Failed Login Lockout Review

Keycloak logs every failed login attempt against a user account, including the timestamp and source. A Beam agent reads that event log and, when an account crosses the account's configured failed attempt threshold, checks whether the pattern looks like a single person mistyping a password or attempts spread across many accounts from one source, which points to something more serious. A routine mistyped-password pattern gets a notice to the user with a reset link. A spread-out pattern gets escalated straight to the security team instead. The agent never unlocks an account or resets a password itself, both stay a person's decision.

Stale Session Cleanup Alerts

Keycloak tracks every active session, including when it started and when the token expires. A Beam agent reads session data on a schedule and, for sessions that have run well past the account's expected length, such as a token still active days after the user last logged in through another system, flags them to the security team as candidates for revocation. Sessions still within a normal working day, or ones tied to a service account expected to stay long-lived, are excluded from the flag. The agent does not revoke a session itself, it only surfaces the ones worth a person's attention.

Role Assignment Change Notices

Keycloak stores which roles and groups each user belongs to, which in turn controls what that user can access. A Beam agent reads role assignment changes as they happen and, for a routine change like a new hire added to their team's standard group, logs it without alerting anyone. For a change that adds an administrative or highly privileged role, the agent notifies the security team immediately with who made the change and to whom. The agent never assigns or removes a role itself, it only watches for and reports on changes an admin has already made in Keycloak.