Integration Process
Navigate to your profile and tap on "Settings" button.
Go to Settings section and tap on "Workspace". In this screen tap on "Connect SIEM" button.
Choose the wanted provider from the existing providers (Crowdstrike, Splunk or Microsoft Sentinel) then enter the required URL and token.
Check out that everything is working an activated smoothly. In anytime you can disable the integration to your SIEM.
Recommended SIEM Detection Rules
After connecting your SIEM, you can turn Spikerz events into detection and monitoring rules for your SOC.
To make Spikerz activity easier to operationalize, we recommend grouping events into five detection families. Each family represents a different security or audit use case, allowing your team to apply the appropriate severity, response workflow, and escalation policy.
Detection family | What it covers | Recommended handling |
1. Account Takeover & Active Intrusion | Compromised users, unauthorized access, suspicious logins, account lockouts, and account deactivation | High priority. Create an incident when received. |
2. Credential & Data Breach Exposure | Leaked passwords and detected email/data breaches | High priority. Create an incident when received. |
3. Social Media Access & Identity Governance | Permissions, roles, invitations, employee access, authorization, and workspace access changes | Review as governance/audit activity and escalate when correlated with a security signal. |
4. Social Media Secrets & Authentication-Factor Operations | Password, 2FA, email, phone, backup-code, and secret-management operations | Review as security-sensitive audit activity and correlate with takeover signals. |
5. Spikerz Platform Telemetry & Audit Trail | Spikerz account activity, logins, extension activity, product interactions, and integration testing | Use primarily for audit, operational visibility, and troubleshooting. |
SOC response recommendation
For Families 1 and 2, we recommend opening an incident as soon as a matching event arrives and targeting an acknowledgement time of approximately 15–30 minutes.
Families 3–5 are generally better suited to audit or batch review. Escalate them when the activity correlates with a Family 1 or Family 2 signal involving the same identity, employee, or social account.
For example, a 2faRemoved event followed by autoAccountLockout2FAChangedTriggered should receive additional attention because the combination can indicate an attempted account takeover.
Important: SIEM source names, table names, index names, and field mappings can differ between environments. Before creating production rules, confirm how a Spikerz event appears in your SIEM and adjust the source or field names where required.
Securonix
Spikerz events can be used in Securonix Spotter searches and detection policies.
For the queries below, configure your Spikerz parser or field mapping so that:
Spikerz
typeis mapped toeventtypeSpikerz
actionis mapped todeviceactionThe Spikerz data source is named
Spikerz
If your data source uses another name, replace resourcegroupname = "Spikerz" accordingly.
1. Account Takeover & Active Intrusion
index=activity AND resourcegroupname = "Spikerz" AND ( eventtype = "compromisedUserDetected" OR eventtype = "compromisedUserPermissionRemoved" OR eventtype = "unauthorizedUserDetected" OR eventtype = "suspiciousActivityNewLogin" OR eventtype = "accountDeactivated" OR eventtype = "autoAccountLockoutNewLoginTriggered" OR eventtype = "autoAccountLockout2FAChangedTriggered" OR eventtype = "autoAccountLockoutNumberChangedTriggered" OR eventtype = "manualAccountLockoutActivated" )
2. Credential & Data Breach Exposure
