New-login alerts

A new-login alert tells you when someone logs in from a place that this user has not used before. It helps you find a stolen password early. This is a feature of Pastmark Pro.

The two rules #

Pastmark Pro adds two alert rules. Go to User Activity → Settings → Alerts → Alert Rules.

Rule	Event	When it fires
Login from a new location	Login From New IP	A user logs in from an IP address that is new for this user.
Login from a new country	Login From New Country	A user logs in from a country that is new for this user. This needs Geolocation.

Turn them on #

1. Go to User Activity → Settings → Alerts → Alert Rules.
2. Turn on the switch of Login from a new location, Login from a new country or both.
3. Check the channel of the rule. Click the pencil icon to change it. Read Set up alert channels.

The rules are added switched off. On a site that already used Pastmark Pro, Pastmark Pro adds them once, and it uses the first delivery channel. If you delete a rule, Pastmark Pro does not add it again.

How a new place is found #

• At each login, Pastmark Pro compares the IP address with the last 20 different IP addresses of that user. The list is saved as hashed values in the user data. The real addresses are not saved there.
• A new IP address saves the event Login From New IP. The severity is Warning for administrators and Info for all other users.
• The first login after you install Pastmark Pro is never “new”. It only saves the starting address.
• The browser and the system, for example Chrome on Linux, are shown in the event. They do not start an alert. Only a new IP address does.

Example of an event: New login location for "tom": 91.198.174.192 (Chrome on Linux).

New country #

• A login from a country that the user never used before saves Login From New Country with the severity Warning. Example: New login country for "tom": NL (Chrome on Linux).
• If the history of the user has no country yet, Pastmark Pro only saves the country. It does not fire.
• A login from a new country is also a new IP address. So it saves both events. If both rules are on, you get two alerts for one login.

Limits #

• If Anonymize IP Addresses is on, Pastmark compares the shortened address. A new place is then found less exactly. Read Security and privacy.
• Pastmark reads the IP address like everywhere else, also from proxy headers. Without a proxy in front of your site, a visitor can fake the header X-Forwarded-For and so change what Pastmark sees.
• Users who share one network, or who travel, get alerts for good reasons. Check the event before you act.

Next steps #

• Create alert rules
• Geolocation
• See and end login sessions