Using Keen
Keen alongside SIEM and security monitoring
Chapter 16 of 17
Use Keen alongside security monitoring
If you run Wazuh or another SIEM, Keen does not replace it. This chapter explains how the two divide the work, how to bring security events into Keen, and what a reviewed piece of security evidence looks like end to end.
Keen alongside Wazuh and SIEMs
Keen takes an evidence-first approach: collect a record of what happened, attribute it to the relevant controls, and keep the supporting material available for review. Your monitoring platform supplies technical evidence; Keen connects it to the organisation's wider assurance and ISMS work.
The question Keen answers next is: “How does this event support our control, which risk does that control address, and what did we conclude when we reviewed it?” Policies, assets, owners, measurements and audits all hang off that answer.
| Area | Wazuh / security monitoring | Keen |
|---|---|---|
| Endpoint monitoring and detection | Wazuh agents and server analysis provide intrusion detection, file integrity monitoring, configuration assessment and vulnerability detection. | Ingests records produced by these systems and makes them available as evidence. Endpoint monitoring remains with the source platform. |
| Investigation and response | Security teams investigate alerts; Wazuh active response can execute configured actions. SIEM response and case-management capabilities vary by product. | Reviews supporting events, raises questions and can declare an incident through a configured external incident webhook. Response outcomes can be collected as further evidence. |
| Framework attribution | Wazuh supplies compliance rule tags and dashboards, and supports custom compliance identifiers. Other SIEMs offer their own mappings and reports. | Maintains editable frameworks, controls and evidence-mapping rules. Reviewers can inspect automatic mappings, add manual mappings with rationale, and use evidence across relevant frameworks. |
| Evidence across the organisation | Security alerts, endpoint findings and technical assessment results are central inputs. Wider business integrations depend on the platform. | Combines security events with development, operational and organisational records, document artefacts and manually recorded activities. |
| Risk and ISMS management | Security findings inform risk decisions. Broader governance workflows depend on the product and connected tools. | Connects risk ratings and treatments with controls, assets, people, suppliers, objectives, policies and processes. |
| Policies and documents | Security configuration policies support technical checks; document governance depends on the wider toolset. | Supports authored, uploaded and linked documents, version history, folders and enabled BookStack page/section capture. |
| Effectiveness measurements | Operational dashboards and reports provide security measurements. | Records observations against configured thresholds and links measures to controls or clauses, providing evidence of both results and regular measurement. |
| Audits and review | Alerts and compliance reports provide material for an assessment. | Schedules and runs audits, samples evidence, records findings and supports documented review of the management system. |
Wazuh is the concrete example here. SIEM capabilities vary by edition, integrations and configuration, and some include substantial governance or audit features. Weigh the workflows you already have against the relationships and reviews you want to manage in Keen.
Bring security events into Keen
There are two configured paths, and they can coexist.
Through Loki. Ship OSSEC or Wazuh log records with a compatible collector such as Grafana Alloy, store them in Loki, then configure Keen's Loki collection with a focused LogQL query. Wazuh writes JSON alerts at /var/ossec/logs/alerts/alerts.json; confirm paths and fields for your installed version, and collect the response records you need as well as the detections.
Through ingestion webhooks. A custom Wazuh integration, an active-response script or a relay can post an event to Keen's /v1/webhooks/{provider}/{event_type} route (with Keen's hosted UI proxy, the public path includes /api). Configure the provider's shared-secret header and environment secret, then adapt and test the sender's payload. Preserve the source event identifier, timestamp, affected system, triggering rule, action and observed outcome. Keen stores the submitted payload as an artefact, and mapping definitions give it its framework relationships.
Going deeper: sender responsibilities
The sender or relay needs installation-specific configuration. Keep reporting failures separate from the response action itself and arrange bounded delivery retries. The inbound evidence webhook and the outbound incident-declaration webhook serve different parts of the workflow.
Example: from blocked attack to reviewed evidence
- Collect. Wazuh detects repeated authentication failures and an active response attempts to block the source. Collect the detection and the response result with enough context to correlate them.
- Attribute. In Keen, preview a mapping rule against the actual event and associate it with the relevant monitoring or incident-response controls. Keep the original Wazuh rule and compliance tags in the supporting payload.
- Assess. Does the record show a triggered action, a successful block, or a failure? A detection supports “monitoring operated”; a verified response outcome supports a more specific claim about response effectiveness.
- Connect. Link the control to the risk and policy being assessed. Record a measurement, such as the proportion of sampled responses within an agreed response time, with a defined period, denominator and observations.
- Review. Sample the event and the measurement into an audit, ask for missing context and record the finding. One successful response supports that observation; broader conclusions need representative evidence and an assessment of coverage.
A mapped event establishes relevance to a control. Compliance and effectiveness conclusions still need a review of evidence, scope, timeliness and exceptions. Continue with evidence collection and mapping, effectiveness measurements and audit sampling.
References and scope
The comparison was reviewed on 6 October 2026 against this Keen codebase and the following primary documentation. The integration examples describe configurable workflows.