There are user events that you can enable in Keycloak, check https://www.keycloak.org/docs/latest/server_admin/index.html#event-listener

You could forward the events that are logged with fluentd and forward them to your backend of choice. Ideally you could make use of some SIEM tools or build your own alerting rules around pattern detection.