---
title: "Keeper"
slug: "keeper"
tags: ["Self Service Ingestion"]
updated: 2026-02-28T23:13:54Z
published: 2026-02-28T23:13:54Z
canonical: "docs.hunters.ai/keeper"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Keeper

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

****TL;DR****

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Keeper Logs |  |  | ✅ | ✅ | keeper_logs | NDJSON | S3 |

---

## Overview

![image.png](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/image-1738759246376.png)[Keeper Security](https://docs.keeper.io/enterprise-guide/) is transforming the way organizations and individuals protect their passwords and sensitive digital assets to significantly reduce password-related data breaches and cyberthreats. Keeper is the leading provider of zero-knowledge security and encryption software covering password management, secrets management, connection management, dark web monitoring, digital file storage, secret messaging, and more.

Hunters supports the Integration of Keeper to the data lake. Moreover, the data source is used in the Hunters pipeline for detection and investigation related to Login events, as well as mapped to IOC Search.

## Supported data types

### Keeper Logs

**Table name:** `keeper_logs`

Keeper's Advanced Reporting & Alerts Module ("ARAM") is a critical component of the Keeper Security platform which provides Keeper Administrators and Compliance teams tools for monitoring overall usage and adherence to policies.

Learn more [here](https://docs.keeper.io/enterprise-guide/event-reporting).

## Send data to Hunters

Hunters supports the ingestion of Keeper logs via an intermediary AWS S3 bucket.

**To connect Keeper logs:**

1. Export your logs from Keeper to an AWS S3 bucket by following [this guide](https://docs.keeper.io/enterprise-guide/event-reporting/aws-s3-bucket).
2. Once the export is completed and the logs are collected to S3, follow the steps in [this section](/v1/docs/connect-data-through-aws-s3).

## Expected format

The expected format is json-array which is one of Keeper's default output formats.

```json
[
  {
    "audit_event": "login",
    "remote_address": "1.1.1.1",
    "client_version": "iPhone.17.4.1",
    "timestamp": "2023-10-05T18:12:11.321Z",
    "username": "user@examplecorp.com",
    "enterprise_id": 91025
  },
  {
    "audit_event": "login",
    "remote_address": "1.1.1.1",
    "client_version": "iPhone.17.4.1",
    "timestamp": "2023-10-05T18:12:21.842Z",
    "username": "user@examplecorp.com",
    "enterprise_id": 91025
  },
  {
    "audit_event": "login",
    "remote_address": "1.1.1.1",
    "client_version": "iPhone.17.4.1",
    "timestamp": "2023-10-05T18:12:18.507Z",
    "username": "user@examplecorp.com",
    "enterprise_id": 91025
  },
  {
    "record_uid": "Zx8LmN3qRtYpVb6KjHd92Q",
    "audit_event": "open_record",
    "remote_address": "1.1.1.1",
    "client_version": "iPhone.17.4.1",
    "timestamp": "2023-10-05T18:13:02.115Z",
    "username": "user@examplecorp.com",
    "enterprise_id": 91025
  },
  {
    "record_uid": "Zx8LmN3qRtYpVb6KjHd92Q",
    "audit_event": "fast_fill",
    "remote_address": "1.1.1.1",
    "client_version": "iPhone.17.4.1",
    "timestamp": "2023-10-05T18:13:02.115Z",
    "username": "user@examplecorp.com",
    "enterprise_id": 91025
  }
]
```