Shared Signals
Overview
The Shared Signals Framework (SSF) lets systems exchange security events, such as “this user’s session was revoked” or “this user’s account was disabled”, as they happen. Britive can receive events and act on the affected user, and it can send its own events to other systems.
Events use the CAEP and RISC event types. Each event is sent as a signed SET.
Shared Signals is configured in Admin → Security → Shared Signals, which has three tabs. The guides in this section follow the same layout.
| Console tab | What it configures | Direction |
|---|---|---|
| Transmitters | External systems, such as an identity provider, that send events to Britive. Britive runs a Britive action on the user for each event. | Inbound |
| Receivers | External systems, such as a SIEM, that Britive sends its own events to | Outbound |
| Events | Events Britive accepted or sent, with the result | Both |
The tab names describe the external system’s role: a transmitter sends events and a receiver receives them. To receive events in Britive, add a transmitter. To send events from Britive, add a receiver.
Permissions
| Console | API | Permission | Built-in roles |
|---|---|---|---|
| View the Transmitters, Receivers, and Events tabs | GET /api/ssf/admin/..., GET /api/ssf/results | securityadmin.security.view, securityadmin.security.list | TenantAdminRole, SecurityAdminRole, TenantAuditorRole, SecurityViewRole |
| Add, change, or delete transmitters, receivers, and their mappings | POST, PATCH, PUT, DELETE /api/ssf/admin/... | securityadmin.security.manage | TenantAdminRole, SecurityAdminRole |
Guides
Receive security events from an identity provider or other transmitter, and run a Britive action on the user for each event.
Send Britive security events, such as a disabled user, to a SIEM, identity provider, or other receiver.
Review the security events Britive received from transmitters or sent to receivers, and whether each one succeeded.
Reference
- Shared Signals Framework in the Britive documentation
Standards:
Last updated on