Chuyển đến nội dung chính
文章課程HL7證照準備學習路線遊戲領域關於我MCPNEW
主題
Kiến trúc hệ thốngLinux安全程式設計資料庫開發營運

第 18 課：事件系統與審核日誌記錄

事件類型（登入事件、管理事件）、啟用事件日誌記錄、設定事件偵聽器（jboss-logging、電子郵件）、事件儲存、事件詳細資訊、事件過濾、透過管理控制台和 REST API 查詢事件、自訂事件偵聽器 SPI、用於集中日誌記錄的 ELK Stack / Grafana Loki 整合、SIEM 整合、審計合規性（

🔒 DevSecOps — 第 18 課 第 18 課：事件系統與審核日誌

Keycloak從基礎到高級

第 5 部分：主題、事件、安全性與保管庫__HTMLTAG_60___

xdev.asia

HTMLTAG_65__HTMLTAG_66___1。事件系統概述___HTMLTAG_67__HTMLTAG_68

Keycloak 提供了全面的 事件系統 來監控系統中的所有活動。從登入、註冊到更改管理配置的每個操作都會記錄為事件。

HTMLTAG_73__HTMLTAG_74___1.1 兩種類型的事件___HTMLTAG_75__HTMLTAG_76

___HTMLTAG_79__HTMLTAG_80___類型___HTMLTAG_81__HTMLTAG_82___說明____HTMLTAG_83__HTMLTAG_84___範例____HTMLTAG_85__HTMLTAG_86___ ___HTMLTAG_89__HTMLTAG_90__HTMLTAG_91___登入事件（使用者事件）___HTMLTAG_92__HTMLTAG_93__HTMLTAG_94___與使用者相關的操作____HTMLTAG_95__HTMLTAG_96____1、註冊、登出、TOK1_HTMLTAG_95__HTMLTAG_96____ML、註冊、註銷、1K1_UUUUUU​​S_UUUU​​S_4UUU4UU44U444U444444EN」4U4%_​​ML ___HTMLTAG_99__HTMLTAG_100__HTMLTAG_101___管理事件___HTMLTAG_102__HTMLTAG_103__HTMLTAG_104___透過管理控制台/API 進行設定變更___HTMLTAG_105__HTMLTAG_106____建立用戶端更新

