Every identity change in one feed
Sign-ins, access changes, and security signals from every connected system, written as a plain sentence and tied to the person behind it.
Events at a glance
- Identity event types Hydden tracks
- 100+
Why it's important
Events is the activity record in Hydden. Sign-ins, account and access changes, credential and MFA updates, AI agent activity and security signals from every connected system land in one feed and one schema. Each event is tied to the accounts on both sides and to the person who owns them. You can follow one identity across Entra, AWS, Okta, GitHub and the rest without opening another console.
The problems this feature solves
Each connected system keeps its own activity log. Following one identity across Entra, AWS, Okta, and the rest means reading each log on its own.
Some systems keep no activity log. A role assignment or a disabled account on those systems leaves no event stream, and a later data collection only shows the state at that moment.
Security alerts usually name the account that signed in or changed access. The person who owns that account is on the identity record, and matching the alert to that person is a separate step.
What the feature does
Hydden compares each data collection with the one before and records the difference as a typed event, such as role assigned or account disabled.
On the Explore identity events page, each row is a sentence you can filter and search, covering who did what, to whom, in which system, and whether it worked.
Accounts, groups, and AI agents each have an Activity tab with what changed, the security context, and who owns the account.
Events go to Cortex XSIAM, SentinelOne, Splunk, or Microsoft Sentinel in that platform’s native format.
Sources and destinations
Questions
Which systems send events?
Native activity logs come from 20 systems today, including Entra ID, AWS CloudTrail, Google Cloud, Okta, Google Workspace, GitHub, GitLab, Slack, CyberArk, 1Password, Box, Keeper, Jira, Vercel, OpenAI, Anthropic, PAN-OS, SQL Server, PostgreSQL and Linux.
What about systems without an audit log?
Hydden compares each data collection with the previous one and records the difference as typed events, such as account created, member added or role assigned.
Can I send events to my SIEM?
Yes. Events can be forwarded to Cortex XSIAM, SentinelOne, Splunk and Microsoft Sentinel, each with its own filters.
See your own identity activity in one feed
Request a trial and connect your first system.