Your SOC Sees Every Session, Every Privileged Access, Every Change
Endpoint evidence is only useful if your security operations team can see it. Lockfy forwards a rich, SOC-ready event stream to your SIEM, so session protection, local-admin access and software changes become alerts, dashboards and investigations in the tools your analysts already use.
How It Works
| Capability | Description |
|---|
| CEF Events over Syslog | Events are formatted in Common Event Format (CEF) so SIEMs can extract fields reliably, with no custom parsing |
| Flexible Transport | Send over TCP, UDP or TLS-encrypted Syslog, in RFC 3164 or RFC 5424 framing |
| Per-Event Control | Turn individual events on or off, grouped into eight categories, without restarting anything |
| Audit-Grade Delivery | Events are spooled durably and replayed if your SIEM is unreachable, so outages don’t create gaps in the audit trail |
| Consistent Fields | Every event carries the same core fields (who, what, where, when, severity, source server) for easy correlation |
| Health Visibility | The portal shows whether the SIEM feed is healthy, so a broken integration is noticed, not discovered during an audit |
| Webhooks | Trigger your own workflows on session, workstation-connectivity and compliance events, with automatic retries and delivery logs |
| Classic Syslog Logging | Optional Syslog forwarding of application logs (TCP/UDP, RFC 3164/5424) for operations teams |
What Lockfy Sends to Your SIEM
| Category | Example Events |
|---|
| Authentication & Access | Portal sign-in succeeded or failed, tokens issued, setup-mode sign-in |
| Session Activity | Session started, ended, idle, active, locked, unlocked, and locked automatically by Lockfy |
| Privileged Access | Local admin password viewed, randomized, or failed to change |
| Local Accounts | Account created, deleted, enabled or disabled, added to or removed from a group, password expiry changed |
| Compliance | Workstation compliance changed, compliance requirement raised |
| Admin Actions | Configuration changed, policy changed, manual session lock, users, roles and tags changed |
| Asset Connectivity | Workstation connected or disconnected |
| Software & Browsers | Application installed or removed, browser extension installed, removed, enabled or disabled, browser restart requested |
Key Benefits
| Benefit | Impact |
|---|
| Detect Misuse Faster | Correlate unlocks, privileged-password views and failed sign-ins with the rest of your security telemetry |
| Centralized Evidence | Keep endpoint session and privileged-access records in the same place as your other security logs |
| Meet Logging Requirements | Supports event-logging and monitoring controls such as NCA ECC 2-12 |
| No Custom Parsers | Standard CEF means faster onboarding for SOC teams and managed security providers |
Ready to Connect Lockfy to Your SOC?
Learn how Lockfy Enterprise can provide always-on protection for your organization.
