Announcing Nametag SIEM Integrations: Identity Data for Automation & Security

Nametag is now integrated with popular Security Information & Event Management (SIEM) tools such as Splunk, Microsoft Sentinel, IBM Qradar, LogRhythm, Google Chronicle, AWS Cloudwatch, and Trellix. Security teams can benefit from Nametag verification data in your preferred SIEM environment, adding rich new identity event data to your analytics. 

Nametag SIEM integrations enable numerous use cases including anomaly detection, real-time alerts, incident reports, automated step-up verification and other workflows. Read on to learn more about our new SIEM integrations or check out our documentation.

Why did we build SIEM integrations?

Because Nametag is effectively a security control, it can be very useful—or even required—to incorporate Nametag data into your SIEM. The benefits of doing so are numerous: by integrating your SIEM with Nametag, you can significantly enhance your organization’s security posture with rich new data sources; streamline compliance efforts with audit logging; and save time with new security workflow automations.

Some examples of how Nametag customers are already using SIEM integrations:

• Anomaly Detection: Monitor identity verification and account recovery activities for suspicious signals, such as unusual frequency or geographic locations.
• Real-time Alerts: Generate real-time alerts for suspicious activities such as repeated failed identity verification attempts to enable quick incident response.
• Audit Trails: Maintain detailed logs of all identity verifications, password resets, and MFA resets for regulatory compliance and forensic investigation purposes.
• Incident Reports: Conduct post-incident reports by reviewing historical logs and patterns related to identity verification and password reset activities.
• Unified Dashboard: Combine data from Nametag with your SIEM, identity management and other tools for a holistic view of your security posture.

How to use Nametag SIEM integrations

Nametag SIEM integrations are built to work with all Security Information & Event Management platforms including Microsoft Sentinel, Splunk, Google Chronicle, AWS Cloudwatch, and others. 

Using our simple API-based webhooks, you can quickly bring customizable data points from Nametag into your SIEM for analysis and action. Our approach isn’t confined to one proprietary format; it adapts to your in-house developed logging and other infrastructure.

When a Nametag event occurs, you can configure our platform to package up some of that information and send it to your SIEM. 

1. An event happens in Nametag (e.g. someone completes self-service account recovery, or a helpdesk agent sends an identity request)
2. Nametag constructs a JSON body with the data your request, then posts it to the endpoint of your SIEM.
3. Your SIEM maps the data fields, enabling cross-correlations, alerting, and a wide range of other use cases.

Check out our documentation, or contact us to learn more about our SIEM integrations. You can sign up for a free trial of our self-service account recovery and helpdesk verification solutions, but you'll need to be a current customer or running an active Proof of Concept to test our SIEM integrations.