Keycloak IAM Lab 5: Offboarding & SOC Detection — Catching the Deleted User in Wazuh | Live Hands-On

I offboarded a user from the directory — then watched my SIEM catch him trying to come back. This is the part that matters in a breach investigation: not just granting access, but making sure it leaves when the person does. In this live lab (part 2 of user federation): Played HR: deleted the user from the LDAP directory — one change, one place His next login failed at the login page itself: gone from the directory = gone from every app behind Keycloak Hit a real LDAP schema gotcha (groupOfNames requires at least one member) SOC side: shipped Keycloak events into Wazuh and wrote detection rules The offboarded account's login attempt fired an alert — mapped to MITRE T1110 5 failures in 60s escalates to a brute-force / credential-stuffing alert (level 10) Two layers, two detections: Wrong group → denied at AUTHORIZATION (rule 100018) Deleted user → denied at AUTHENTICATION (rule 100020) Honest caveat: deleting the account blocks new logins, but a token already issued survives until it expires. Real deprovisioning must also revoke active sessions. Part 1 (federation):    • IAM- Keycloak Lab 4A: User Federation with...   Full series:    / @cyberops401unauthorized   Live on Twitch:   / cyberops401unauthorized   #DetectionEngineering #Wazuh #Keycloak #LDAP #SIEM #BlueTeam #IncidentResponse #IAM #MITREATTACK #SOC