<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: implementing-identity-security-monitoring
description: >-
  Implement continuous identity security monitoring with SIEM integration,
  UEBA baselines, identity-specific dashboards, and automated alerting for
  authentication anomalies and privilege changes.
domain: cybersecurity
subdomain: identity-security
tags:
  - identity-monitoring
  - siem
  - ueba
  - dashboards
  - alerting
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack:
  - T1078
  - T1110
  - T1098
  - T1136
  - T1556
---

# Implementing Identity Security Monitoring

## Overview

Identity security monitoring provides continuous visibility into authentication
events, privilege changes, and behavioral anomalies. It combines SIEM log
correlation, UEBA behavioral baselines, and identity-specific dashboards to
detect threats that point-in-time assessments miss.

## Prerequisites

| Requirement | Purpose |
|---|---|
| Python 3.10+ | Agent tooling |
| SIEM access | Log correlation |
| IdP API access | Identity provider queries |
| `pip install msal` | Microsoft auth library |
| `pip install okta` | Okta SDK |

## Key Concepts

### Identity Monitoring Architecture

```
┌──────────────┐  ┌──────────────┐  ┌──────────────┐
│  IdP Logs    │  │  HR System   │  │  Endpoint    │
│  Entra/Okta  │  │  Workday/SAP │  │  EDR/MDM     │
└──────┬───────┘  └──────┬───────┘  └──────┬───────┘
       │                 │                 │
       └────────┬────────┴─────────────────┘
                ▼
       ┌────────────────┐
       │  SIEM / SOAR   │
       │  Correlation    │
       └────────┬───────┘
                │
       ┌────────┴───────┐
       │  UEBA Engine   │
       │  Behavioral    │
       │  Baselines     │
       └────────┬───────┘
                │
       ┌────────┴───────┐
       │  Dashboards    │
       │  & Alerting    │
       └────────────────┘
```

### Key Identity Metrics

| Metric | Description | Threshold |
|---|---|---|
| Auth failure rate | Failed logins / total | > 10% per hour |
| MFA bypass rate | Logins without MFA | > 0% for required users |
| Privilege change rate | Role/group changes | > baseline + 2 stddev |
| New admin accounts | Admin role grants | Any new → alert |
| Service principal auth | Non-interactive logins | Anomalous patterns |

## Workflow

```
1. DESIGN     — Define identity monitoring use cases and data sources
2. INGEST     — Configure log forwarding from all identity sources
3. BASELINE   — Establish UEBA behavioral baselines (30-day minimum)
4. DETECT     — Deploy detection rules and correlation searches
5. DASHBOARD  — Build identity security dashboards and KPIs
6. ALERT      — Configure alerting thresholds and escalation paths
7. TUNE       — Refine baselines and reduce false positives
```

## Verification

```bash
# Validate agent script
python3 -m py_compile scripts/agent.js && echo "OK" || echo "FAIL"
ruff check scripts/agent.js

# Run agent help
node scripts/agent.js --help
```

## References

- [MITRE ATT&CK — Identity Techniques](https://attack.mitre.org/tactics/TA0006/)
- [NIST SP 800-63 Digital Identity Guidelines](https://pages.nist.gov/800-63-3/)
- [NIST SP 800-207 Zero Trust Architecture](https://csrc.nist.gov/publications/detail/sp/800-207/final)
- [CIS Controls v8](https://www.cisecurity.org/controls/v8)
