Hi all, thanks so much for the work on Keycloak.

While working on security monitoring topics for Keycloak events, I stumbled across the following issues, mostly about missing display names of the user/group/role instead of just having the user/group id or about missing group/role names/ids is some events.

Do you think that it is feasible to extend/improve those events to cover this additional information in events? It makes correlation and analysis much faster instead of a required manual lookup for some of the information.

What I found so far:

• The user_id field found in each log, showing e.g., which admin doing the change, is visible, but not the username for that user_id. It would be helpful to have the username for correlation with other logs instead of the Keycloak id only.
• In some events, e.g., for GROUP_MEMBERSHIP events, the user name of the affected user is given, but the group name itself is not visible, only the group id. Analysts need to look up manually which group was assigned.
• In GROUP or USER events, the actual name of the user or group is missing within the event, e.g., in adding or deleting a group or user. Only the group id or user id of the affected user is found.
• The group assignment event is missing when using the add user dialogue and assigning a group within that dialogue directly. It's therefore not logged at all which groups were assigned to a user.
• Actual username missing in client or realm role assignment events (CLIENT_ROLE_MAPPING, REALM_ROLE_MAPPING), only user ID is given in create or delete activities.
• Realm or client role id and name is missing in realm_role_mapping or client_role_mapping events, just stating that a realm or client role was assigned but it's not visible which one was assigned. Manual lookup is required.
• Delete client role mapping from group produces a "realm role mapping" delete event instead of a "client_role_mapping" event.

Thanks a lot for considering some of those points for a future release.

Best
Andreas