SIEM events

Knocknoc writes a structured line for every notable action and sends them wherever you set up under Logs > SIEM integration. This page is what those lines say, so you can write rules against them.

What every event carries

Field	What it holds
KnocknocEvent	The event name, such as LoginFailure
category	One of the six groups below, so a rule can take a whole class at once
severity	info, warning or critical
outcome	success or failure
ActorUserName	Who did it, where there is someone to name
ClientIP	The address the request came from
ConnectionIP	The address that connected, which is your proxy when one sits in front
trace_id	Ties the lines of one request together

An event about a person or a thing also names what it acted on, under TargetName or, for a Knoc, ResourceName.

{
    "KnocknocEvent": "LoginFailure",
    "category": "Authentication",
    "severity": "warning",
    "outcome": "failure",
    "ActorType": "user",
    "ActorUserName": "jsmith",
    "Reason": "invalid_password",
    "ClientIP": "203.0.113.24",
    "ConnectionIP": "10.0.0.1",
    "trace_id": "abc123",
    "time": "2026-10-28T10:30:00Z"
}

What to alert on

Most events are routine, and warning covers something as ordinary as a mistyped password, so a rule on severity alone will be noisy. These are the ones worth alerting on:

When you want to know	Events
Someone is trying to get in	LoginFailure, RateLimited, TOTPInvalid
Access was refused on purpose	TrustPolicyBlocked, GreynoiseBlocked, AllowlistAuthFailed
Access is broken	GrantError, RevokeError, AgentDisconnected, AgentFault
Someone changed something big	DeleteAdmin, AdminOverrideGrant, MassAdminSessionInvalidation
Knocknoc itself is in trouble	LicenseInvalid, LicenseExpired, LicenseAutoRemoved

Those last three are the only events Knocknoc marks critical.

The six categories

Category	What lands in it
Authentication	Signing in and out, password changes, TOTP checks, and sessions being ended
TrustEngine	What a trust policy decided, and what the threat intelligence sources said
Grants	Access given and taken away, and anything that failed on the way
Agent	Agents connecting, dropping and faulting
AdminSystemChanges	Every create, edit and delete an admin makes, settings included
Licence	Licence validation, expiry and check-in

Trust Engine events in detail

Event	When	What it carries
TrustPolicyObserved	A policy noticed something and allowed access.	The user, the address, the Knoc, the policy, the outcome, and a field per signal that matched. A condition that applied its response because its provider failed is listed under MatchedProviderFailed, one whose provider refused the credential under MatchedProviderRejected, and one nobody asked about under MatchedNotEvaluated. A verdict decided on a stored answer names the sources under DecidedOnStaleAnswer and the age of the oldest under StaleAnswerOldest.
TrustPolicyChallenged	A policy held a grant back pending confirmation.	The same fields as TrustPolicyObserved.
TrustPolicyBlocked	A policy refused a grant.	The same fields as TrustPolicyObserved.
TrustChallengePassed	A user confirmed who they are.	The user, the address they confirmed from, how they confirmed, and how many policies the answer satisfied. No Knoc and no policy, because one confirmation answers every policy the user's Knocs use.
IpIntelCacheCleared	An admin cleared the cached provider answers from the Threat intelligence page.	Who did it, and how many answers the server that took the click dropped.
IpIntelLookupFailed	A provider did not answer.	The provider, the address it was asked about, and the error. Nothing about the user, Knoc or policy, since this is a call to a provider rather than a decision about anyone.
SessionIPChange	A signed-in user's address changed.	The user, the addresses it was, and the one it is now.
TrustPolicyUnreadable	A Knoc's policy could not be read, so nothing could be decided from it.	The Knoc and the policy. This is Knocknoc's own data being wrong, and it will not clear until someone fixes the policy.
GreynoiseBlocked	GreyNoise reported the address as malicious and the Knoc's own setting refused it.	The user, the address and the Knoc. This is the per-Knoc setting rather than a trust policy.
GreynoiseLookupFailed	GreyNoise did not answer.	The address it was asked about, and the error.
IpIntelKeyDegraded	A threat intelligence key stopped working, so the checks that need it are no longer running.	The provider and what went wrong.
GreynoiseKeyDegraded	The GreyNoise key was rejected, or an error left it unconfirmed.	The provider and the state it moved to.
IpIntelLicenseKeyWithdrawn	A provider key that came with your licence is no longer in the licence, and nothing replaced it.	The provider. Fires once across a fleet.

The three TrustPolicy* events share one field shape, so a rule written against one works unchanged against the others. IpIntelLookupFailed marks a failure that will not clear on its own, such as a rejected key or a plan gap, apart from a passing outage, so an alert can single it out.