Sigra.SuspiciousLogin (Sigra v0.2.3)

Suspicious login detection. Compares login IP against all active session IPs for the user. Triggers on new IP during explicit login only.

Does NOT trigger on:

Configuration

suspicious_login: [
  enabled: true,   # Enable/disable detection
  notify: true     # Send email notification on detection
]

Emits [:sigra, :security, :suspicious_login] with metadata: %{user_id, ip, geo_city, geo_country_code} per D-57.

Detect if a login is from a suspicious (new) IP.

(since 0.4.0)

@spec detect(Sigra.Config.t(), term(), String.t(), keyword()) ::
  :ok | {:suspicious, map()}

Detect if a login is from a suspicious (new) IP.

Returns :ok if the login IP is known or detection is disabled. Returns {:suspicious, details} if the IP is new and user has prior sessions.