Reporting, Alerts & SIEM
Keeper's Advanced Reporting and Alerts Module (ARAM) provides advanced event logging to meet compliance requirements.
Overview
Keeper's Advanced Reporting & Alerts Module ("ARAM") is a critical component of the Keeper Security platform which provides Keeper Administrators and Compliance teams tools for monitoring overall usage and adherence to policies.
Key Capabilities
- Reporting Engine Run custom time-based reports with 100+ different event types that are broken down by category (e.g. Security Events, Administrative Actions, General Usage, etc). Filter on User, Event Type, Attribute (e.g. Record UID, Shared Folder UID, Geolocation).
- Alerts Set alert triggers which can send email, SMS or Webhook notifications based on specific event types (For example, notify Admins upon any policy changes).
- External Logging Integrate with any existing SIEM solution such as Splunk, Sumo or LogRhythm.
- BreachWatch monitoring Get notified and track BreachWatch events (user notified of high risk password, resolved high risk password).
- Commander CLI / SDK Integration Keeper Commander can perform customized reporting and automation.
- Compliance Auditing Generate reports specifically to address SOX, ISO, SOC compliance auditing requirements.
Reporting Interface
The Reporting & Alerts dashboard provides an overview of the top 5 events, two built-in reports and your custom reports. The "Recent Activity" report is a built-in report that provides basic event tracking for the last 1,000 events across 16 event types. Customers can upgrade to the Advanced Reporting and Alerts module to track over 100 event types and generate custom reports and alert notifications.
The "Recent Activity" and "All Security Events" reports are provided in all Keeper Business and Enterprise subscriptions. Custom reporting and alerts is a feature of the Advanced Reporting and Alerts Module (ARAM). To take advantage of this capability, please contact your Keeper Security account manager or upgrade your subscription through the Secure Add Ons interface of the Admin Console.
Additionally, a user status report is available via the dashboard. See the Dashboard section in this guide.
Admins can also create custom reports by clicking Add Custom Report.
Preview the results by clicking Apply, and if you want to use the report in the future, click the Save button. You can export the events as a file in JSON, CSV or SysLog formats.
New events generated by Keeper vault devices can take up to 10 minutes to appear in the reporting module.
Geolocation based on IP address
Accuracy of geolocation based on IP address varies depending on the database used to identify the user's location. The precision of geolocation data depends on several factors. Most importantly is how well registries validate the data they receive. If information connected with an IP address is incorrect, it reduces its usefulness. Geolocation is incredibly challenging in the case of mobile phone usage where IP address changes are frequently and mobile carriers use centralized gateways that users reach the internet. Additionally, if users are using proxies or VPN's the location data will invariably be incorrect.
Keeper subscribes to one of the industries most reliable providers who performs quality assurance by validating data quality against known IP addresses sourced from the public on a regular basis.
Timeline Chart
The Timeline Chart provides a chart of events over a 24-hour, 7-day and 30-day period. Clicking on any event row will open a report containing all events from the time period.
Alerts
The Alert module allows you to create event-based triggers that will generate either email or SMS-based alerts.
New alerts are created similarly to new reports, by clicking Add Alert and specifying a name and a filter criteria. You can add one or more recipients using email address, phone number (for SMS) or both. Recipients don't have to be a part of your enterprise and any email address or phone number can be provided. The first recipient is predefined to be the user who generated the event. This will be "off" by default, and you will need to toggle it "on" to enable sending the alerts (email only) to the originator.
Specifying a broad event and attribute filter could generate a lot of alerts. Adjust alert frequency and set narrow event types and filters to reduce alert noise.
To prevent the recipients from receiving too many emails or SMS, alerts can be throttled. One way to throttle is to specify Alert Frequency. For example, if you set the frequency to "Once Per Time Period" with a period of 1 hour than all events matching the alert filter will still trigger the alert "occurrence" but the message will be sent only if 1 hour has passed since the time of the previous message. Another way to throttle the alert is to pause it using the toggle switch. Paused alert will also accumulate "occurrences" without sending the actual messages. When resumed, the very next event matching the alert will trigger sending the message which will contain the number of events that happened while being on pause.
Below is an example of an email alert:
You can view the alert history in the Alerts Sent tab, with the ability to drill down to see the individual events:
External SIEM Logging
If you are utilizing a 3rd party SIEM solution, the Keeper Admin Console can be configured to automatically feed live event data into external SIEM products. Currently supported systems include:
- Splunk
- Sumo Logic
- AWS S3 Bucket
- IBM QRadar
- Azure Log Analytics
- LogRhythm
- Syslog Push
Event data is transmitted from Keeper's servers to the destination SIEM collector. Only one method of the external sync can be active at a time.
