{"__v":0,"_id":"5719767ec863120e0012a05d","category":{"__v":0,"_id":"5719767ec863120e0012a044","project":"56008ba98c0c9d0d00dcaeb0","version":"5719767ec863120e0012a042","sync":{"url":"","isSync":false},"reference":false,"createdAt":"2016-03-03T22:29:05.165Z","from_sync":false,"order":1,"slug":"guides","title":"Guide"},"parentDoc":null,"project":"56008ba98c0c9d0d00dcaeb0","user":"56008b651503430d007cc929","version":{"__v":3,"_id":"5719767ec863120e0012a042","hasDoc":true,"hasReference":true,"project":"56008ba98c0c9d0d00dcaeb0","createdAt":"2016-04-22T00:55:26.295Z","releaseDate":"2016-04-22T00:55:26.295Z","categories":["5719767ec863120e0012a043","5719767ec863120e0012a044","5719767ec863120e0012a045","5719767ec863120e0012a046","5719767ec863120e0012a047","5719767ec863120e0012a048","5719767ec863120e0012a049","57f45a18da14e71700d12e4a","582b71b15403840f008c0410"],"is_deprecated":false,"is_hidden":false,"is_beta":true,"is_stable":true,"codename":"","version_clean":"2.0.0","version":"2.0"},"updates":[],"next":{"pages":[],"description":""},"createdAt":"2016-03-03T23:24:11.766Z","link_external":false,"link_url":"","githubsync":"","sync_unique":"","hidden":false,"api":{"results":{"codes":[]},"settings":"","auth":"required","params":[],"url":""},"isReference":false,"order":1,"body":"ThisData's Login Intelligence engine looks at events as your user interacts with your app. You're going to pretend to be one of your users, and act suspiciously. 👾\n\nAfter completing this, you will have generated an alert like this:\n[block:image]\n{\n  \"images\": [\n    {\n      \"image\": [\n        \"https://files.readme.io/U7dyrblUQtqyWCNioLcg_Trigger%20first%20Alert.png\",\n        \"Trigger first Alert.png\",\n        \"1500\",\n        \"771\",\n        \"#6c63f3\",\n        \"\"\n      ],\n      \"sizing\": \"full\"\n    }\n  ]\n}\n[/block]\n\n[block:api-header]\n{\n  \"type\": \"basic\",\n  \"title\": \"Step 1. Send your first Event\"\n}\n[/block]\n[Send your first event by following our guide](doc:sending-your-first-event-to-thisdata-from-the-command-line-with-curl). You can use whichever language you like, but the following examples will use CURL via the command line.\n\nYou probably sent something like this:\n\n```json\ncurl -XPOST 'https://api.thisdata.com/v1/events.json?api_key=API_KEY' -d '{\n  \"ip\" : \"1.2.3.4\",\n  \"verb\" : \"log-in\",\n  \"user_agent\" : \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3)...\",\n  \"user\" : {\n    \"id\" : \"112233\",\n    \"name\" : \"Eve Smith\",\n    \"email\" : \"eve.smith:::at:::domain.com\",\n    \"mobile\" : \"+18325552002\"\n   }\n}'\n```\n[block:api-header]\n{\n  \"type\": \"basic\",\n  \"title\": \"Step 2. Send another, slightly modified, Event\"\n}\n[/block]\nWe're going to edit the IP address. `1.2.3.4` is in America somewhere. `5.6.7.8` is in Germany. Let's use that:\n\n```json\ncurl -XPOST 'https://api.thisdata.com/v1/events.json?api_key=API_KEY' -d '{\n  \"ip\" : \"5.6.7.8\",\n  \"verb\" : \"log-in\",\n  \"user_agent\" : \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3)...\",\n  \"user\" : {\n    \"id\" : \"112233\",\n    \"name\" : \"Eve Smith\",\n    \"email\" : \"eve.smith@domain.com\",\n    \"mobile\" : \"+18325552002\"\n   }\n}'\n```\n[block:api-header]\n{\n  \"type\": \"basic\",\n  \"title\": \"Step 3. Success!\"\n}\n[/block]\nIn your favourite browser flick back to ThisData.com, and click on the Alerts tab. You should see an alert has been generated for Eve, because she logged in from a new location!\n\nUnless you already turned the setting on, we won't have sent the \"Was This You?\" notification. But we still track the alert for your Ops team.\n\n**Fail?**\n\nNo event showed up? Bummer! Try again with a different IP address. Or keep the IP address the same, and use a different User Agent.\n\nStill no luck? Probably something funky - oops! Reach out to us at: [developers@thisdata.com](mailto:developers@thisdata.com).","excerpt":"Learn how to act suspicious, and make ThisData generate a Login Anomaly Alert","slug":"triggering-your-first-alert","type":"basic","title":"2. Trigger Your First Alert"}

2. Trigger Your First Alert

Learn how to act suspicious, and make ThisData generate a Login Anomaly Alert

ThisData's Login Intelligence engine looks at events as your user interacts with your app. You're going to pretend to be one of your users, and act suspiciously. 👾 After completing this, you will have generated an alert like this: [block:image] { "images": [ { "image": [ "https://files.readme.io/U7dyrblUQtqyWCNioLcg_Trigger%20first%20Alert.png", "Trigger first Alert.png", "1500", "771", "#6c63f3", "" ], "sizing": "full" } ] } [/block] [block:api-header] { "type": "basic", "title": "Step 1. Send your first Event" } [/block] [Send your first event by following our guide](doc:sending-your-first-event-to-thisdata-from-the-command-line-with-curl). You can use whichever language you like, but the following examples will use CURL via the command line. You probably sent something like this: ```json curl -XPOST 'https://api.thisdata.com/v1/events.json?api_key=API_KEY' -d '{ "ip" : "1.2.3.4", "verb" : "log-in", "user_agent" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3)...", "user" : { "id" : "112233", "name" : "Eve Smith", "email" : "eve.smith@domain.com", "mobile" : "+18325552002" } }' ``` [block:api-header] { "type": "basic", "title": "Step 2. Send another, slightly modified, Event" } [/block] We're going to edit the IP address. `1.2.3.4` is in America somewhere. `5.6.7.8` is in Germany. Let's use that: ```json curl -XPOST 'https://api.thisdata.com/v1/events.json?api_key=API_KEY' -d '{ "ip" : "5.6.7.8", "verb" : "log-in", "user_agent" : "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_3)...", "user" : { "id" : "112233", "name" : "Eve Smith", "email" : "eve.smith@domain.com", "mobile" : "+18325552002" } }' ``` [block:api-header] { "type": "basic", "title": "Step 3. Success!" } [/block] In your favourite browser flick back to ThisData.com, and click on the Alerts tab. You should see an alert has been generated for Eve, because she logged in from a new location! Unless you already turned the setting on, we won't have sent the "Was This You?" notification. But we still track the alert for your Ops team. **Fail?** No event showed up? Bummer! Try again with a different IP address. Or keep the IP address the same, and use a different User Agent. Still no luck? Probably something funky - oops! Reach out to us at: [developers@thisdata.com](mailto:developers@thisdata.com).