HTMLTAG_111__HTMLTAG_112___1.2 登入事件類型___HTMLTAG_113__HTMLTAG_114

___HTMLTAG_117__HTMLTAG_118___事件類型____HTMLTAG_119__HTMLTAG_120___描述____HTMLTAG_121__HTMLTAG_122___發生時間___HTMLTAG_123__HTMLTAG_124______ ___HTMLTAG_127__HTMLTAG_128__HTMLTAG_129___登入___HTMLTAG_130__HTMLTAG_131__HTMLTAG_132___成功登入___HTMLTAG_133__HTMLTAG_134_____使用者輸入了正確的憑證使用者輸入了正確的憑證135 ___HTMLTAG_137__HTMLTAG_138__HTMLTAG_139___LOGIN_ERROR___HTMLTAG_140__HTMLTAG_141__HTMLTAG_142____登入失敗____HTMLTAG_143__HTMLTAG_144___使用者名稱登入失敗_____ ___HTMLTAG_147__HTMLTAG_148__HTMLTAG_149___註冊___HTMLTAG_150__HTMLTAG_151__HTMLTAG_152___註冊新帳號___HTMLTAG_153__HTMLTAG_154______使用者建立公用帳戶___MLTAG1TAG_153__HTMLTAG_154______使用者建立公用帳戶___MLTAG11TAG_15115157___使用者建立公用帳號_____ ___HTMLTAG_157__HTMLTAG_158__HTMLTAG_159___REGISTER_ERROR___HTMLTAG_160__HTMLTAG_161__HTMLTAG_162___註冊失敗____HTMLTAG_163__HTMLTAG_164___電子郵件重複，驗證失敗失敗_____ ___HTMLTAG_167__HTMLTAG_168__HTMLTAG_169____註銷____HTMLTAG_170__HTMLTAG_171__HTMLTAG_172____登出____HTMLTAG_173__HTMLTAG_174___使用者登出或過17417473章_________174___使用者登出或過173____ML_____74___用戶 ___HTMLTAG_177__HTMLTAG_178__HTMLTAG_179___CODE_TO_TOKEN___HTMLTAG_180__HTMLTAG_181__HTMLTAG_182______交換授權碼→令牌___HTMLTAG_183__HTMLTAG_184___V​​D___MLTAG_183__HTMLTAG_184___DC___MLTAG183__HTMLTAG_184___ ___HTMLTAG_187__HTMLTAG_188__HTMLTAG_189___CODE_TO_TOKEN_ERROR___HTMLTAG_190__HTMLTAG_191__HTMLTAG_192___令牌交換器失敗___HTMLTAG_193__HTMLTAG_194______ ___HTMLTAG_197__HTMLTAG_198__HTMLTAG_199___REFRESH_TOKEN___HTMLTAG_200__HTMLTAG_201__HTMLTAG_202___刷新訪問令牌_HTMLTAG_203__HTMLTAG_204____MLTAGMLUU​​SMLTAG_203__HTMLTAG_204____MLTAGML4___ ___HTMLTAG_207__HTMLTAG_208__HTMLTAG_209___REFRESH_TOKEN_ERROR___HTMLTAG_210__HTMLTAG_211__HTMLTAG_212___刷新令牌失敗___HTMLTAG_213__HTMLTAG_21141474_____ ___HTMLTAG_217__HTMLTAG_218__HTMLTAG_219___CLIENT_LOGIN___HTMLTAG_220__HTMLTAG_221__HTMLTAG_222____客戶端身分驗證服務106142___2567410224___ ___HTMLTAG_227__HTMLTAG_228__HTMLTAG_229___INTROSPECT_TOKEN___HTMLTAG_230__HTMLTAG_231__HTMLTAG_232______令牌內省___HTMLTAG_233__HTMLTAG_234___資源維權 ___HTMLTAG_237__HTMLTAG_238__HTMLTAG_239___UPDATE_PASSWORD___HTMLTAG_240__HTMLTAG_241__HTMLTAG_242___更改密碼____HTMLTAG_243__HTMLTAG_1244___使用者更改密碼 ___HTMLTAG_247__HTMLTAG_248__HTMLTAG_249___RESET_PASSWORD___HTMLTAG_250__HTMLTAG_251__HTMLTAG_252___重設密碼____HTMLTAG_253__HTMLTAG_254___透過電子郵件____ ___HTMLTAG_257__HTMLTAG_258__HTMLTAG_259___VERIFY_EMAIL___HTMLTAG_260__HTMLTAG_261__HTMLTAG_262___電子郵件驗證____HTMLTAG_263__HTMLTAG_264___使用者點擊驗證連結1 ___HTMLTAG_267__HTMLTAG_268__HTMLTAG_269___SEND_RESET_PASSWORD___HTMLTAG_270__HTMLTAG_271__HTMLTAG_272___傳送密碼重設電子郵件___HTMLTAG_273__HTMLTAG_274___請求忘記密碼___HTMLTAG_275__HTMLTAG_276___ ___HTMLTAG_277__HTMLTAG_278__HTMLTAG_279___UPDATE_PROFILE___HTMLTAG_280__HTMLTAG_281__HTMLTAG_282_____個人資料___HTMLTAG_283__HTMLTAG_284___用戶更新個人資料___ ___HTMLTAG_287__HTMLTAG_288__HTMLTAG_289___REMOVE_TOTP___HTMLTAG_290__HTMLTAG_291__HTMLTAG_292___刪除 TOTP 設備___HTMLTAG_293__HTMLTAG_294______刪除 TOTP 設備___HTMLTAG_293__HTMLTAG_294____UMLTAGML ___HTMLTAG_297__HTMLTAG_298__HTMLTAG_299___UPDATE_TOTP___HTMLTAG_300__HTMLTAG_301__HTMLTAG_302___TOTP配置____HTMLTAG_303__HTMLTAG_304___使用者設定P___ML配置___MLG130____303__HTMLTAG_304___使用者設定P___] ___HTMLTAG_307__HTMLTAG_308__HTMLTAG_309___GRANT_CONSENT___HTMLTAG_310__HTMLTAG_311__HTMLTAG_312___使用者授予權限同意___HTMLTAG_313__HTMLTAG_314___OA2同意畫面同意___ML413155_____ ___HTMLTAG_317__HTMLTAG_318__HTMLTAG_319___TOKEN_EXCHANGE___HTMLTAG_320__HTMLTAG_321__HTMLTAG_322___令牌交換___MLTAG_323__HTMLTAG_324_____32____令牌交換在客戶端之間________32_____32_____321414232____
___HTMLTAG_329__HTMLTAG_330___1.3 管理事件操作___HTMLTAG_331__HTMLTAG_332___ ___HTMLTAG_335__HTMLTAG_336___操作____HTMLTAG_337__HTMLTAG_338___說明____HTMLTAG_339__HTMLTAG_340___資源類型____HTMLTAG_341__HTMLTAG_342___ ___HTMLTAG_345__HTMLTAG_346__HTMLTAG_347___建立___HTMLTAG_348__HTMLTAG_349__HTMLTAG_350___建立新資源___HTMLTAG_351__HTMLTAG_352______、客戶端、建立新資源___HTMLTAG_351__HTMLTAG_352______、客戶端、工作領域、用戶端、____35353453____ ___HTMLTAG_355__HTMLTAG_356__HTMLTAG_357___更新___HTMLTAG_358__HTMLTAG_359__HTMLTAG_360___更新資源___HTMLTAG_361__HTMLTAG_362___使用者、客戶端、網域設定...___HTMLTAG10414UUU​​S____S_MLTAGMLTA_4___ML ___HTMLTAG_365__HTMLTAG_366__HTMLTAG_367___刪除___HTMLTAG_368__HTMLTAG_369__HTMLTAG_370___刪除資源___HTMLTAG_371__HTMLTAG_372___使用者、客戶端、工作階段...___MLTAG_371__HTMLTAG_372___使用者、客戶端、工作階段、____ ___HTMLTAG_375__HTMLTAG_376__HTMLTAG_377___操作___HTMLTAG_378__HTMLTAG_379__HTMLTAG_380____執行操作___HTMLTAG_381__HTMLTAG_382____重設_ML，發送驗證_重設密碼