Click Setup to activate the external logging solution. Setup is easy on each logging platform and typically only requires a few attributes to integrate.
Event Types
Within the Admin Console, the default "Recent Activity" report contains 16 event types. Keeper's Advanced Reporting and Alert module supports ~ 100 event types.
The events captured by Keeper Enterprise are visible in the drop-down menus for report and alert configuration.
Event Type Filter
Enabling BreachWatch Events
By default, BreachWatch events from the end-user devices are not collected and transmitted to the Advanced Reporting & Alerts module. These events are managed by the Role policy. To activate this feature, visit the Role > Enforcement Policies > Vault Features and toggle Send BreachWatch events to Reporting & Alerts and connected external logging systems "on".
Enable BreachWatch Events
Event List
A list of all available events captured by the Keeper Advanced Reporting and Alert Module are provided in the chart below. The Event Code is utilized in the user interface and within the Keeper Commander CLI command parameters. The "Message" field is utilized for the Alerting module.
Within each event, there may be additional attributes such as Record UID, Shared Folder UID, Team UID, Username, etc. These attributes will appear within the event description and they are also provided to the 3rd party SIEM provider in the format as specified by the destination.
Event Code
Category
Message
Comments
change_master_password
account
User ${username} changed master password
set_two_factor_off
security
User ${username} set 2FA method OFF
change_security_question
account
User ${username} changed security question
change_email
account
User ${username} changed email. Previous email ${email}
alias_added
account
User ${username} added alternative email ${email}
create_user
security
User ${username} created
delete_user
security
User ${to_username} was deleted by admin ${username}
fast_fill
usage
User ${username} autofilled record UID ${record_uid}
login
login
User ${username} logged in to vault
Optional: "channel"
login_failure
login
User ${username} login failed with code ${result_code}
Optional: "channel"
open_record
usage
User ${username} opened record UID ${record_uid}
Optional: "folder_type", "folder_uid"
record_add
usage
User ${username} added record UID ${record_uid}
Optional: "folder_type", "folder_uid"
record_delete
usage
User ${username} sent record UID ${record_uid} to trash
Optional: "folder_type", "folder_uid"
record_remove
usage
User ${username} removed record UID ${record_uid}
Optional: "folder_type", "folder_uid"
record_update
usage
User ${username} updated record UID ${record_uid}
Optional: "folder_type", "folder_uid"
set_two_factor_on
security
User ${username} set 2FA method ${channel} ON
share
share
User ${username} shared record UID ${record_uid} with ${to_username}
transfer_owner
share
User ${username} transferred ownership of record UID ${record_uid} to user ${to_username}
change_share
share
User ${username} changed share permissions for record UID ${record_uid} to user ${to_username}
This event log changes on record share to user
record share includes permissions to re-share and edit
Raw Event Data Examples
Below are examples of 2 events in JSON format that are sent. Note that Record UID is provided with the "record_update" event since it relates to a specific record.
1
{
2
"record_uid" : "Uk6qLnfWVxWL9OQlsGdOUw",
3
"audit_event" : "record_update",
4
"remote_address" : "155.65.556.130",
5
"client_version" : "Browser Extensions.12.3.0",
6
"timestamp" : "2019-02-14T22:41:12.027Z",
7
"username" : "[email protected]",
8
"enterprise_id" : 12345
9
}
10
11
{
12
"audit_event" : "login",
13
"remote_address" : "168.123.45.130",
14
"client_version" : "Web App.14.2.4",
15
"timestamp" : "2019-02-14T22:40:08.655Z",
16
"username" : "[email protected]",
17
"client_version_new" : true,
18
"enterprise_id" : 12345
19
}
20
Copied!
Below is an example of a Syslog-format event that can be exported via Keeper Commander or into the 3rd party SIEM solution:
1
<110>1 2019-02-14T21:34:47Z 46.45.253.15 Keeper - 1132431639 [[email protected] geo_location="Chicago, IL, US" keeper_version_category="MOBILE" audit_event_type="login_failure" keeper_version="iPhone 14.2.0" result_code="auth_failed" username="[email protected]" node_id="47377784242178"] User [email protected] login failed with code auth_failed
2
Copied!
Note that "enterprise_id" is useful for distinguishing different Keeper Enterprise tenants within the same SIEM collector.
Locating the Record UID and Other Identifiers
The event data references several types of UID values such as Record UID, Shared Folder UID and Team UID. The Record UID and Shared Folder UID can be found either through the Keeper Commander CLI or through the Web Vault user interface.
Last modified 4d ago