Alert rules
Rules that act for you: when something keeps happening, slow the source, pause the key, end the session, ban, or tell you.
Open it now:Automation
How a rule works
A rule watches one kind of event and counts it for the person it came from (the license key, the machine or the IP address, whichever the event points at). When the count reaches the threshold inside the window, the rule's actions fire. For example: 15 failed sign-ins from one address within an hour bans that address for an hour.
A rule can have several actions, or none, which only records the event. A new application starts with a set of default rules that are on; you can edit them, switch them off and add your own. The default rules cannot be deleted, so switching one off is the way to retire it, and the confirmation for switching off the build check reminds you why it exists.
Events a rule can watch
| Group | Event | Fires when |
|---|---|---|
| Access | Failed authentications | Wrong keys or passwords, repeatedly. |
| Access | Expired license attempts | Expired keys keep trying. |
| Access | Banned key retried | A banned license tries to come back. |
| Access | Concurrency exceeded | A key is used on too many devices at once. |
| Account | Failed verifications, Verification flood | Wrong email codes repeatedly, or one account triggering many code requests. |
| Account | Mass key redemption | One account redeems many keys quickly. |
| Account | Password-reset flood | Many reset requests for one identifier or address. |
| Account | Device trust spike, Email used by many accounts | An account trusts many new devices, or one email sits on several accounts. |
| Identity | HWID mismatch, IP mismatch | A key is used from a machine or address other than the one it locked to. |
| Identity | New device, New IP | A license signs in from a machine or address never seen before. |
| Network | New country, Geofence violation | A new country, or a blocked one, signs in. |
| Network | VPN, Datacenter, Tor exit detected | The address is a VPN, a hosting range or a Tor exit. |
| Network | Impossible travel | The same license appears in cities over 500 km apart within an hour. |
| Network | Network-flagged machine | A machine that used unauthorized builds on several other applications signs in. |
| Network | Rapid requests | A burst of requests from one source. |
| Integrity | Unauthorized binary | A build that is not on the authorized list signs in. |
| Integrity | Stale binary version | A client older than 30 days. |
| Integrity | Client tamper reported | The program reports a debugger, a hook, a patch or an injection. |
| Integrity | Time skew | The customer's clock is far off. |
| Behavior | Auth after ban | A banned license signs in successfully, which means a ban leaked. |
| Behavior | Rapid HWID changes | A license bounces between machines faster than a reinstall would. |
Each event has its own range for the threshold and the window, shown in the editor. Values outside it are refused.
Actions
| Group | Action | What it does |
|---|---|---|
| Block | Ban the IP, Ban the hardware, Ban the license | A ban that lasts the duration you set, or forever if you leave it empty. |
| Block | Cascade ban | Bans the license, the device and the IP together, permanently. |
| Block | Account cascade ban | The same for an account. Permanent. |
| Slow | Throttle the IP | Each connection from the address waits 3 seconds for the duration you set. Requests still succeed. |
| Slow | Pause the license | Pauses the key. Fully recoverable: resume it from its row. |
| Slow | Require re-auth | Accounts only: forgets their trusted devices, so each re-verifies by email. |
| Session | Kill the session | Ends every live session of the license. They can sign in again. |
| Session | Reset device binding | Clears the license's hardware ID so a real customer can re-bind. |
| Session | Revoke trusted devices | Accounts only. Same as Require re-auth. |
| Notify | Post to Discord | Posts an alert line to the application's Discord and JSON webhooks. A webhook must accept the WARN event, or have no event filter. |
| Notify | Email the owner | Emails you what tripped, how often, the license, device and IP, and what Atlas did. At most once per offender per window. |
The default rules
New applications start with stepped rules, so a small problem gets a small answer and a persistent one gets a harder one:
| Problem | Steps |
|---|---|
| Key guessing | 5 failures in 10 minutes: slow the address 15 minutes. 15 in an hour: ban it for an hour. 60 in a day: ban it for 7 days and email you. |
| A license on several machines | 3 mismatches in a day: pause the license and email you. A machine trying 8 licenses in a day: ban it for 7 days. |
| A license from several addresses | 3 mismatches in a day: email you. 8: pause it and email you. |
| Key sharing | 3 over-limit sign-ins in an hour: end the sessions and email you. 10 in a day: pause the license and email you. |
| Unauthorized build | 1 in an hour: email you. 3 in a day: ban the hardware and address for 7 days. 10 in a day: ban them permanently. |
| Ban evasion | 3 retries in an hour: ban the address for a day. 10 in a day: ban it for 30 days and email you. |
| Blocked region, VPN, expired keys | 5 blocked-country retries in an hour: ban the address for a day. 10 VPN retries in an hour, or 20 expired-license retries: slow the address for 30 minutes. |
Add and edit rules
Add rule asks for a name, the event, the threshold, the window, the actions and, for a timed ban or a slowdown, the duration. Editing a rule changes it from the next event on; switching it off keeps it and its history. Editing needs the alert-rules permission.
What a rule did appears in Bans (type Auto) and in Logs (BAN entries).