HTMLTAG_387__HTMLTAG_388___2。啟用事件記錄___HTMLTAG_389__HTMLTAG_390

HTMLTAG_391__HTMLTAG_392___2.1 透過管理控制台___HTMLTAG_393__HTMLTAG_394

  1. 登入 管理控制台___HTMLTAG_398__HTMLTAG_399___
  2. 選擇領域 → 領域設定 → 選項卡 事件___HTMLTAG_404__HTMLTAG_405___
  3. 設定 使用者事件設定：
      ___HTMLTAG_410__HTMLTAG_411___儲存事件：開啟 ___HTMLTAG_414__HTMLTAG_415___過期：30 天（取決於合規性要求） ___HTMLTAG_418__HTMLTAG_419___已儲存類型：選擇要儲存的事件類型（預設值：全部）
  4. 設定 管理事件設定：
      ___HTMLTAG_428__HTMLTAG_429___保存事件：開啟 ___HTMLTAG_432__HTMLTAG_433___包含表示：開啟（儲存請求/回應正文）
    5. ___HTMLTAG_438__HTMLTAG_439___事件偵聽器__HTMLTAG_440___：新增必要的偵聽器__HTMLTAG_441___

HTMLTAG_443__HTMLTAG_444___2.2 透過 REST API___HTMLTAG_445__HTMLTAG_446

預編碼_0

HTMLTAG_447__HTMLTAG_448___3。事件偵聽器___HTMLTAG_449__HTMLTAG_450

事件監聽器在事件發生時會處理。 Keycloak 有以下可用偵聽器：

HTMLTAG_453__HTMLTAG_454___3.1 jboss-logging 監聽器___HTMLTAG_455__HTMLTAG_456

將事件記錄到 Keycloak 伺服器日誌（預設為啟用）：

預編碼_1

HTMLTAG_459__HTMLTAG_460___3.2 電子郵件監聽器___HTMLTAG_461__HTMLTAG_462

發生重要事件時傳送電子郵件給使用者（例如：從新裝置登入）：

預編碼_2

HTMLTAG_465__HTMLTAG_466___4。活動詳細資訊與活動儲存___HTMLTAG_467__HTMLTAG_468______HTMLTAG_469__HTMLTAG_470___4.1 登入事件結構___HTMLTAG_471__HTMLTAG_472

預編碼_3

HTMLTAG_473__HTMLTAG_474___4.2 管理事件結構___HTMLTAG_475__HTMLTAG_476

預編碼_4

HTMLTAG_477__HTMLTAG_478___4.3 事件儲存 — 資料庫___HTMLTAG_479__HTMLTAG_480

事件儲存在Keycloak的資料庫中：

___HTMLTAG_485__HTMLTAG_486___表格___HTMLTAG_487__HTMLTAG_488___內容___HTMLTAG_489__HTMLTAG_490___ ___HTMLTAG_493__HTMLTAG_494__HTMLTAG_495___EVENT_ENTITY___HTMLTAG_496__HTMLTAG_497__HTMLTAG_498___登入事件___HTMLTAG_499__HTMLTAG_500___ ___HTMLTAG_501__HTMLTAG_502__HTMLTAG_503___ADMIN_EVENT_ENTITY___HTMLTAG_504__HTMLTAG_505__HTMLTAG_506___管理事件____HTMLTAG_507__HTMLTAG_508___
___HTMLTAG_512__HTMLTAG_513___注意： 事件儲存預設保存在 Keycloak DB 中。對於大量事件，您應該使用自訂事件偵聽器將事件傳送到外部系統並為內建儲存設定較短的過期時間。

HTMLTAG_517__HTMLTAG_518___5。事件過濾與查詢___HTMLTAG_519__HTMLTAG_520

HTMLTAG_521__HTMLTAG_522___5.1 透過管理控制台___HTMLTAG_523__HTMLTAG_524

  1. 轉到 事件 → 選項卡 使用者事件 或 管理事件__
  2. 依下列條件過濾事件：
      ___HTMLTAG_536__HTMLTAG_537___事件類型：登入、LOGIN_ERROR、註冊... ___HTMLTAG_540__HTMLTAG_541___客戶端：選擇特定客戶端 ___HTMLTAG_544__HTMLTAG_545___使用者：按使用者 ID 搜尋 ___HTMLTAG_548__HTMLTAG_549___日期範圍：從/到日期 ___HTMLTAG_552__HTMLTAG_553___IP 位址：按 IP 過濾

HTMLTAG_559__HTMLTAG_560___5.2 透過 REST API — 登入事件___HTMLTAG_561__HTMLTAG_562

預編碼_5

HTMLTAG_563__HTMLTAG_564___5.3 透過 REST API — 管理事件___HTMLTAG_565__HTMLTAG_566

預編碼_6

HTMLTAG_567__HTMLTAG_568___6。自訂事件監聽器 SPI___HTMLTAG_569__HTMLTAG_570

Keycloak 允許透過 服務提供者介面 (SPI).

