Spikerz SIEM Alerts: Structure, Risks & Event Types

This document describes Spikerz workspace SIEM alerts. These alerts are generated at the workspace level and may include signals reported by connected social media platforms. They are designed for SOC teams, IT, and security stakeholders to understand what happened, why it matters, and how to assess risk.

1. SIEM Alert Structure

All Spikerz SIEM alerts share a consistent schema, making them easy to ingest and correlate in any SIEM.

Common fields

Field	Description
`_id`	Unique event identifier
`workspaceId`	Spikerz workspace where the event occurred
`platform`	Social platform involved (Instagram, Facebook, TikTok, etc.) or `null`
`accountId`	Internal identifier of the connected account (nullable)
`assetUsername`	Username of the social media asset (nullable)
`employeeId`	Employee identifier (for employee-related events)
`email`	User or employee email (for audit events)
`timestamp`	ISO 8601 timestamp
`sourceType`	Always `spikerz`
`metadata`	Event-specific contextual data

Security alerts vs audit events

Type	Identification	Purpose
Security alert	`type` + `category` populated	High-signal security events
Audit / event log	`action` populated	Visibility, audit, correlation

2. Risk Levels

Risk	Meaning
🚨 Critical	Immediate security incident
🔴 High	Strong security signal
🟠 Medium	Potential risk or loss of visibility
🟡 Informational	Expected activity, audit only

2.1 SIEM Event Examples (JSON)

Below are realistic example payloads showing how Spikerz sends events to your SIEM. These examples illustrate the two core types of events: security alerts and audit / event logs.

Security Alert Example (type + category)

Security alerts represent high-signal security events. They populate type and category, and leave action as null.

{   "_id": "507f1f77bcf86cd799439011",   
"workspaceId": "workspace_123",   
"platform": "instagram",   
"accountId": "17841445325350983",   
"assetUsername": "example_account",   
"employeeId": null,   
"email": null,   
"type": "autoAccountLockoutTriggered",   
"category": "accountSecurity",   
"action": null,   
"timestamp": "2025-04-11T12:55:29.062Z",   
"sourceType": "spikerz",   
"metadata": {     
"trigger": "suspicious_login",     
"device": "Chrome on Windows 10",     
"location": "Berlin, DE"   } }

Audit / Event Log Example (action)

Audit events represent workspace activity, configuration changes, and operational actions. They populate action, and leave type and category as null.
{   "_id": "507f1f77bcf86cd799439012",   
"workspaceId": "workspace_123",   
"platform": "instagram",   
"accountId": "17841445325350983",   
"assetUsername": "example_account",   
"employeeId": "emp_456",   
"email": "[email protected]",   
"type": null,   
"category": null,   
"action": "permissionAdded",   
"timestamp": "2025-04-11T13:02:10.481Z",   
"sourceType": "spikerz",   
"metadata": {     
"role": "admin",     
"grantedBy": "workspace_owner"   } }

3. Account Lockout & Takeover Prevention

Alert name	Explanation	Risk
`manualAccountLockoutActivated`	Account was manually locked	🚨 Critical
`autoAccountLockoutTriggered`	Automatic lockout after high-risk detection	🚨 Critical
`autoAccountLockoutNewLoginTriggered`	Lockout after suspicious new login	🚨 Critical
`autoAccountLockout2FAChangedTriggered`	Lockout after 2FA change	🚨 Critical
`autoAccountLockoutNumberChangedTriggered`	Lockout after phone number change	🚨 Critical

4. Account Protection (Platform Signals)

This category groups authentication, password, and recovery changes reported by connected social platforms.

Alert name	Explanation	Risk
`2faAdded`	Two-factor authentication enabled	🟡 Informational
`2faChange`	Two-factor authentication configuration changed	🟡 Informational
`2faRemoved`	Two-factor authentication disabled	🚨 Critical
`passwordChangedFromApp`	Account password changed on platform	🔴 High
`manual_password_rotate_triggered`	Password rotation initiated	🔴 High
`emailAdded`	Recovery email added	🟡 Informational
`emailRemoved`	Recovery email removed	🔴 High
`emailChange`	Recovery email changed	🔴 High
`phoneNumberAdded`	Recovery phone number added	🟡 Informational
`phoneNumberRemoved`	Recovery phone number removed	🔴 High
`phoneNumberChange`	Recovery phone number changed	🔴 High

5. Data Breaches

Alert name	Explanation	Risk
`emailDataBreachesDetected`	Account email found in breach databases	🔴 High
`passwordsLeaked`	Password found in breach databases	🔴 High
`employeeEmailDataBreachesDetected`	Employee email found in breach databases	🔴 High
`employeePasswordsLeaked`	Employee password found in breach databases	🔴 High

6. Social Media Permissions

Alert name	Explanation	Risk
`permissionAdded`	Permission added on social media asset	🟡 Informational
`permissionRemoved`	Permission removed from social media asset	🟡 Informational
`roleAdded`	Role added on social media asset	🟡 Informational
`roleRemoved`	Role removed from social media asset	🟡 Informational
`pageAdded`	Page added to workspace	🟡 Informational
`pageRemoved`	Page removed from workspace	🟡 Informational
`partnerAdded`	Partner access added	🟡 Informational
`partnerRemoved`	Partner access removed	🟡 Informational
`partnerRoleChanged`	Partner role changed	🟡 Informational
`partnerStatusChanged`	Partner status changed	🟡 Informational
`whitelist_user_added`	Social media account added to whitelist	🟡 Informational
`whitelist_user_removed`	Social media account removed from whitelist	🟡 Informational
`permissions_settings_changed`	Social media permissions configuration changed	🟡 Informational

7. Connectivity & Sync

Alert name	Explanation	Risk
`accountConnected`	Social media account connected to Spikerz	🟡 Informational
`accountDisconnected`	Social media account disconnected from Spikerz	🟠 Medium
`failedFetchPermissions`	Failed to fetch permissions from platform	🟠 Medium

8. Alert Workflow & Audit Events

Alert name	Explanation	Risk
`alert_resolved`	Alert marked as resolved	🟡 Informational
`alert_unresolved`	Alert reopened	🟡 Informational
`alert_mistake`	Alert marked as false positive	🟡 Informational
`alert_assigned_to_user`	Alert assigned to a user	🟡 Informational
`alert_type_changed`	Alert type changed	🟡 Informational
`alert_tags_changed`	Alert tags changed	🟡 Informational

9. Comment & Moderation Events

Alert name	Explanation	Risk
`comment_deleted`	Comment deleted	🟡 Informational
`comment_hidden`	Comment hidden	🟡 Informational
`comment_unhidden`	Comment unhidden	🟡 Informational
`reply_created`	Reply created	🟡 Informational
`reply_edited`	Reply edited	🟡 Informational
`reply_deleted`	Reply deleted	🟡 Informational
`account_blocked`	Account blocked	🟡 Informational