> For the complete documentation index, see [llms.txt](https://docs.coherent.global/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.coherent.global/identity-and-access-management/security-information-and-event-management.md).

# Security information and event management

In modern SaaS environments, identity is the primary control plane - governing access, enforcing security policies, and driving compliance.

For Coherent, customers are issued dedicated [Keycloak](https://www.keycloak.org/) realms where identity management, federation, and access control are fully delegated. This makes centralized visibility into identity events critical. This can be managed with a security information and event management (SIEM) solution.

## SIEM is essential for Keycloak

In Spark, the identity and access management application is the gateway to customer environments, enforcing:

* Authentication (single sign-on, multifactor authentication, federation).
* Authorization (roles, policies).
* Access to APIs, UIs, and admin features.

To protect this surface, identity activity should be logged, monitored, and ingested into a SIEM.

## SIEM integration strategy

You can integrate your SIEM by pulling audit and event logs from their Keycloak realm via the Keycloak Admin REST API with a dedicated service account.

Configuring and maintaining SIEM integration is solely the your responsibility. The type of SIEM solution used is entirely the customer’s decision. Any modern SIEM is capable of ingesting logs from REST APIs or standard log formats.

### Recommended events to monitor

* Successful and failed login attempts.
* Token grants and refreshes.
* Admin role assignments.
* Federation and identity provider changes.
* Group membership and access policy changes.

For identity-centric security, the first and most critical layer of defense is visibility into identity-driven events such as authentication, access control, and configuration changes, rather than focusing on traditional perimeter tools.

### IAM recommendations

Before implementing SIEM we recommend reviewing:

* [IAM fundamentals](/identity-and-access-management/iam-fundamentals.md)
* [IdP recommendations](/identity-and-access-management/single-sign-on/idp-recommendations.md)
* [Shared responsibility model](/support/shared-responsibility-model.md)

Identity management defines your security perimeter. Treat identity logs with the same urgency as network logs!

## Demo video

[Microsoft Sentinel](https://learn.microsoft.com/en-us/azure/sentinel/) is the [Microsoft Azure](https://learn.microsoft.com/en-us/azure/) SIEM application. This video demonstrates how a failed login to Spark registers into a [Sentinel workbook](https://learn.microsoft.com/en-us/azure/sentinel/monitor-your-data).

{% file src="/files/ShwwUT2bAKlIKLC8c0Pw" %}