Make sure we provide enough information to Logstash for useful account security related dashboards in OpenSearch, and create those dashboards:
- Show successful and failed logins
- https://logstash.wikimedia.org/app/dashboards#/view/3e1d0bd0-10a3-11f0-ba73-55e78dc2c82f (goodpass/badpass)
- actual password checks via CentralAuth logs
- Show suspicious login attempts
- Differentiate between many login attempts with the same username / password combo (broken bot) and with different passwords (bruteforce attempt)
- Show 2FA checks
- Show credential changes
- Show password resets
- Show email changes
- Make sure the relevant log events have enough information to identify the client (user agent, IP, user and app when available, action API custom user agent header when available, maybe some other HTTP headers that are inidicative of browser emulators)
- All dashboards should have a description and be easy to use