Skip to main content

Anomaly Detection

You can't watch your access patterns 24/7. WardenAuth does — and raises an alert when behavior deviates from the baseline.

The problem​

A compromised API key starts hammering endpoints at 3 AM. An attacker probes permissions they shouldn't need. An MCP server goes haywire and burns through your access-check quota. These incidents look like noise in an audit log but are obvious as anomalies — if someone is watching.

How it works​

The system tracks evaluation rates per scope over time. When the rate spikes above a threshold or drops unexpectedly, an anomaly is recorded.

What triggers an anomaly​

  • Sudden spike in access check volume (>3x baseline)
  • Access from previously unseen IP ranges
  • Unusual permission evaluation patterns (e.g., high deny rate)
  • Drift detection — MCP server toolset changes

Acknowledging​

Anomalies appear in the dashboard. Acknowledge them to mark them as reviewed:

POST /v1/admin/scope/{scopeId}/anomaly/{anomalySk}/acknowledge
Authorization: Bearer <management-key>

Acknowledged anomalies remain in the log but are filtered out of the active alerts view.