A SIEM (Security Information and Event Management) platform collects logs from across an environment, normalizes them, and runs correlation rules and analytics to detect and alert on threats, while retaining the data for investigation and audit. For identity, the SIEM is where sign-in and audit logs become detections. Wazuh is the open-source SIEM the labs use.

At minimum: identity-provider sign-in logs (success and failure), directory audit logs (role, group and policy changes), MFA and risk events, privileged-access and PAM session logs, and authentication logs from key applications. Coverage of both authentication and administrative change is what lets you catch account takeover and privilege escalation. The labs wire these into dashboards and detections.

Grafana visualizes identity signals — sign-in volume and failure rates, MFA registration, risky sign-ins, privileged activity — from data sources like Loki and Prometheus, with alerting on anomalies. Good dashboards make drift and incidents visible at a glance. The Grafana labs build identity dashboards, including a dark-theme variant, with alerts on the signals that matter.

Wazuh is an open-source security platform combining SIEM and host-based intrusion detection. It ingests logs and endpoint telemetry, applies rules, and raises alerts — including identity-relevant ones like brute force, suspicious authentication and configuration change. The Wazuh lab builds identity-focused detections you can run without commercial licensing.

MITRE ATT&CK is a knowledge base of adversary tactics and techniques. Mapping detections to ATT&CK technique IDs — for credential access, persistence, privilege escalation and defense evasion — shows your coverage and gaps against real attacker behavior. Framing identity detections against ATT&CK makes monitoring measurable rather than ad hoc.

UEBA (User and Entity Behavior Analytics) baselines normal behavior for each user and workload, then flags deviations — a service account logging in interactively, a user authenticating from a new country, a sudden burst of privileged actions. It catches account takeover and insider misuse that static rules miss, and it is the analytics layer modern SIEMs add on top of correlation.

Tune detections against a baseline, suppress known-good patterns (service accounts, scheduled jobs, corporate IP ranges), enrich alerts with context like device and risk level, and prioritize by asset and privilege. Correlating multiple weak signals into one high-confidence alert beats firing on every failed login. The labs emphasize evidence-quality alerts an analyst will actually action.