index=activity AND resourcegroupname = "Spikerz" AND ( eventtype = "passwordsLeaked" OR eventtype = "employeePasswordsLeaked" OR eventtype = "emailDataBreachesDetected" OR eventtype = "employeeEmailDataBreachesDetected" )
3. Social Media Access & Identity Governance
index=activity AND resourcegroupname = "Spikerz" AND ( eventtype = "permissionAdded" OR eventtype = "permissionRemoved" OR eventtype = "automaticPermissionRemovalSuccess" OR eventtype = "failedPermissionOperation" OR eventtype = "roleAdded" OR eventtype = "roleChanged" OR eventtype = "roleRemoved" OR eventtype = "pageAdded" OR eventtype = "pageRemoved" OR eventtype = "employeeAccessExpired" OR eventtype = "employeeTerminated" OR eventtype = "employeeNameChanged" OR eventtype = "invitationSent" OR eventtype = "invitationResent" OR eventtype = "invitationExpired" OR eventtype = "invitationCancelled" OR deviceaction = "asset_access_granted" OR deviceaction = "workspace_access_granted" OR deviceaction = "workspace_access_revoked" OR deviceaction = "workspace_access_changed" OR deviceaction = "permissions_settings_changed" OR deviceaction = "whitelist_user_added" OR deviceaction = "whitelist_user_removed" OR deviceaction = "user_marked_as_authorized" OR deviceaction = "user_marked_as_unauthorized" OR deviceaction = "employee_protection_enabled" OR deviceaction = "employee_terminated" OR deviceaction = "alert_approved_by_user" OR deviceaction = "alert_denied_by_user" )
4. Social Media Secrets & Authentication-Factor Operations
index=activity AND resourcegroupname = "Spikerz" AND ( eventtype = "2faAdded" OR eventtype = "2faChange" OR eventtype = "2faRemoved" OR eventtype = "emailAdded" OR eventtype = "emailChange" OR eventtype = "emailRemoved" OR eventtype = "phoneNumberAdded" OR eventtype = "phoneNumberChange" OR eventtype = "phoneNumberRemoved" OR eventtype = "passwordChanged" OR deviceaction = "password_added" OR deviceaction = "password_changed" OR deviceaction = "password_copied" OR deviceaction = "password_update_prompted" OR deviceaction = "password_update_saved" OR deviceaction = "password_update_dismissed" OR deviceaction = "manual_password_rotate_triggered" OR deviceaction = "two_factor_6_digits_code_generated" OR deviceaction = "two_factor_activation_code_stored" OR deviceaction = "two_factor_authenticator_deleted" OR deviceaction = "two_factor_backup_codes_stored" OR deviceaction = "two_factor_backup_codes_deleted" OR deviceaction = "two_factor_used_via_extension" OR deviceaction = "secure_email_generated" OR deviceaction = "secure_email_deleted" OR deviceaction = "secure_email_auto_forward_updated" OR deviceaction = "secure_email_webhook_received" OR deviceaction = "secure_phone_generated" OR deviceaction = "secure_phone_deleted" OR deviceaction = "secure_phone_auto_forward_updated" OR deviceaction = "secure_phone_sms_received" OR deviceaction = "employee_backup_email_set" OR deviceaction = "employee_backup_email_removed" )
5. Spikerz Platform Telemetry & Audit Trail
index=activity AND resourcegroupname = "Spikerz" AND ( eventtype = "testAlert" OR deviceaction = "account_connected" OR deviceaction = "account_refreshed" OR deviceaction = "account_selected" OR deviceaction = "user_logged_in" OR deviceaction = "user_logged_out" OR deviceaction = "platform_login_succeeded" OR deviceaction = "extension_installed" OR deviceaction = "autofill_attempted" OR deviceaction = "widget_opened" OR deviceaction = "widget_workspace_picked" OR deviceaction = "detection_layer_used" OR deviceaction = "phishing_blocklist_fetch_failed" )
Splunk
Spikerz events are delivered as JSON. The examples below use spath to extract the JSON fields before filtering on the Spikerz type and action values.
The queries assume the source type is spikerz. If you use another source type, update the first line.
