**Lidar** is Authdog's identity SIEM. Open it from the sidebar (`/dashboard/security` — the route is `security`, the label is Lidar). The console subtitle is *"Threat detection, monitoring, and security intelligence for your application"*. For the model, see [Lidar concepts](/docs/concepts/lidar).

Per environment. A selected project and environment are required.

Lidar is sales-gated (feature slug `lidar`). Until access is approved, the page shows a locked landing — *"Protect against bots, fraud, and abuse"* — with **Request access**. That landing is not a tab. After approval, the default tab is **Signals**.

Optional [notification channels](/docs/events-webhooks) copy the same trail to another SIEM if you already run one.

## Signals

`?tab=signals` (default after approval). Live findings for the selected environment. Time range comes from the top bar. Columns: Time, Severity, Signal, User, IP, Rule (`lidar.<detectionType>`). Facets: Severity, Detection type, Origin, Synthetic, Country, Client IP, User.

**Generate events** (dev) and **Clear synthetics** exercise the pipeline with console fixtures. Label those rows synthetic. Do not use them in production screenshots.

## Scan Logs

`?tab=scan-logs`. Analysis-run history for the environment: what the pipeline executed, raw events, and flags.

## Scan Runs

`?tab=scan-runs`. Detector sweep history (queue, console analyze, or sweep). Expand a run for per-detector status and severity.

## Monitors

`?tab=monitors`. Detector catalogue. Enable or disable each monitor, edit the `detection:<id>` query, set severity. Disabled monitors produce no new Signals.

Default monitors cover brute force, credential stuffing, impossible travel, MFA fatigue, bots, breached passwords, unrecognized devices, stale accounts, repeat signup, rate-limit spikes, and privilege changes. Query tokens: `detection:` (required), `window:`, `attempts:`, `priorAccounts:`, `challenges:`, `dormantDays:`, `botScore:`, `distanceKm:`, `observed:`, `action:`.

## Posture

`?tab=posture`. Configuration posture for this environment — not behavioral detection. Score 0–100 plus category subscores (Authentication, Access Control, Secrets & Keys, Threat Protection, Monitoring). Findings are deterministic checks over the environment's own settings (password policy, redirect URIs, JWKS, rate limiting, bot/breach add-ons, webhook signing, Elevate MFA, audit forwarding). **Rescan** writes a history row. **Acknowledge** mutes a finding.

No external cloud connectors. This is Authdog-config posture only.

## Limits

- Access must be approved before Signals, Scan Logs, Scan Runs, Monitors, and Posture are usable.
- Breached-password *policy* in [Authentication](/docs/console/authentication) is a separate control from the breached-password monitor.
- There is no Dashboards tab. Severity over time lives on Signals.

## Related

| Read | To learn how to |
|------|-----------------|
| [Lidar concepts](/docs/concepts/lidar) | How monitors become Signals |
| [Recipes](/docs/recipes) | Pair Lidar with bot protection |
| [Events & webhooks](/docs/events-webhooks) | Optional export to another SIEM |
| [Agents](/docs/console/agents) | MCP tool-abuse and rug-pull Signals start from agent identity |
| [Support Center](/docs/console/support) | How gated-feature requests are reviewed |