Enhancement: Add Support for Multi-Factor Authentication (MFA) Monitoring

[ahamed-ali-git]

Description:
I'd like to contribute to BuffaLogs by adding support for monitoring and alerting on Multi-Factor Authentication (MFA) events. This enhancement would allow BuffaLogs to detect patterns like:

MFA bypass attempts
Failed MFA verifications from the same user across multiple devices
Unusual MFA verification times for specific users
MFA disablement events

Why this matters:
As organizations increasingly rely on MFA for security, tracking anomalous behavior related to MFA can help detect sophisticated attacks where credentials have been compromised but attackers are struggling with the second factor.
Implementation approach:

Extend the log structure schema to include MFA-related fields
Create a new alert type for suspicious MFA patterns
Update the frontend visualization to display MFA-related metrics
Add documentation for the new feature

I'm willing to work on this enhancement and follow the project's contribution guidelines. Please let me know if you're interested in this feature and if you have any specific implementation preferences. @Lorygold can I work on this feature?

[ManofWax]

Hi Ahamed,
surely adding support for MFA would be useful.

Do you have already an idea on what fields would be useful to detecting anomalies on MFA? Have you already got some logs example containing MFA data?

[ahamed-ali-git]

Hi @ManofWax ,
Thanks for your interest in this feature and for getting assigned to the issue!
Regarding MFA fields that would be useful for detection, I'm thinking we should include:

mfa_method_type - The type of MFA used (TOTP, SMS, hardware key, etc.)
mfa_verification_status - Success/failure of the verification attempt
mfa_challenge_timestamp - When the MFA challenge was issued
mfa_response_timestamp - When the user responded to the challenge
mfa_source_ip - IP address where the MFA request originated
mfa_device_id - Unique identifier for the device used
user_id - To correlate with other authentication events
mfa_bypass_attempt - Boolean flag for attempted bypasses

I don't have specific log examples yet, but I was thinking of a structure like:
jsonCopy{
"timestamp": "2025-03-13T09:15:22Z",
"event_type": "mfa_verification",
"user_id": "user123",
"mfa_method_type": "totp",
"mfa_verification_status": "success",
"mfa_challenge_timestamp": "2025-03-13T09:15:10Z",
"mfa_response_timestamp": "2025-03-13T09:15:22Z",
"mfa_source_ip": "192.168.1.105",
"mfa_device_id": "device_abc123",
"session_id": "session_xyz789"
}
My main goal is to detect the patterns I mentioned in the issue description:

MFA bypass attempts
Failed verifications from the same user across different devices
Unusual verification timing patterns
MFA disablement events

Do you think this approach makes sense? I'd appreciate your input on the schema and any other fields you think would be valuable for detecting MFA-related security issues.

[ManofWax]

I though a bit on it and I think it's best to place it on hold until we are merging this branch: https://github.com/certego/BuffaLogs/tree/ingestion because we are reworking the ingestion phase and this implementation would conflict with this issue.

One thing you can do in the meantime is to find product that will generate logs containing real MFA information to see what they look like.