1. Account Takeover & Active Intrusion
sourcetype=spikerz | spath | search type IN ( "compromisedUserDetected", "compromisedUserPermissionRemoved", "unauthorizedUserDetected", "suspiciousActivityNewLogin", "accountDeactivated", "autoAccountLockoutNewLoginTriggered", "autoAccountLockout2FAChangedTriggered", "autoAccountLockoutNumberChangedTriggered", "manualAccountLockoutActivated" )
2. Credential & Data Breach Exposure
sourcetype=spikerz | spath | search type IN ( "passwordsLeaked", "employeePasswordsLeaked", "emailDataBreachesDetected", "employeeEmailDataBreachesDetected" )
3. Social Media Access & Identity Governance
sourcetype=spikerz | spath | search ( type IN ( "permissionAdded", "permissionRemoved", "automaticPermissionRemovalSuccess", "failedPermissionOperation", "roleAdded", "roleChanged", "roleRemoved", "pageAdded", "pageRemoved", "employeeAccessExpired", "employeeTerminated", "employeeNameChanged", "invitationSent", "invitationResent", "invitationExpired", "invitationCancelled" ) OR action IN ( "asset_access_granted", "workspace_access_granted", "workspace_access_revoked", "workspace_access_changed", "permissions_settings_changed", "whitelist_user_added", "whitelist_user_removed", "user_marked_as_authorized", "user_marked_as_unauthorized", "employee_protection_enabled", "employee_terminated", "alert_approved_by_user", "alert_denied_by_user" ) )
4. Social Media Secrets & Authentication-Factor Operations
sourcetype=spikerz | spath | search ( type IN ( "2faAdded", "2faChange", "2faRemoved", "emailAdded", "emailChange", "emailRemoved", "phoneNumberAdded", "phoneNumberChange", "phoneNumberRemoved", "passwordChanged" ) OR action IN ( "password_added", "password_changed", "password_copied", "password_update_prompted", "password_update_saved", "password_update_dismissed", "manual_password_rotate_triggered", "two_factor_6_digits_code_generated", "two_factor_activation_code_stored", "two_factor_authenticator_deleted", "two_factor_backup_codes_stored", "two_factor_backup_codes_deleted", "two_factor_used_via_extension", "secure_email_generated", "secure_email_deleted", "secure_email_auto_forward_updated", "secure_email_webhook_received", "secure_phone_generated", "secure_phone_deleted", "secure_phone_auto_forward_updated", "secure_phone_sms_received", "employee_backup_email_set", "employee_backup_email_removed" ) )
5. Spikerz Platform Telemetry & Audit Trail
sourcetype=spikerz | spath | search ( type="testAlert" OR action IN ( "account_connected", "account_refreshed", "account_selected", "user_logged_in", "user_logged_out", "platform_login_succeeded", "extension_installed", "autofill_attempted", "widget_opened", "widget_workspace_picked", "detection_layer_used", "phishing_blocklist_fetch_failed" ) )
Microsoft Sentinel
Use the following Kusto Query Language (KQL) examples to build Microsoft Sentinel analytics rules.
The examples assume:
Your custom table is named
Spikerz_CL.The original Spikerz JSON payload is stored in
RawData.
If your connector maps type and action directly into table columns, use those columns instead of parsing RawData.
1. Account Takeover & Active Intrusion
Spikerz_CL | extend payload = parse_json(RawData) | extend spikerz_type = tostring(payload.type) | where spikerz_type in ( "compromisedUserDetected", "compromisedUserPermissionRemoved", "unauthorizedUserDetected", "suspiciousActivityNewLogin", "accountDeactivated", "autoAccountLockoutNewLoginTriggered", "autoAccountLockout2FAChangedTriggered", "autoAccountLockoutNumberChangedTriggered", "manualAccountLockoutActivated" )
2. Credential & Data Breach Exposure
Spikerz_CL | extend payload = parse_json(RawData) | extend spikerz_type = tostring(payload.type) | where spikerz_type in ( "passwordsLeaked", "employeePasswordsLeaked", "emailDataBreachesDetected", "employeeEmailDataBreachesDetected" )
3. Social Media Access & Identity Governance
