CyberArkEPMSOCResponse

Use the CyberArk EPM integration to activate and deactivate CyberArk EPM risk plans for specific endpoints.

Endpoint · CyberArk Endpoint Privilege Manager

Details

IDCyberArkEPMSOCResponse
ProviderCyberArk
CategoryEndpoint
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix XSIAM EDR

README

Use the CyberArk EPM integration to activate and deactivate CyberArk EPM risk plans for specific endpoints.
This integration was integrated and tested with the CyberArk EPM API.

Configure CyberArk EPM SOC Response in Cortex

Parameter Description Required
EPM Region-based tenant URL The tenant URL for EPM region (e.g., https://api-na.epm.cyberark.cloud). True
Identity URL The CyberArk Identity FQDN for OAuth2 authentication (e.g., https://abc1234.id.cyberark.cloud). True
Web App ID The Application ID of the OAuth2 Server web app configured in Identity Administration. True
Client ID Service username (configured as OAuth confidential client). True
Client Secret Service user password for OAuth2 authentication. True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberarkepm-activate-risk-plan

Activates a CyberArk EPM risk plan for a specified endpoint.

Base Command

cyberarkepm-activate-risk-plan

Input

Argument Name Description Required
risk_plan The name of the risk plan to activate. Required
endpoint_name The name of the endpoint to target. Required
logged_in_user The logged-in username of the endpoint. Optional
external_ip (Deprecated) The external IP address of the endpoint. This argument is deprecated and no longer used. Optional

Context Output

Path Type Description
CyberArkEPMSOCResponse.SetID String The ID of the EPM set in which the endpoints were found.
CyberArkEPMSOCResponse.EndpointIDs String The IDs of the endpoints added to the risk plan.
CyberArkEPMSOCResponse.RiskPlan String The name of activated risk plan.
CyberArkEPMSOCResponse.Action String The action performed on the risk plan (add/remove).
CyberArkEPMSOCResponse.GroupActionPerformed Boolean Whether the endpoint was successfully added to the risk plan group in this set.

cyberarkepm-deactivate-risk-plan

Deactivates a CyberArk EPM risk plan for a specified endpoint.

Base Command

cyberarkepm-deactivate-risk-plan

Input

Argument Name Description Required
risk_plan The name of the risk plan to deactivate. Required
endpoint_name The name of the endpoint to target. Required
logged_in_user The logged-in username of the endpoint. Optional
external_ip (Deprecated) The external IP address of the endpoint. This argument is deprecated and no longer used. Optional

Context Output

Path Type Description
CyberArkEPMSOCResponse.SetID String The ID of the EPM set in which the endpoints were found.
CyberArkEPMSOCResponse.EndpointIDs String The IDs of the endpoints removed from the risk plan.
CyberArkEPMSOCResponse.RiskPlan String The name of the deactivated risk plan.
CyberArkEPMSOCResponse.Action String The action performed on the risk plan (add/remove).
CyberArkEPMSOCResponse.GroupActionPerformed Boolean Whether the endpoint was successfully removed from the risk plan group in this set.

Configuration parameters

  • url — EPM Region-based tenant URL (required)
  • identity_url — Identity URL (required)
  • web_app_id — Web App ID (required)
  • client_id — Client ID (required)
  • credentials — Client Secret (Service User Password) (required)
  • application_id — Application ID

Commands (2)

  • cyberarkepm-activate-risk-plan

    Activates a CyberArk EPM risk plan for a specified endpoint.

  • cyberarkepm-deactivate-risk-plan

    Deactivates a CyberArk EPM risk plan for a specified endpoint.

Source

CyberArkEPMSOCResponse.py CyberArkEPMSOCResponse_test.py CyberArkEPMSOCResponse.yml CyberArkEPMSOCResponse_description.md command_examples.txt
Download History Raw 
## CyberArk EPM

### Authentication
To authenticate to EPM with OAuth2, provide the following:

- tenant_url: The tenant URL for EPM region (e.g., https://api-na.epm.cyberark.cloud)
- token_url: The CyberArk Identity FQDN for OAuth2 authentication (e.g., https://abc1234.id.cyberark.cloud)
- web_app_id: The Application ID of the OAuth2 Server web app configured in Identity Administration.
- client_id: Service username (configured as OAuth confidential client).
- client_secret: Service user password for OAuth2 authentication.

### Endpoint Information

To specify an endpoint, use the following command arguments: 
- `endpoint_name`
- `endpoint_external_ip`
- In addition, provide a pre-defined risk plan (for example, `Medium_Risk_Plan`).