---
title: "Keycloak"
slug: "keycloak"
updated: 2026-02-28T23:16:18Z
published: 2026-02-28T23:16:18Z
canonical: "docs.hunters.ai/keycloak"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.hunters.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Keycloak

Self Service Ingestion

          

Connect this data source on your own, using the Hunters platform.

****TL;DR****

| Supported data types | 3rd party detection | Hunters detection | IOC search | Search | Table name | Log format | Collection method |
| --- | --- | --- | --- | --- | --- | --- | --- |
| Keycloak Application Logs |  |  | ✅ | ✅ | keycloak_application_logs | NDJSON | S3 |

---

## Overview

![image.png](https://cdn.document360.io/5f63f0e0-3c70-4d00-b623-82493be0bde5/Images/Documentation/keycloak logo(1).png)[Keycloak](https://www.keycloak.org/) is an open-source identity and access management solution offering SSO, user management, and support for OAuth 2.0, OpenID Connect, and SAML. It simplifies authentication and authorization for apps with features like social login, multi-factor authentication, and a user-friendly admin console.

## Supported data types

### Keycloak Application Logs

**Table name:** `keycloak_application_logs`

Keycloak application logs provide detailed information about the server's activities, including authentication events, user operations, and system behavior. These logs are crucial for monitoring, debugging, and auditing. Keycloak supports configurable log levels (e.g., INFO, DEBUG, ERROR) and can integrate with logging frameworks like Log4j or external tools for centralized log management.

## Send data to Hunters

Hunters supports the ingestion of Keycloak logs via an intermediary AWS S3 bucket.

**To connect Keycloak logs:**

1. Follow [this Keycloak guide](https://www.keycloak.org/server/logging) to export your logs from the data lake to an AWS S3 bucket.
2. Once the export is completed and the logs are collected to S3, follow the steps in [this section](/v1/docs/connect-data-through-aws-s3).

## Expected format

Logs are expected in JSON format.

```json
{
  "@timestamp": "2024-07-02T11:18:47.512+02:00",
  "log_type": "application_log",
  "severity": "INFO",
  "description": "user_name=user@examplecorp.com;ip_address=203.0.113.88 EVENT type=LOGIN, realm_id=prod-realm, client_id=web-frontend-prod, ip_address=203.0.113.88, error=null, user_id=11111111-2222-3333-4444-555555555555",
  "class": "org.jboss.logmanager.ExtLogRecord",
  "thread": "threadID: 48217",
  "correlation_id": "request_id=aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee;http_session_id=ffffffff-1111-2222-3333-444444444444;ravelin_device_id=rjs-12345678-90ab-cdef-1234-567890abcdef;realm=prod-realm;client_id=web-frontend-prod;user_id=11111111-2222-3333-4444-555555555555;event_type=LOGIN;session_id=99999999-8888-7777-6666-555555555555;error=;caller=;caller_version="
}
```