Spikerz_CL | extend payload = parse_json(RawData) | extend spikerz_type = tostring(payload.type), spikerz_action = tostring(payload.action) | where spikerz_type in ( "permissionAdded", "permissionRemoved", "automaticPermissionRemovalSuccess", "failedPermissionOperation", "roleAdded", "roleChanged", "roleRemoved", "pageAdded", "pageRemoved", "employeeAccessExpired", "employeeTerminated", "employeeNameChanged", "invitationSent", "invitationResent", "invitationExpired", "invitationCancelled" ) or spikerz_action in ( "asset_access_granted", "workspace_access_granted", "workspace_access_revoked", "workspace_access_changed", "permissions_settings_changed", "whitelist_user_added", "whitelist_user_removed", "user_marked_as_authorized", "user_marked_as_unauthorized", "employee_protection_enabled", "employee_terminated", "alert_approved_by_user", "alert_denied_by_user" )
4. Social Media Secrets & Authentication-Factor Operations
Spikerz_CL | extend payload = parse_json(RawData) | extend spikerz_type = tostring(payload.type), spikerz_action = tostring(payload.action) | where spikerz_type in ( "2faAdded", "2faChange", "2faRemoved", "emailAdded", "emailChange", "emailRemoved", "phoneNumberAdded", "phoneNumberChange", "phoneNumberRemoved", "passwordChanged" ) or spikerz_action in ( "password_added", "password_changed", "password_copied", "password_update_prompted", "password_update_saved", "password_update_dismissed", "manual_password_rotate_triggered", "two_factor_6_digits_code_generated", "two_factor_activation_code_stored", "two_factor_authenticator_deleted", "two_factor_backup_codes_stored", "two_factor_backup_codes_deleted", "two_factor_used_via_extension", "secure_email_generated", "secure_email_deleted", "secure_email_auto_forward_updated", "secure_email_webhook_received", "secure_phone_generated", "secure_phone_deleted", "secure_phone_auto_forward_updated", "secure_phone_sms_received", "employee_backup_email_set", "employee_backup_email_removed" )
5. Spikerz Platform Telemetry & Audit Trail
Spikerz_CL | extend payload = parse_json(RawData) | extend spikerz_type = tostring(payload.type), spikerz_action = tostring(payload.action) | where spikerz_type == "testAlert" or spikerz_action in ( "account_connected", "account_refreshed", "account_selected", "user_logged_in", "user_logged_out", "platform_login_succeeded", "extension_installed", "autofill_attempted", "widget_opened", "widget_workspace_picked", "detection_layer_used", "phishing_blocklist_fetch_failed" )
CrowdStrike
The following queries are designed for CrowdStrike Falcon Next-Gen SIEM / LogScale.
They assume Spikerz events use the spikerz source type and that the original JSON is available in @rawstring.
1. Account Takeover & Active Intrusion
@sourcetype="spikerz" | parseJson(field=@rawstring, prefix="json.") | in(field="json.type", values=[ "compromisedUserDetected", "compromisedUserPermissionRemoved", "unauthorizedUserDetected", "suspiciousActivityNewLogin", "accountDeactivated", "autoAccountLockoutNewLoginTriggered", "autoAccountLockout2FAChangedTriggered", "autoAccountLockoutNumberChangedTriggered", "manualAccountLockoutActivated" ])
2. Credential & Data Breach Exposure
@sourcetype="spikerz" | parseJson(field=@rawstring, prefix="json.") | in(field="json.type", values=[ "passwordsLeaked", "employeePasswordsLeaked", "emailDataBreachesDetected", "employeeEmailDataBreachesDetected" ])
3. Social Media Access & Identity Governance
@sourcetype="spikerz" | parseJson(field=@rawstring, prefix="json.") | ( in(field="json.type", values=[ "permissionAdded", "permissionRemoved", "automaticPermissionRemovalSuccess", "failedPermissionOperation", "roleAdded", "roleChanged", "roleRemoved", "pageAdded", "pageRemoved", "employeeAccessExpired", "employeeTerminated", "employeeNameChanged", "invitationSent", "invitationResent", "invitationExpired", "invitationCancelled" ]) or in(field="json.action", values=[ "asset_access_granted", "workspace_access_granted", "workspace_access_revoked", "workspace_access_changed", "permissions_settings_changed", "whitelist_user_added", "whitelist_user_removed", "user_marked_as_authorized", "user_marked_as_unauthorized", "employee_protection_enabled", "employee_terminated", "alert_approved_by_user", "alert_denied_by_user" ]) )
4. Social Media Secrets & Authentication-Factor Operations