建立自訂事件偵聽器

HTMLTAG_575__HTMLTAG_576___6.1 建立 Maven 專案___HTMLTAG_577__HTMLTAG_578

預編碼_7

HTMLTAG_579__HTMLTAG_580___6.2 實作 EventListenerProvider___HTMLTAG_581__HTMLTAG_582

預編碼_8

HTMLTAG_583__HTMLTAG_584___6.3 實作 EventListenerProviderFactory___HTMLTAG_585__HTMLTAG_586

預編碼_9

HTMLTAG_587__HTMLTAG_588___6.4 註冊SPI___HTMLTAG_589__HTMLTAG_590

預編碼_10

HTMLTAG_591__HTMLTAG_592___6.5 部署與啟動___HTMLTAG_593__HTMLTAG_594

# Build
mvn clean package

# Deploy
cp target/custom-event-listener-1.0.0.jar $KEYCLOAK_HOME/providers/
$KEYCLOAK_HOME/bin/kc.sh build

# Kích hoạt: Admin Console → Realm Settings → Events → Event listeners
# Thêm "custom-event-listener"

HTMLTAG_595__HTMLTAG_596___7。 Keycloak JSON 日誌記錄___HTMLTAG_597__HTMLTAG_598

要與集中式日誌記錄集成，請配置 Keycloak 輸出 JSON 日誌：

# Bật JSON logging
bin/kc.sh start \
  --log=console \
  --log-console-output=json

Hoặc qua environment variables


KC_LOG=console
KC_LOG_CONSOLE_OUTPUT=json

HTMLTAG_601__HTMLTAG_602___7.1 JSON 日誌輸出範例___HTMLTAG_603__HTMLTAG_604

{
    "timestamp": "2026-03-15T10:30:45.123Z",
    "level": "INFO",
    "loggerClassName": "org.keycloak.events",
    "loggerName": "org.keycloak.events",
    "message": "type=LOGIN, realmId=my-realm, clientId=my-app, userId=abc-123, ipAddress=192.168.1.100",
    "threadName": "executor-thread-1",
    "threadId": 42,
    "hostName": "keycloak-0",
    "processName": "keycloak",
    "processId": 1
}

HTMLTAG_605__HTMLTAG_606___7.2 設定日誌等級___HTMLTAG_607__HTMLTAG_608

# Cấu hình log levels cho events
bin/kc.sh start \
  --log=console \
  --log-console-output=json \
  --log-level=INFO \
  --log-level=org.keycloak.events:DEBUG

# Environment variables
KC_LOG_LEVEL=INFO
KC_LOG_LEVEL=org.keycloak.events:DEBUG

HTMLTAG_609__HTMLTAG_610___8。 ELK 堆疊整合___HTMLTAG_611__HTMLTAG_612

將 Keycloak 日誌傳送到 ELK Stack（Elasticsearch、Logstash、Kibana）進行集中分析。

HTMLTAG_615__HTMLTAG_616___8.1 一般架構___HTMLTAG_617__HTMLTAG_618

Keycloak (JSON logs)
    ↓
Filebeat (log shipper)
    ↓
Logstash (processing & enrichment)
    ↓
Elasticsearch (storage & indexing)
    ↓
Kibana (visualization & dashboards)

HTMLTAG_619__HTMLTAG_620___8.2 Filebeat 設定___HTMLTAG_621__HTMLTAG_622

# filebeat.yml
filebeat.inputs:
  - type: container
    paths:
      - /var/log/containers/keycloak-*.log
    processors:
      - decode_json_fields:
          fields: ["message"]
          target: "keycloak"
          overwrite_keys: true
      - add_fields:
          target: ""
          fields:
            service.name: keycloak
            environment: production

output.logstash:
  hosts: ["logstash:5044"]

HTMLTAG_623__HTMLTAG_624___8.3 Logstash 管道___HTMLTAG_625__HTMLTAG_626

# logstash/pipeline/keycloak.conf
input {
  beats {
    port => 5044
  }
}

filter {
  if [service][name] == "keycloak" {
    # Parse Keycloak event message
    if [keycloak][message] =~ "^type=" {
      kv {
        source => "[keycloak][message]"
        field_split => ", "
        value_split => "="
        target => "kc_event"
      }

      mutate {
        add_field => {
          "event_type" => "%{[kc_event][type]}"
          "realm" => "%{[kc_event][realmId]}"
          "client_id" => "%{[kc_event][clientId]}"
        }
      }
    }

