Unifying Identity Security in Your SIEM: How Opal and RunReveal Create Complete Security Visibility

In today's complex security landscape, organizations face a critical challenge: correlating identity and access events with broader security telemetry to detect and respond to threats effectively. When access changes occur in isolation from security monitoring, teams miss crucial context that could reveal potential security incidents or policy violations.

To address this gap, Opal and RunReveal are partnering to bring together real-time authorization data with comprehensive security observability, giving security teams the complete picture they need to protect their organizations.

The Power of Connected Security Data

Opal provides a data-centric identity platform that gives organizations visibility and control over who has access to what across their entire technology stack. By integrating seamlessly with cloud providers, SaaS applications, and on-premises systems, Opal helps teams implement least privilege access at scale.

RunReveal has established itself as the definitive new player in the SIEM market with its modern observability platform for unifying, querying, and investigating security logs at scale. Their platform enables security teams to rapidly search through vast amounts of security data using a native AI chat to identify threats and investigate incidents.

When used together, Opal's authorization events provide essential context within RunReveal's security data lake, enabling teams to:

• Correlate access changes with suspicious activity patterns

• Investigate security incidents with full visibility into access permissions

• Detect potential insider threats through behavioral analysis

• Streamline compliance reporting with unified audit trails

Key Integration Capabilities

Opal is now part of RunReveal's detections library, making it simple for mutual customers to leverage pre-built detection rules and queries. The integration enables streaming of critical Opal events directly into RunReveal, including:

High-Priority Events for Security Monitoring:

• API token created - Track programmatic access provisioning

• MFA reset - Monitor potential account takeover attempts

• Break-glass access used - Alert on emergency access activation

• User added/removed to/from group - Especially for highly sensitive groups

• Groups manually created/deleted in Opal - Track administrative changes

These events, when correlated with other security telemetry in RunReveal, create powerful detection capabilities that neither platform could provide alone.

Implementation Benefits

Enhanced Threat Detection

By combining identity state changes with security logs, teams can identify complex attack patterns that span both access and activity. This unified view enables faster detection of sophisticated threats that might otherwise go unnoticed.

Proactive Security Posture

The integration enables teams to build proactive detections based on risky access patterns. For example, alerting when a user receives elevated permissions and immediately begins accessing sensitive resources in an unusual pattern.

Compliance and Audit Excellence

With Opal's access events stored alongside other security data in RunReveal, organizations can generate comprehensive compliance reports that include both access governance and security monitoring data.

Getting Started

Setting up the Opal and RunReveal integration is straightforward. Organizations can begin streaming Opal events to RunReveal to augment their security telemetry with critical identity and access data.

RunReveal also supports native AI chat, so users can dig into their Opal logs with natural language, and turn security investigations from hours to minutes.

We're excited to collaborate with RunReveal to deliver better security outcomes for our shared customers. As organizations continue to face evolving threats, the combination of identity security and SIEM capabilities becomes increasingly critical.

This partnership represents our commitment to ensuring that security teams have the comprehensive visibility they need to protect their organizations effectively. By breaking down the silos between identity and security data, we're enabling a new level of security intelligence.

Learn More

Ready to enhance your security visibility with Opal and RunReveal? Schedule a demo with our team. Or, if you’re looking to get started on how to use Opal and RunReveal together, check out Opal’s documentation and RunReveal’s documentation.

About Opal: Opal is the unified identity security platform that enables organizations to implement least privilege access at scale while maintaining operational efficiency.

About RunReveal: RunReveal is a modern observability platform built for security teams to query and investigate through security logs at scale, establishing itself as the definitive new player in the SIEM market.