@sourcetype="spikerz" | parseJson(field=@rawstring, prefix="json.") | ( in(field="json.type", values=[ "2faAdded", "2faChange", "2faRemoved", "emailAdded", "emailChange", "emailRemoved", "phoneNumberAdded", "phoneNumberChange", "phoneNumberRemoved", "passwordChanged" ]) or in(field="json.action", values=[ "password_added", "password_changed", "password_copied", "password_update_prompted", "password_update_saved", "password_update_dismissed", "manual_password_rotate_triggered", "two_factor_6_digits_code_generated", "two_factor_activation_code_stored", "two_factor_authenticator_deleted", "two_factor_backup_codes_stored", "two_factor_backup_codes_deleted", "two_factor_used_via_extension", "secure_email_generated", "secure_email_deleted", "secure_email_auto_forward_updated", "secure_email_webhook_received", "secure_phone_generated", "secure_phone_deleted", "secure_phone_auto_forward_updated", "secure_phone_sms_received", "employee_backup_email_set", "employee_backup_email_removed" ]) )
5. Spikerz Platform Telemetry & Audit Trail
@sourcetype="spikerz" | parseJson(field=@rawstring, prefix="json.") | ( in(field="json.type", values=["testAlert"]) or in(field="json.action", values=[ "account_connected", "account_refreshed", "account_selected", "user_logged_in", "user_logged_out", "platform_login_succeeded", "extension_installed", "autofill_attempted", "widget_opened", "widget_workspace_picked", "detection_layer_used", "phishing_blocklist_fetch_failed" ]) )
Elasticsearch
For Elastic Security, create a Custom query rule and use Kibana Query Language (KQL).
Set the rule's index pattern or data view to the location where your Spikerz events are stored. The examples below assume type and action are indexed as top-level fields.
1. Account Takeover & Active Intrusion
type: ( "compromisedUserDetected" OR "compromisedUserPermissionRemoved" OR "unauthorizedUserDetected" OR "suspiciousActivityNewLogin" OR "accountDeactivated" OR "autoAccountLockoutNewLoginTriggered" OR "autoAccountLockout2FAChangedTriggered" OR "autoAccountLockoutNumberChangedTriggered" OR "manualAccountLockoutActivated" )
2. Credential & Data Breach Exposure
type: ( "passwordsLeaked" OR "employeePasswordsLeaked" OR "emailDataBreachesDetected" OR "employeeEmailDataBreachesDetected" )
3. Social Media Access & Identity Governance
( type: ( "permissionAdded" OR "permissionRemoved" OR "automaticPermissionRemovalSuccess" OR "failedPermissionOperation" OR "roleAdded" OR "roleChanged" OR "roleRemoved" OR "pageAdded" OR "pageRemoved" OR "employeeAccessExpired" OR "employeeTerminated" OR "employeeNameChanged" OR "invitationSent" OR "invitationResent" OR "invitationExpired" OR "invitationCancelled" ) OR action: ( "asset_access_granted" OR "workspace_access_granted" OR "workspace_access_revoked" OR "workspace_access_changed" OR "permissions_settings_changed" OR "whitelist_user_added" OR "whitelist_user_removed" OR "user_marked_as_authorized" OR "user_marked_as_unauthorized" OR "employee_protection_enabled" OR "employee_terminated" OR "alert_approved_by_user" OR "alert_denied_by_user" ) )
4. Social Media Secrets & Authentication-Factor Operations
( type: ( "2faAdded" OR "2faChange" OR "2faRemoved" OR "emailAdded" OR "emailChange" OR "emailRemoved" OR "phoneNumberAdded" OR "phoneNumberChange" OR "phoneNumberRemoved" OR "passwordChanged" ) OR action: ( "password_added" OR "password_changed" OR "password_copied" OR "password_update_prompted" OR "password_update_saved" OR "password_update_dismissed" OR "manual_password_rotate_triggered" OR "two_factor_6_digits_code_generated" OR "two_factor_activation_code_stored" OR "two_factor_authenticator_deleted" OR "two_factor_backup_codes_stored" OR "two_factor_backup_codes_deleted" OR "two_factor_used_via_extension" OR "secure_email_generated" OR "secure_email_deleted" OR "secure_email_auto_forward_updated" OR "secure_email_webhook_received" OR "secure_phone_generated" OR "secure_phone_deleted" OR "secure_phone_auto_forward_updated" OR "secure_phone_sms_received" OR "employee_backup_email_set" OR "employee_backup_email_removed" ) )
5. Spikerz Platform Telemetry & Audit Trail
( type: "testAlert" OR action: ( "account_connected" OR "account_refreshed" OR "account_selected" OR "user_logged_in" OR "user_logged_out" OR "platform_login_succeeded" OR "extension_installed" OR "autofill_attempted" OR "widget_opened" OR "widget_workspace_picked" OR "detection_layer_used" OR "phishing_blocklist_fetch_failed" ) )
Rapid7
Use the following LEQL queries with your Spikerz log set selected in Rapid7.
