SurePassID Compliance Manager Datasheet: HIPAA and CMMC 2.0

SurePassID Authentication Server

Multiple Event Sources

Last Updated: July 2025

The compliance system supports ingesting authentication events from multiple sources simultaneously. When multiple sources are enabled, events are fetched in parallel and merged chronologically using AggregateEventSource.

Configuration

Enable multiple sources in the EventSources section of appsettings.json:

{
  "EventSources": {
    "SurePassID": { "Enabled": true },
    "WindowsEventLog": { "Enabled": true },
    "JsonFile": {
      "Enabled": false,
      "DirectoryPath": "./Events",
      "FilePattern": "*.json"
    },
    "Syslog": { "Enabled": false }
  }
}

Each source has its own top-level configuration section for detailed settings.

Available Sources

Common Multi-Source Combinations

SurePassID + Windows Event Log (Recommended for AD environments)

Correlates MFA events from SurePassID with AD logon events from the Security log:

{
  "EventSources": {
    "SurePassID": { "Enabled": true },
    "WindowsEventLog": { "Enabled": true }
  },
  "SurePassID": {
    "Endpoint": "https://mfa.company.com/api/mfa/v1",
    "ApiKeyId": "compliance-api",
    "ApiKey": "your-api-key",
    "IgnoreSyncStatus": true,
    "PreferJsonBulkFormat": true
  },
  "WindowsEventLog": {
    "LogName": "Security",
    "ComputerNames": ["dc01.company.com"],
    "IncludeSuccessfulLogons": true,
    "IncludeFailedLogons": true,
    "ExcludeMachineAccounts": true,
    "ExcludeSystemAccounts": true,
    "MaxEventsPerQuery": 10000
  },
  "ActiveDirectory": {
    "Server": "dc01.company.com",
    "BaseDn": "DC=company,DC=com",
    "UseIntegratedAuth": true
  }
}

SurePassID + JSON File Import

Supplement real-time MFA data with historical SIEM exports:

{
  "EventSources": {
    "SurePassID": { "Enabled": true },
    "JsonFile": {
      "Enabled": true,
      "DirectoryPath": "C:\\Logs\\SiemExports",
      "FilePattern": "*.json"
    }
  }
}

How It Works

1. Registration: At startup, the CLI, service, or MCP server registers an IAuthEventSource for each enabled source.
2. Aggregation: When more than one source is registered, an AggregateEventSource wraps them.
3. Parallel Fetch: AggregateEventSource.FetchAsync() calls each source concurrently.
4. Merge: Results are combined into a single list sorted by event timestamp (UTC-normalized).
5. Fault Tolerance: If one source fails, the others still return their events. Failures are logged as warnings.
6. MFA Coverage: When both Windows Event Log and SurePassID sources are active, the MFA coverage correlator matches Windows SFA logons to SurePassID MFA events. Configure via the MfaCoverage section.

Legacy Compatibility

The older single-source EventSource:Type configuration is still supported:

{
  "EventSource": {
    "Type": "SurePassIdRestApi"
  }
}

When both EventSources and EventSource sections are present, the multi-source EventSources section takes priority and EventSource is ignored.

Migration: Replace EventSource:Type with the corresponding entry in EventSources:

Environment Variable Overrides

export EventSources__SurePassID__Enabled="true"
export EventSources__WindowsEventLog__Enabled="true"
export EventSources__JsonFile__Enabled="false"

Troubleshooting