    # GeoIP enrichment
    if [kc_event][ipAddress] {
      geoip {
        source => "[kc_event][ipAddress]"
        target => "geo"
      }
    }

    # Detect suspicious patterns
    if [kc_event][type] == "LOGIN_ERROR" {
      mutate {
        add_tag => ["login_failure"]
      }
    }
  }
}

output {
  if [service][name] == "keycloak" {
    elasticsearch {
      hosts => ["elasticsearch:9200"]
      index => "keycloak-events-%{+YYYY.MM.dd}"
    }
  }
}

HTMLTAG_627__HTMLTAG_628___8.4 Kibana 儀表板___HTMLTAG_629__HTMLTAG_630

建立要監控的 Kibana 儀表板：

    ___HTMLTAG_634__HTMLTAG_635___登入成功/失敗率 — 隨時間變化的長條圖 ___HTMLTAG_638__HTMLTAG_639___主要登入錯誤 — 依錯誤類型分割的餅圖 ___HTMLTAG_642__HTMLTAG_643___透過地理位置登入 — 地圖視覺化 ___HTMLTAG_646__HTMLTAG_647___IP登入失敗 — 暴力破解偵測表 ___HTMLTAG_650__HTMLTAG_651___用戶註冊趨勢 — 按日折線圖 ___HTMLTAG_654__HTMLTAG_655___管理作業審核 — 包含完整詳細資料的資料表

HTMLTAG_659__HTMLTAG_660___9。 Grafana Loki 整合___HTMLTAG_661__HTMLTAG_662

Grafana Loki 是比 ELK 更輕的日誌聚合解決方案，適用於 Kubernetes 環境。

HTMLTAG_665__HTMLTAG_666___9.1 Promtail 設定___HTMLTAG_667__HTMLTAG_668

# promtail-config.yml
server:
  http_listen_port: 9080

positions:
  filename: /tmp/positions.yaml

clients:
  - url: http://loki:3100/loki/api/v1/push

scrape_configs:
  - job_name: keycloak
    kubernetes_sd_configs:
      - role: pod
    relabel_configs:
      - source_labels: [__meta_kubernetes_pod_label_app]
        regex: keycloak
        action: keep
      - source_labels: [__meta_kubernetes_namespace]
        target_label: namespace
      - source_labels: [__meta_kubernetes_pod_name]
        target_label: pod
    pipeline_stages:
      - json:
          expressions:
            level: level
            logger: loggerName
            message: message
            timestamp: timestamp
      - labels:
          level:
          logger:
      - match:
          selector: '{app="keycloak"} |~ "type=LOGIN|type=REGISTER|type=LOGOUT"'
          stages:
            - regex:
                expression: 'type=(?P<event_type>\w+), realmId=(?P<realm>[\w-]+), clientId=(?P<client_id>[\w-]+), userId=(?P<user_id>[\w-]+)'
            - labels:
                event_type:
                realm:

HTMLTAG_669__HTMLTAG_670___9.2 Grafana 儀表板查詢___HTMLTAG_671__HTMLTAG_672

# Login failures trong 1 giờ qua
{app="keycloak"} |~ "type=LOGIN_ERROR" | json | count_over_time({app="keycloak"} |~ "LOGIN_ERROR" [1h])

# Login events theo realm
sum by (realm) (count_over_time({app="keycloak"} |~ "type=LOGIN" [5m]))

# Top IPs với login failures
{app="keycloak"} |~ "type=LOGIN_ERROR" | regexp `ipAddress=(?P<ip>[\d.]+)` | count by (ip) | sort desc | limit 10

