Username Alerts

Add a Username Alert

Navigate to Username Alerts in your dashboard and click + Add Username. Enter any username you want to monitor — for example, admin or deploy.

Add an optional label to identify the username (e.g. “Service Account”). Usernames are normalized to lowercase automatically. Your plan determines how many usernames you can watch. See pricing for limits by tier.

Receive Email Digests

When a watched username is captured by our honeypot sensors, SikkerAPI queues a notification. Emails are batched into hourly digests — one email per hour at most.

Unlike IP alerts, username digests include the protocol the username appeared on (SSH, FTP, MySQL, etc.) and the number of times it was used. This tells you exactly how attackers are trying to use your credentials.

• Username — the monitored username that was detected
• Protocol — which service it appeared on (SSH, FTP, MySQL, etc.)
• Count — how many times the username was used
• Last seen — UTC timestamp of most recent detection