Based on the knowledge sources provided, there are a few recommended approaches for anomaly detection and monitoring suspicious login behavior with the Ory stack: 1. Ory Network provides built-in protections against automated attacks and suspicious activity: [Ory Docs - Threat Models and Security](https://www.ory.sh/docs/kratos/concepts/security) mentions that Ory Network leverages Cloudflare WAF and Bot Management services to detect bots and throttle suspicious IPs. This provides defense against automated threats without impacting user experience. 2. For self-hosted Ory Kratos, implementing anomaly detection is the responsibility of the administrator: The same document notes that for self-hosted instances, it's up to the administrator to implement appropriate measures like rate limiting. Ory Support can provide guidance on this. 3. Ory Actions can be used to implement custom logic for login monitoring: [Ory Docs - Login and Registration Webhooks](https://www.ory.sh/docs/identities/sign-in/actions) explains that you can use Ory Actions to customize login flows, including calling external services or implementing custom logic. This could potentially be used to integrate with anomaly detection systems. 4. Enterprise customers have access to live event streams: [Ory Docs - Live Event Streams](https://www.ory.sh/docs/actions/live-events) mentions that enterprise customers can stream events like logins in real-time to their own infrastructure. This could be used to feed data into custom anomaly detection systems. 5. Some basic protections are available out-of-the-box: [Ory Pricing - Security & Compliance](https://www.ory.sh/pricing/) indicates that features like Brute Force Protection, DoS Protection, Credentials Stuffing Protection, and Suspicious IP Throttling are included in Ory Network. While these sources provide some information on security features and integration possibilities, they don't mention specific standard integrations or detailed recommendations for anomaly detection. For more specific guidance on implementing advanced anomaly detection, you may need to consult with Ory Support or explore custom integrations using the available hooks and event streams.