HTMLTAG_673__HTMLTAG_674___10。 SIEM 整合___HTMLTAG_675__HTMLTAG_676

將 Keycloak 事件與安全資訊和事件管理 (SIEM) 系統整合。

HTMLTAG_679__HTMLTAG_680___10.1 Splunk 整合___HTMLTAG_681__HTMLTAG_682

預編碼_20

HTMLTAG_683__HTMLTAG_684___10.2 SIEM 用例___HTMLTAG_685__HTMLTAG_686

___HTMLTAG_689__HTMLTAG_690___用例___HTMLTAG_691__HTMLTAG_692___事件模式___HTMLTAG_693__HTMLTAG_694___操作___HTMLTAG_695__HTMLTAG_696___ ___HTMLTAG_699__HTMLTAG_700__HTMLTAG_701____暴力偵測____HTMLTAG_702__HTMLTAG_703__HTMLTAG_704___來自同一IP的多個LOGIN_ERROR____HTMLTAG_705__HTMLTAGML_706_70707____ML_U_705__HT ___HTMLTAG_709__HTMLTAG_710__HTMLTAG_711___帳號接管___HTMLTAG_712__HTMLTAG_713__HTMLTAG_714___從例外GeoIP登入___HTMLTAG_715__HTMLTAG_716___ML]需要M___HT登入___HTMLTAG_715__HTMLTAG_716___ML]需要M___HT ___HTMLTAG_719__HTMLTAG_720__HTMLTAG_721___權限升級___HTMLTAG_722__HTMLTAG_723__HTMLTAG_724___管理員指派角色admin____HTMLTAG_725__HTMLTAG_726___MLTAD_____HTUML4725_____ ___HTMLTAG_729__HTMLTAG_730__HTMLTAG_731___資料滲透___HTMLTAG_732__HTMLTAG_733__HTMLTAG_734___許多異常令牌請求____HTMLTAG_735__HTMLTAG_736___ML +撤銷警報警報器 ___HTMLTAG_739__HTMLTAG_740__HTMLTAG_741___可疑註冊___HTMLTAG_742__HTMLTAG_743__HTMLTAG_744___來自同一IP的多個註冊____HTMLTAG_745__HTMLTAG_744___來自同一IP的多個註冊____HTMLTAG_745__HTMLTAG_746____ML41746___ML_74146____746___

HTMLTAG_751__HTMLTAG_752___11。審計合規性___HTMLTAG_753__HTMLTAG_754

HTMLTAG_755__HTMLTAG_756___11.1 SOC2 要求___HTMLTAG_757__HTMLTAG_758

___HTMLTAG_761__HTMLTAG_762___SOC2 控制___HTMLTAG_763__HTMLTAG_764___Keycloak 實作___HTMLTAG_765__HTMLTAG_766___ ___HTMLTAG_769__HTMLTAG_770__HTMLTAG_771___CC6.1 — 邏輯存取安全___HTMLTAG_773__HTMLTAG_774___ML登入、LOGIN_ERROR、密碼變更的事件記錄__HT ___HTMLTAG_777__HTMLTAG_778__HTMLTAG_779___CC6.2 — 使用者驗證____HTMLTAG_781__HTMLTAG_782___MFA 事件、註冊事件____HTMLTAG_783__4MLG_783__4MLG_783__4ML ___HTMLTAG_785__HTMLTAG_786__HTMLTAG_787___CC6.3 — 存取授權____HTMLTAG_789__HTMLTAG_790___角色/權限變更的管理事件____HTMLTAG_791__HTMLTAG_791__HT ___HTMLTAG_793__HTMLTAG_794__HTMLTAG_795___CC7.2 — 安全監控___HTMLTAG_797__HTMLTAG_798______登入失敗即時警報___HTMLTAG_799__HTMLTAG_800___ ___HTMLTAG_801__HTMLTAG_802__HTMLTAG_803___CC8.1 — 變更管理___HTMLTAG_805__HTMLTAG_806___帶有表示的管理事件___HTMLTAG_807__HTMLTAG_808___

