SAML + OIDC
Starts, callbacks, validation, claims, role mapping, sessions, logout, and failures.
Investigation surface
Six signal domains, one correlation model.
An incident can move across authentication, provisioning, directory, host, relay, and database boundaries without losing its request, session, actor, or evidence context.
Assurance
Success, failure, HBAC, Kerberos, account state, and downstream Linux proof.
SSH + VNC
Jump path, Guacamole launches, readiness, blockers, and ownership.
Suspicious activity
Repeated failures, malformed requests, source patterns, confidence, and containment context.
Lifecycle
Mappings, provisioning outcomes, password-presence flags, retries, drift, and errors.
Health + data
Service readiness, migrations, retention, pruning, schema state, and recovery.
Rich context, secret-safe
More explanation does not mean exposing more sensitive material.
FreeSCIM can retain technical depth while excluding plaintext passwords, tokens, assertions, cookies, private keys, and deployment secrets.
Designed for remediation
Observability becomes an operating advantage.
Every meaningful event can answer what happened, who or what initiated it, which boundary was involved, what was affected, and what the operator should do next.