or values as evidence. The agent then investigates in your logs. It opens an issue when the finding is real, and closes the investigation without one when the change is harmless. A security issue is a normal issue. It has a name, a description, a severity, a Security type with categories, an optional component and the usual lifecycle. Severity follows impact: a security exposure happening now in production is critical. If the same problem recurs while its issue is open or ignored, Sazabi adds the recurrence to that issue instead of opening a second one. List the signals and the open security issues from the CLI:

npx -y @sazabi/cli@latest signals list --type sensor
npx -y @sazabi/cli@latest issues list --type security --status open
npx -y @sazabi/cli@latest issues list --category active_attack

In the dashboard, the issue inbox shows each issue’s classification as a badge, such as Security (Active attack), and its filter menu narrows the list by type.

Example

This is an illustration, not output from a real project. Failed logins arrive across several hundred accounts, each from a different address, with no successful login from those addresses. Sazabi might open an issue named “Failed logins across many accounts from rotating addresses” with severity high and the type Security (Active attack). Its report lists the failure counts, the address spread and the absence of successes.

Secrets found in logs

When the agent quotes a secret in an issue’s report, name or description, Sazabi masks it before the issue is stored. A masked value keeps what identifies it, such as the key name or a token’s prefix, and at most the first four characters of a long value. The rest becomes [REDACTED]. The dashboard, API, MCP server, cards and webhooks all show the masked text. Masking applies to issue content only. The log line that held the secret is unchanged and stays in your log storage. Treat a secret that reached a log as exposed and rotate it. To redact common secret and personal-data patterns from logs as they arrive, turn on Redact sensitive data in Settings > Project. See Data handling.

Route security issues to your team

An issue reaches a shared channel only when a delivery rule sends it there. To send security issues to a security channel, open the project’s Settings > Notifications, choose Delivery rules > Add delivery rule, pick Issue triggered and set the condition Type is one of to Security. Or create the rule from the CLI:

npx -y @sazabi/cli@latest notifications delivery-rules create \
  --notification-type issue_triggered \
  --destination slack_channel:C0SEC \
  --type security

Add a Severity is one of condition that selects high and critical to route only the urgent ones and leave the rest in the inbox. Rules match on types, not categories. See Route notifications.

Steer what Sazabi reports

You don’t create, edit or mute detections. To shape what you see, work through the issue:

Ignore an issue that needs no fix, such as a known scanner your team runs. See Issues.
Add context about your system for the agent with project memory. See Use project memory.
Ask in plain words for a specific question to be watched. See Sensors.

Code vulnerabilities

To scan your connected repositories for vulnerabilities, see Security review. It files confirmed code findings as issues, separate from the log detections on this page.

Sensors

How the Sazabi agent sets up and maintains what watches your logs.

Notification types

Every event Sazabi can send and where it can be delivered.

Get started

Send data

Detect issues

Triage issues

Ask Sazabi

Explore logs

Ship fixes

Manage account

Detect threats in your logs

What Sazabi catches

What the detections read

From a detection to an issue

Example

Secrets found in logs

Route security issues to your team

Steer what Sazabi reports

Code vulnerabilities

Further reading

Sensors

Notification types

​What Sazabi catches

​What the detections read

​From a detection to an issue

​Example

​Secrets found in logs

​Route security issues to your team

​Steer what Sazabi reports

​Code vulnerabilities

​Further reading

Sensors

Notification types

What Sazabi catches

What the detections read

From a detection to an issue

Example

Secrets found in logs

Route security issues to your team

Steer what Sazabi reports

Code vulnerabilities

Further reading