HTMLTAG_811__HTMLTAG_812___11.2 HIPAA 需求___HTMLTAG_813__HTMLTAG_814

___HTMLTAG_817__HTMLTAG_818___HIPAA 控制___HTMLTAG_819__HTMLTAG_820___Keycloak 實作___HTMLTAG_821__HTMLTAG_822___ ___HTMLTAG_825__HTMLTAG_826__HTMLTAG_827___§164.312(b) — 審核控制____HTMLTAG_829__HTMLTAG_830___啟用所有事件類型、帶有表示的管理事件____MLGMLGML_832___ ___HTMLTAG_833__HTMLTAG_834__HTMLTAG_835___§164.312(d) — 人員驗證____HTMLTAG_837__HTMLTAG_838___身分驗證嘗試的事件記錄____HTMLTAG_837__HTMLTAG_838_____14________HTMLTAG_839__4839_____ ___HTMLTAG_841__HTMLTAG_842__HTMLTAG_843___§164.308(a)(5) — 安全意識____HTMLTAG_845__HTMLTAG_846___可疑活動的電子郵件通知____HTMLTAG_845__HT84784_____

HTMLTAG_851__HTMLTAG_852___11.3 保留政策___HTMLTAG_853__HTMLTAG_854

# Cấu hình event retention
# SOC2: minimum 1 năm
# HIPAA: minimum 6 năm

# Trong Keycloak (built-in store)
# Realm Settings → Events → Expiration: 365 days

# Trong Elasticsearch (centralized logging)
# ILM Policy:
# - Hot: 30 days (SSD)
# - Warm: 335 days (HDD)
# - Cold/Frozen: 5+ years (S3/GCS)
# - Delete: 7 years

HTMLTAG_855__HTMLTAG_856___12。警報自動化___HTMLTAG_857__HTMLTAG_858

HTMLTAG_859__HTMLTAG_860___12.1 Prometheus 警報___HTMLTAG_861__HTMLTAG_862

Keycloak 通過 /metrics 端點公開指標（需要啟用指標）：

# Bật metrics
bin/kc.sh start --metrics-enabled=true

# prometheus-alerts.yml
groups:
  - name: keycloak-security
    rules:
      - alert: HighLoginFailureRate
        expr: |
          sum(rate(keycloak_login_error_total[5m])) by (realm)
          /
          sum(rate(keycloak_login_total[5m])) by (realm)
          > 0.3
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "High login failure rate in realm {{ $labels.realm }}"
          description: "Login failure rate is {{ $value | humanizePercentage }} (threshold: 30%)"

      - alert: BruteForceDetected
        expr: |
          sum(increase(keycloak_login_error_total[5m])) by (realm) > 50
        for: 2m
        labels:
          severity: critical
        annotations:
          summary: "Possible brute-force attack on realm {{ $labels.realm }}"
          description: "{{ $value }} login failures in 5 minutes"

      - alert: UnusualRegistrationSpike
        expr: |
          sum(increase(keycloak_registrations_total[10m])) by (realm) > 100
        for: 5m
        labels:
          severity: warning
        annotations:
          summary: "Unusual registration spike in realm {{ $labels.realm }}"

HTMLTAG_867__HTMLTAG_868___12.2 Alertmanager 路由___HTMLTAG_869__HTMLTAG_870

預編碼_24

HTMLTAG_871__HTMLTAG_872___13。最佳實務___HTMLTAG_873__HTMLTAG_874

    ___HTMLTAG_876__HTMLTAG_877___同時啟用登入事件和管理事件 — 不要錯過系統中的任何活動。 ___HTMLTAG_880__HTMLTAG_881___將事件傳送至外部系統 — 不要只依賴內建事件儲存。使用 ELK/Loki/SIEM 進行長期儲存。 ___HTMLTAG_884__HTMLTAG_885___啟用管理事件表示 — 儲存管理作業的請求/回應正文以進行全面審核。 ___HTMLTAG_888__HTMLTAG_889___設定適當的保留 — 遵守合規性要求（SOC2：1 年，HIPAA：6 年）. ___HTMLTAG_892__HTMLTAG_893___監控登入失敗率 — 設定暴力偵測和帳號接管警報。 ___HTMLTAG_896__HTMLTAG_897___關聯事件 — 將 Keycloak 事件與應用程式日誌結合以獲得全面的了解。 ___HTMLTAG_900__HTMLTAG_901___保護事件日誌 — 日誌資料包含 PII，需要在靜態和傳輸過程中加密，存取受到限制。