Keycloak

Connect Keycloak to Radiant Security to forward authentication activity for AI triage.

Keycloak is an open-source identity and access management (IAM) platform that controls authentication, single sign-on, and authorization for applications and services. Connecting Keycloak forwards authentication activity to Radiant Security through the Radiant Agent over syslog. Radiant uses this activity during AI triage, giving analysts the identity context to separate routine access from suspicious sign-in activity.

Prerequisites

• A running Keycloak deployment
• Access to the Keycloak configuration file (keycloak.conf)
• A deployed Radiant Agent reachable from Keycloak

Add the data connector in Radiant Security

1. Log in to Radiant Security.
2. From the navigation menu, click Settings > Data Connectors, then click + Add Connector.
3. Search for and select Radiant Agent, then click Data Feeds.
4. Under Select your data feeds, select Keycloak, then click Credentials.
5. Under Credential Name, enter an identifiable name for the Radiant Agent integration (e.g., Radiant Agent integration).
6. Click Add Connector.

Configure log forwarding in Keycloak

Before starting, confirm the IP address of the Radiant Agent and the port configured to receive Keycloak data. If you do not know the port, contact your Customer Success representative.

Use either method below to forward Keycloak logs to the Radiant Agent.

Edit the Keycloak configuration file (recommended)

1. On the Keycloak server, open the configuration file (keycloak.conf).
2. Add the following lines, replacing <radiant-agent-ip> and <radiant-agent-keycloak-port> with the IP address and port of the Radiant Agent:

# Enable the syslog handler. Use log=console,syslog to enable both console and syslog.
log=syslog

# Set the syslog endpoint (IP and port)
log-syslog-endpoint=:

# Enable JSON output format
log-syslog-output=json

# Set the log level for specific categories
log-syslog-level=org.keycloak.events:INFO

1. Restart Keycloak.

Start Keycloak with logging options

Alternatively, pass the logging options when you start Keycloak:

bin/kc.sh start --log="console,syslog" --log-syslog-endpoint=: --log-syslog-output=json --log-syslog-level="org.keycloak.events:INFO"

For more information about the logging options, refer to the Keycloak documentation.

Verify ingestion

After Keycloak begins forwarding, confirm events are reaching Radiant.

1. In Radiant, navigate to Log Management.
2. Filter by rs_connectorType:"keycloak".
3. Confirm recent events appear.

Allow several minutes for events to be parsed, indexed, and available for search.