Weekly Auth0 activity brief for ops and security teams

Every Monday at 8:07 AM local time, pull the last seven days of activity from Auth0 and email a short executive brief to the ops and security distribution list.

Auth0 steps:

1. Call Auth0 "Get Active Users Count" to fetch the current tenant MAU.

2. Call Auth0 "Get Daily Stats" for the last seven days to get login and signup counts per day. Call it a second time for the seven days before that so you can compute a week-over-week comparison.

3. Call Auth0 "Search Log Events" for the same seven-day window, filtered to failure and blocked event types. Use search_engine=v3 with a Lucene query on the type field: type:"f" OR type:"fp" OR type:"fu" OR type:"fs" OR type:"limit_wc" OR type:"fapi", constrained to the window by a date range. These codes cover failed logins (f, fp, fu), failed signups (fs), accounts blocked by brute-force protection (limit_wc), and Management API errors (fapi).

Then summarize the numbers into a short executive brief that covers:

- MAU trend versus the previous week.

- Top three signup days from the last seven days.

- Total failed logins for the week and count of accounts blocked for brute-force attempts.

- Any spike worth investigating. Heuristic: any day where failed logins jump more than 50 percent versus the day before, or any brute-force blocks at all. Keep these thresholds tunable so the recipient can tighten or loosen them later.

Draft the report with Gmail "Create a Draft" and then send it with Gmail "Send a Draft". The recipient is the ops and security distribution list. Use a subject like "Auth0 weekly brief for the week ending [date]".

Tone: plain and non-technical, one minute to read. Do not paste raw JSON, do not mention operation names, and do not use Auth0 log type codes in the body. Translate everything to plain phrases like "failed logins", "blocked accounts (brute-force protection)", and "signups". Short paragraphs with a small bulleted number list are fine.