CyberCLI
Sign in →
← All connectors

Keycloak

Free · OSS

Identity (self-hosted)

On-prem identity broker — Okta-grade audit events without the Okta bill.

Keycloak homepage ↗

Open-source identity broker — the on-prem alternative to Okta and Auth0. Realms, OIDC clients, federation hops, admin-console changes. Every login, every token, every role change is an audit event you can read like the IdP saw it.

CyberCLI pack v1.0.0 beta
updated 2026-06-06

Production-shippable, newer or thinner field coverage. Watch the changelog before pinning compliance claims.

What it watches

  • Interactive logins — success, failure, MFA challenge outcome
  • Token issuance + refresh + introspection events
  • Admin-console actions — realm/client/role/group changes
  • Federation hops (SAML, OIDC, social IdP)
  • User self-service events — register, password reset, email verify
  • Service-account + offline-token activity

MITRE ATT&CK coverage

Tactics this connector gives CyberCLI visibility into.

TA0001 · Initial Access TA0003 · Persistence TA0004 · Privilege Escalation TA0006 · Credential Access TA0008 · Lateral Movement
See the full coverage matrix →

Every alert this connector surfaces

14 event types

Every matrix-covered event_type on the passthrough lane — pinned by the engine's coverage matrix. The right column shows the operator-friendly phrase the dashboard renders. High-severity AI-lane signals are summarized in What it watches above (Warden + Herald handle those); the rest take the substrate's passthrough lane (no AI tokens burned).

event_type dashboard renders
keycloak_auth_failed Authentication failed on keycloak
keycloak_auth_ok Authentication success on keycloak
keycloak_admin_create Admin created object on keycloak
keycloak_admin_delete Admin deleted object on keycloak
keycloak_admin_update Admin updated object on keycloak
keycloak_admin_action Admin action on keycloak
keycloak_admin_other Admin activity on keycloak
keycloak_credential_change Credential change on keycloak
keycloak_impersonate Impersonation event on keycloak
keycloak_register_failed User registration failed on keycloak
keycloak_session_event Session event on keycloak
keycloak_other_error Keycloak error on keycloak
keycloak_malformed Malformed Keycloak log on keycloak
keycloak_other Identity activity on keycloak

What it helps you catch

Catches a brute-force burst against a single realm by the LOGIN_ERROR cluster on the same client + src_ip.
Flags an admin granting themselves a high-privilege role in the same session they logged in — the lateral-into-admin pattern.
Surfaces token-replay attempts when an offline token reappears from a new IP a year after issuance.
Detects a federated IdP rolling its signing key without your consent — the supply-chain identity move.

What you'd see in CyberCLI

illustrative
CYCON 3 high Keycloak

Catches a brute-force burst against a single realm by the LOGIN_ERROR cluster on the same client + src_ip.

Routed to Warden (triage) → Knight (detection) → Paladin (containment)

⛓ every step hash-chained · replayable

What CyberCLI reads from Keycloak

audit our math
Fields normalized
11
parsed from the source event
Event categories
—
with on-disk fixtures
Trust Ladder
L0 → L4
AI authorization range

Keycloak's jboss-logging event listener emits a JSON envelope plus a key=value event body for every identity action — interactive logins, token refreshes, admin-console changes, federation hops. The 11 fields we read carry the full audit picture: who acted (user_id, acct), from where (src_ip, host), in which tenant (keycloak_realm, keycloak_client, keycloak_session), what they did (keycloak_event_type, keycloak_resource_type, keycloak_resource_path, keycloak_auth_method), and why it failed if it did (keycloak_error). The operator reads the same evidence the IdP saw, no inference required.

Full field index · 11 fields ↓
.action.cybercli_class.cybercli_low_signal.cybercli_parse_status.cybercli_raw_line.cybercli_wire_format.detail.event_id.event_type.keycloak_event_type.rule_level

MITRE techniques typically mapped

Trust Ladder ceiling · L0 → L4

AI can authorize
  • ·L0–L2: digest the login/token/admin event, notify Herald, summarize the auth chain for the operator
  • ·L3 (Knight verification): correlate LOGIN_ERROR bursts into brute-force candidates, cross-reference src_ip with prior sessions and other identity connectors — read-only Admin API queries
  • ·L4 (Paladin containment, Pro+): user disable via keycloak.disable_user · active-session logout via keycloak.logout_sessions
Requires human approval
  • ·L5+: realm/client config edits, identity-provider federation changes, role and group assignment
  • ·Any action against admin or service-account realms, and any change to break-glass identities

Full ladder semantics · /trust →

Field count + sample event auto-derived from src/cybercli/connectors/keycloak/vector.vrl at build time. Numbers update the moment the engine's parser changes — no drift.

Close more of the kill chain

Keycloak covers 5 of 14 ATT&CK tactics. Pair it with these to widen coverage:

CrowdStrike Pro

+7 new tactics

SentinelOne Pro

+7 new tactics

Wazuh

+6 new tactics

How to connect

  1. 1 Enable Keycloak's jboss-logging event listener for the realms you care about (admin console → Events).
  2. 2 Stream Keycloak logs to CyberCLI via file or syslog.
  3. 3 Run `cybercli onboard keycloak`.
  4. 4 Confirm login + admin events in the dashboard's Connectors panel.
Install / activate
podman run --name keycloak -p 8080:8080 quay.io/keycloak/keycloak start-dev
Guild roles it feeds
  • Warden (triage)
  • Knight (detection)
  • Paladin (containment)
The Guild →
Sovereignty

Fully local. Keycloak runs on your hardware; CyberCLI reads its event log in-network. Identity data never leaves the box.

Go deeper

CYCON
Live posture →
The Guild
Meet the agents →
Trust
How the leash works →
Pricing
Free vs Pro →
Install free → Browse all connectors