PERANCANGAN DAN IMPLEMENTASI SISTEM DETEKSI DAN MANAJEMEN INSIDEN KEAMANAN SIBER BERBASIS LOG AUTENTIKASI SSO PADA PT. XYZ

Abstract

The advancement of information technology has driven the widespread adoption of Single Sign-On (SSO) as a centralized authentication solution, making it a prime target for attacks such as brute force and credential stuffing. This study proposes the design and implementation of a cybersecurity incident detection and management system based on Keycloak SSO authentication log analysis. The system integrates four main components: Keycloak as the SSO provider, Redis for alert deduplication and temporary storage, TheHive as the incident management platform, and n8n for workflow automation. Threat detection is performed by a Python worker that continuously reads Keycloak LOGIN_ERROR logs and compares them against defined security rules—brute force and credential stuffing detection. A deduplication mechanism using Redis prevents duplicate incident tickets from being created in TheHive. Experimental testing with simultaneous attack injection from two IP addresses across eight simulation scenarios showed that the system achieved 100% detection accuracy for both attack types. The deduplication mechanism successfully ensured only one unique incident case was created per attacker entity per day. The average end-to-end processing time from alert detection to case creation in TheHive was 2.937 seconds. These results demonstrate that the proposed architecture effectively automates security monitoring, alert deduplication, and incident ticket creation in an efficient and structured manner.