The examples assume Rapid7 has parsed the Spikerz JSON fields as type and action.
1. Account Takeover & Active Intrusion
where(type IN [ "compromisedUserDetected", "compromisedUserPermissionRemoved", "unauthorizedUserDetected", "suspiciousActivityNewLogin", "accountDeactivated", "autoAccountLockoutNewLoginTriggered", "autoAccountLockout2FAChangedTriggered", "autoAccountLockoutNumberChangedTriggered", "manualAccountLockoutActivated" ])
2. Credential & Data Breach Exposure
where(type IN [ "passwordsLeaked", "employeePasswordsLeaked", "emailDataBreachesDetected", "employeeEmailDataBreachesDetected" ])
3. Social Media Access & Identity Governance
where( type IN [ "permissionAdded", "permissionRemoved", "automaticPermissionRemovalSuccess", "failedPermissionOperation", "roleAdded", "roleChanged", "roleRemoved", "pageAdded", "pageRemoved", "employeeAccessExpired", "employeeTerminated", "employeeNameChanged", "invitationSent", "invitationResent", "invitationExpired", "invitationCancelled" ] OR action IN [ "asset_access_granted", "workspace_access_granted", "workspace_access_revoked", "workspace_access_changed", "permissions_settings_changed", "whitelist_user_added", "whitelist_user_removed", "user_marked_as_authorized", "user_marked_as_unauthorized", "employee_protection_enabled", "employee_terminated", "alert_approved_by_user", "alert_denied_by_user" ] )
4. Social Media Secrets & Authentication-Factor Operations
where( type IN [ "2faAdded", "2faChange", "2faRemoved", "emailAdded", "emailChange", "emailRemoved", "phoneNumberAdded", "phoneNumberChange", "phoneNumberRemoved", "passwordChanged" ] OR action IN [ "password_added", "password_changed", "password_copied", "password_update_prompted", "password_update_saved", "password_update_dismissed", "manual_password_rotate_triggered", "two_factor_6_digits_code_generated", "two_factor_activation_code_stored", "two_factor_authenticator_deleted", "two_factor_backup_codes_stored", "two_factor_backup_codes_deleted", "two_factor_used_via_extension", "secure_email_generated", "secure_email_deleted", "secure_email_auto_forward_updated", "secure_email_webhook_received", "secure_phone_generated", "secure_phone_deleted", "secure_phone_auto_forward_updated", "secure_phone_sms_received", "employee_backup_email_set", "employee_backup_email_removed" ] )
5. Spikerz Platform Telemetry & Audit Trail
where( type = "testAlert" OR action IN [ "account_connected", "account_refreshed", "account_selected", "user_logged_in", "user_logged_out", "platform_login_succeeded", "extension_installed", "autofill_attempted", "widget_opened", "widget_workspace_picked", "detection_layer_used", "phishing_blocklist_fetch_failed" ] )
Validate Your Rules
After creating your rules:
Confirm that new Spikerz events are arriving in the selected SIEM.
Run each query manually and verify that it returns the expected event types.
If you send a Spikerz
testAlert, confirm that it appears under Spikerz Platform Telemetry & Audit Trail.Configure the appropriate severity, ownership, notification, and incident workflow for each detection family.
Test your correlation workflow for security-sensitive combinations such as an authentication-factor change followed by an account-lockout or takeover signal.
Once validated, enable the rules according to your organization's existing SOC playbooks and response procedures.