Advanced Reporting, Alerts & SIEM
Keeper's Advanced Reporting and Alerts Module (ARAM) provides advanced event logging to meet compliance requirements.
Overview
Keeper's Advanced Reporting & Alerts Module ("ARAM") is a critical component of the Keeper Security platform which provides Keeper Administrators and Compliance teams with tools for monitoring overall usage, and adherence to policies.
Tamper-Proof Event Logging
ARAM is designed as an immutable, append-only audit system. Event data is written once at the time the action occurs and cannot be altered afterward. Keeper does not provide administrators, at any privilege level, with the ability to modify, suppress, or delete audit events. No API, console function, or command-line capability exists for changing recorded event data.
Administrative activity itself is subject to the same logging. Any change an administrator makes to role policies, enforcement settings, event alerting rules, or reporting configuration generates its own audit event, attributed to the administrator who performed the action. An administrator cannot alter the audit trail, and the act of attempting to change what is monitored is itself recorded.
For customers that require an independent copy of audit data, ARAM streams events in near real time to external SIEM destinations. Once events are delivered to a customer-controlled SIEM, they exist outside the Keeper administrative plane entirely, providing a second immutable record for forensic and compliance purposes.
Key Points:
Audit events are append-only. No modify or delete capability is exposed to administrators.
All administrative policy and configuration changes are logged as attributed audit events.
Events stream to external SIEM platforms, placing an independent copy of the audit trail beyond the reach of any Keeper administrator.
Event data supports compliance requirements for non-repudiation and audit integrity under frameworks such as SOC 2, ISO 27001, FedRAMP, and PCI DSS.
Reporting Interface
The Reporting & Alerts dashboard provides an overview of the top 5 events, two built-in reports and your custom reports. The "Recent Activity" report is a built-in report that provides event tracking for the last 1,000 events across 200+ event types. Customers can upgrade to the Advanced Reporting & Alerts module to generate and save custom reporting and alert capabilities.
Admins can also create custom reports by clicking Add Custom Report.
Preview the results by clicking Apply, and if you want to use the report in the future, click the Save button. You can export the events as a file in JSON, CSV or SysLog formats.
Geolocation based on IP address
Accuracy of geolocation based on IP address varies depending on the database used to identify the user's location. The precision of geolocation data depends on several factors. Most importantly is how well registries validate the data they receive. If information connected with an IP address is incorrect, it reduces its usefulness. Geolocation is incredibly challenging in the case of mobile phone usage where IP address changes are frequent and mobile carriers use centralized gateways through which users reach the internet. Additionally, if users are using proxies or VPNs the location data will invariably be incorrect.
Keeper subscribes to one of the industry's most reliable providers, which performs quality assurance by validating data quality against known IP addresses sourced from the public on a regular basis.
Timeline Chart
The Timeline Chart provides a chart of events over a 24-hour, 7-day, and 30-day period. Clicking on any event row will open a report containing all events from the time period.
Alerts
The Alert module allows you to create event-based triggers that will generate either email or SMS-based alerts.
New alerts are created similarly to new reports, by clicking Add Alert and specifying a name and a filter criteria. You can add one or more recipients using email address, phone number (for SMS) or both. Recipients don't have to be a part of your enterprise and any email address or phone number can be provided. The first recipient is predefined to be the user who generated the event. This will be "off" by default, and you will need to toggle it "on" to enable sending the alerts (email only) to the originator.
To prevent recipients from receiving too many notifications, alerts are throttled by default:
If the Alert Frequency is set to "Every Occurrence", every event will be forwarded, however events of the same type triggered at the same time will be deduplicated. This means that bulk operations or coinciding actions - such as deleting multiple records - will only yield one event notification.
For additional throttling, alternative Alert Frequencies can be set. For example, if you set the frequency to "Once Per Time Period" with a period of 1 hour then all events matching the alert filter will still trigger the alert "occurrence" but the message will be sent only if one hour has passed since the time of the previous message. Another way to throttle the alert is to pause it using the toggle switch. Paused alerts will also accumulate "occurrences" without sending the actual messages. When resumed, the very next event matching the alert will trigger sending the message which will contain the number of events that happened while being on pause.
Below is an example of an email alert:
You can view the alert history in the Alerts Sent tab, with the ability to drill down to see the individual events:
External SIEM Logging
If you are utilizing a third-party SIEM solution, the Keeper Admin Console can be configured to automatically feed live event data into external SIEM products. Currently supported systems include:
Azure Monitor (for Microsoft Sentinel)
Event data is transmitted from Keeper's servers to the destination SIEM collector. Only one method of the external sync can be active at a time.
Click Setup to activate the external logging solution. Setup typically only requires a few attributes to integrate.
Event Types
Within the Admin Console, the default "Recent Activity" report contains 16 event types. Keeper's Advanced Reporting and Alert Module supports over 200+ event types.
The events captured by Keeper Enterprise are visible in the drop-down menus for report and alert configuration.
Enabling BreachWatch Events
By default, BreachWatch events from the end-user devices are not collected and transmitted to the Advanced Reporting & Alerts module. These events are managed by the Role policy. To activate this feature, visit the Role > Enforcement Policies > Vault Features and toggle Send BreachWatch events to Reporting & Alerts and connected external logging systems "on".
Event Descriptions
A list of all available events captured by the Keeper Advanced Reporting and Alert Module are provided in the chart below. The Event Code is utilized in the user interface and within the Keeper Commander CLI command parameters. The "Message" field is utilized for the Alerting module.
Within each event, there may be additional attributes such as Record UID, Shared Folder UID, Team UID, Username, etc. These attributes will appear within the event description and they are also provided to the 3rd party SIEM provider in the format as specified by the destination.
Raw Event Data Examples
Below are examples of 2 events in JSON format that are sent. Note that Record UID is provided with the "record_update" event since it relates to a specific record.
Below is an example of a Syslog-format event that can be exported via Keeper Commander or into the third-party SIEM solution:
Note that "enterprise_id" is useful for distinguishing different Keeper Enterprise tenants within the same SIEM collector.
Locating the Record UID and Other Identifiers
The event data references several types of UID values such as Record UID, Shared Folder UID and Team UID. The Record UID and Shared Folder UID can be found either through the Keeper Commander CLI or through the Web Vault user interface.
Securing SIEM and Alert Modifications
Keeper event logs are immutable. Customers can also request a backend-enforced lockdown that prevents Keeper administrators from changing existing SIEM or Alert settings. Once enabled, changes require approval from two separate Keeper administrators. To request a SIEM and Alert configuration lockdown, open a support ticket with the Keeper team.
Commander CLI
The Keeper Commander CLI provides command-line and SDK integration into Keeper's reporting system for more advanced use cases. The event data can be used for generating actionable reports.
Please see the following reporting related commands for more information:
Last updated
Was this helpful?