Monitor Security with Sentry

You’ve built secure code, locked down inputs, and hardened your APIs — but the moment your app goes live, the real threat begins. Without monitoring security with Sentry and alerts, you’re flying blind: a SQL injection attempt or a burst of failed logins can go unnoticed until it’s too late. This lesson transforms your application from a passive system into an active sentinel, showing you how to capture security-relevant events, set up intelligent alert rules, and respond before a minor anomaly becomes a full-blown breach.

The problem this lesson solves

Traditional logging is a fire-and-forget affair. You write logs to a file, maybe a SIEM, and then… nothing. Nobody watches the logs in real time. When a penetration test flags a suspicious pattern two weeks later, you’re already compromised. The core pain: you cannot secure what you cannot see. A vulnerability exploited silently — a SQL injection probe, a spike in 401s, an unexpected data export — can run for days or weeks before you notice.

This lesson solves that by introducing a monitoring stack centered on Sentry, a real-time error and event tracking platform. You’ll learn to capture security events, set up alert rules that trigger only when thresholds matter, and integrate alerts into your incident response workflow. By the end, you’ll have a system that notifies you the moment something suspicious happens — not next week.

The security mindset: Monitoring is not a luxury; it’s a required control. Even the most robust code has a failure mode — monitoring is what turns a silent failure into a prompt fix.

Core concept / mental model

Think of Sentry as the nervous system of your application. It detects pain signals (errors, performance issues, security events) and sends impulses (alerts) to your brain (you or your on-call team). The mental model breaks down into three layers:

• Capture: Your code sends structured events — errors, exceptions, security signals — to Sentry's ingester.
• Process: Sentry groups related events, enriches them with stack traces, user context, and environment data, and stores them for analysis.
• Alert: You define rules that evaluate incoming events against conditions (e.g., “more than 5 failed logins in 10 minutes for the same user”) and trigger notifications via email, Slack, PagerDuty, or webhook.

This leash is proactive: you’re not waiting for a human to glance at a dashboard; you’re letting the system raise its hand when something’s off. In security terms, this is detection and response — the second pillar of a secure development lifecycle after prevention.

Compare this to traditional logging: logs are passive, unstructured, and often unread. Sentry gives you structured, correlated, and actionable data.

How it works step by step

1. Instrument your code — Install the sentry-sdk package and initialize it with your DSN (Data Source Name) in your application entry point.
2. Capture security events — Use the SDK’s capture_message or capture_exception methods for explicit security checks (e.g., failed auth), or leverage Sentry’s server-side performance monitoring to spot anomalies.
3. Configure alert rules — In the Sentry dashboard (or via Terraform for infrastructure-as-code), create rules that watch for specific event types, user attributes, or error rates.
4. Set thresholds and actions — Define conditions (e.g., “error rate > 5% for 5 minutes”) and actions (email, Slack, or a webhook that triggers your SIEM).
5. Route alerts to the right team — You can attach alert rules to issues, teams, or projects; ensure the right people get pinged, not the whole org.
6. Respond and iterate — When an alert fires, triage it, patch the code, and deplore a fix. Adjust thresholds based on false positives and evolving threat patterns.

Hands-on walkthrough

Let’s set up a minimal Python Flask app with Sentry to monitor a security-sensitive endpoint — a login route that checks for brute-force attempts.

First, install the SDK:

pip install sentry-sdk

Now, instrument your app. Add this to your main module (e.g., app.py):

import sentry_sdk
from sentry_sdk.integrations.flask import FlaskIntegration
from flask import Flask, request, jsonify

sentry_sdk.init(
    dsn="https://your-dsn@sentry.io/your-project-id",  # Replace with your DSN
    integrations=[FlaskIntegration()],
    traces_sample_rate=1.0,  # Enable performance monitoring
    environment="production",
)

app = Flask(__name__)

@app.route("/login", methods=["POST"])
def login():
    username = request.form.get("username")
    password = request.form.get("password")

    # Simulate a failed login (e.g., wrong password)
    if not is_valid_credentials(username, password):
        # Capture the event with context
        sentry_sdk.capture_message(
            "Failed login attempt",
            level="warning",
            extra={
                "username": username,
                "ip_address": request.remote_addr,
                "user_agent": request.user_agent.string
            },
        )
        return jsonify({"error": "Invalid credentials"}), 401

    # Successful login...
    sentry_sdk.set_user({"username": username})
    return jsonify({"message": "Logged in"}), 200

Run the app and hit the login endpoint with a wrong password. In your Sentry dashboard, you’ll see a new issue titled “Failed login attempt” with extra data attached.

Now, let’s set up an alert rule to catch brute-force patterns. Go to Alerts → Create Alert → Custom Alert. Define the condition:

• When: An event is captured
• Filter: extra.ip_address exists AND level = warning
• Threshold: At least 5 events in 10 minutes
• Action: Send to Slack channel #security

Save the rule. Now, simulate 5 failed logins quickly:

for i in {1..5}; do
  curl -X POST http://localhost:5000/login -d "username=attacker&password=wrong"
done

Within a minute, you’ll see a Slack notification (if you set the webhook) or an email. The alert groups the events, saving you from a flood of individual notifications.

Pro tip: Use Sentry’s plugin for AWS Lambda or Celery to monitor background tasks — security checks like rate limiting often live there.

Compare options / when to choose what

Sentry is not the only monitoring tool. Here’s a quick comparison to help you decide when it fits your stack:

For security-specific monitoring, Sentry excels because it natively captures exceptions and allows custom events with rich context. Prometheus is better for rate-based anomalies (e.g., request rate spikes) but requires you to build the pipeline. Datadog offers robust APM but at a cost. If you need log retention for compliance, ELK is a complement, not a replacement.

When choosing, ask:

• Do I need to capture individual security events with user context? → Sentry
• Do I need to track metrics like login failure count over time? → Prometheus
• Do I need to correlate errors with performance? → Datadog or Sentry APM

In this lesson, we focus on Sentry because it requires minimal setup and gives immediate value for security monitoring.

Troubleshooting & edge cases

Issue: Alerts are firing too often (false positives). Fix: Raise thresholds, add filters (e.g., ignore known health checks), or tune the time window.

Issue: Sentry captures sensitive data (passwords, PII) in event extras. Fix: Use sentry_sdk.set_extra() sparingly; configure send_default_pii=False and scrub data in the SDK.

Issue: The SDK slows down production. Fix: Set traces_sample_rate lower (e.g., 0.1) and enable before_send to filter out noise.

Issue: Alert notifications are going to the wrong team. Fix: Assign alerts to a specific team in Sentry; use routing rules in Slack or PagerDuty.

Edge case: Login attempts from the same IP but different usernames may not trigger a simple threshold. Use Sentry’s advanced filter to group by extra.ip_address as a distinct fingerprint.

Common bug: The DSN is hard-coded and leaks in client-side code. Always set it via environment variables.

export SENTRY_DSN="https://..."

What you learned & what's next

You’ve learned to monitor security with Sentry and alerts: you can now capture security events, attach rich context, and alert on suspicious patterns. You understand the mental model of capture → process → alert, and you’ve implemented a brute-force detection scenario. You also know how Sentry compares to other monitoring tools and how to troubleshoot common pitfalls.

This sets the stage for the next lesson in the Secure development track: Incident response automation — you’ll learn to trigger automated actions (like blocking an IP or rotating a key) when Sentry alerts fire, turning detection into remediation. Using the alert rule you just built, you’ll wire it to a webhook that invokes a security response Lambda function.