CyberArkISP

Details

ID	`CyberArkISP`
Provider	CyberArk
Category	Identity and Access Management
From Version	8.11.0
Docker Image	`demisto/python3:3.12.13.10116658`
Supported Modules	Agentix XSIAM

README

Overview

The CyberArk Identity Security Platform is a unified solution securing all human and machine identities (workforce, customers, non-human) across hybrid/multi-cloud environments, centered on intelligent privilege controls, AI-driven threat detection (CORA AI), and lifecycle automation to enforce least privilege and Zero Trust, providing a single portal for access management, PAM, and endpoint security.

This integration collects audit events from CyberArk Identity Security Platform for security monitoring and compliance purposes in your Cortex environment.

Authentication

This integration uses OAuth2 Client Credentials flow combined with API key authentication for secure access to the CyberArk Identity Security Platform Audit API.

Before You Start

Before configuring the integration, you must complete the following prerequisites in your CyberArk Identity Administration:

Step 1: Create and Configure an OAuth2 Server Web App in Identity Administration

In Identity Administration, go to Apps & Widgets > Web Apps, and click Add Web Apps.
In the Add Web Apps dialog, click the Custom tab, locate the OAuth2 Server web app, and click Add.
Click Yes to add the web app.
In the Web Apps page, select the OAuth2 Server app that you just added.
In the OAuth2 Server page, configure the following:
- Settings tab: In the Application ID field, enter a name for this web app (e.g., xsiamapp). This will be your Web App ID.
- Tokens tab: In the Token Type field, select jwtRS256. Under Auth methods, ensure that the Client Creds authentication method is selected.
- Scope tab: Click Add, copy and paste the following text in the Name field, and then click Save:
```
isp.audit.events:read
```
- Advanced tab: Copy and paste the following script:
```
setClaim('tenant_id', TenantData.Get("CybrTenantID"));
setClaim('aud', 'cyberark.isp.audit');
```

Step 2: Create a Service User in Identity Administration

Go to Core Services > Users, and click Add User.
In the Create CyberArk Cloud Directory User page, enter the information in the required fields.
In the Status area, select is OAuth confidential client, and then click Create User.
In the Users page, select the All Service Users set, and then locate and select the user that you just created.
In the User details page, select the Application Settings tab and then click Add.
Locate and select the OAuth2 Server web app, and click Save.
Enter your user name, and click OK.

Note: The service username (without domain) will be your Client ID, and the service password will be your Client Secret.

Step 3: Set the Service User Permissions in Identity Administration

Go to Apps & Widgets > Web Apps, and select the OAuth2 Server web app that you added.
Select the Permissions tab, locate the service user that you created, and select the following permissions:
- Grant
- View
- Run
- Automatically Deploy
Click Save.

Step 4: Add a SIEM Integration in the Administration Space

Go to the Administration space.
Select My environment > Integrations > Export to SIEM.
Click Create, and select Create SIEM integration.
Enter a name for the SIEM integration and an optional description.
Click Apply. An API key is created.
Copy the API key and the API base URL for use in the integration configuration.

Important: You can only have two third-party SIEM integrations. If you want to add an integration, you must delete one of the existing integrations.

Integration Parameters

Parameter	Description	Required
Audit Server URL	The Audit API base URL from the SIEM integration (e.g., https://example-domain.audit.cyberark.cloud).	True
Identity URL	The CyberArk Identity FQDN for OAuth2 authentication (e.g., https://abc1234.id.cyberark.cloud).	True
Web App ID	The Application ID of the OAuth2 Server web app configured in Identity Administration.	True
API Key	The API key from the SIEM integration created in the Administration space.	True
Client ID	Service username without domain (configured as OAuth confidential client).	True
Client Secret	Service user password for OAuth2 authentication.	True
Trust any certificate (not secure)	When selected, the integration will not verify SSL certificates.	False
Use system proxy settings	When selected, the integration will use the system proxy settings.	False
Maximum number of audit events per fetch	Maximum number of events to fetch per cycle (default 10000, based on API paging definition).	False
Fetch Assets	When enabled, the integration periodically fetches CyberArk Cloud Directory snapshots (Users, Groups, Roles, Applications) selected in ‘Directory Data Collection’ below.	False
Directory Data Collection	Select which CyberArk Cloud Directory data sources to fetch as snapshots. Each selected source produces its own dataset (cyberark_users_raw, cyberark_groups_raw, cyberark_roles_raw, cyberark_applications_raw). Has no effect unless ‘Fetch Assets’ is enabled.	False
Maximum number of records per Redrock page	Maximum number of records to request per page from the Redrock API (default 10000). Snapshots are paginated automatically across multiple invocations within a fetch cycle when needed.	False

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberark-isp-get-events

Gets audit events from CyberArk Identity Security Platform. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and API request limitation exceeding.

Note: This command is not supported in XSOAR.

Base Command

cyberark-isp-get-events

Input

Argument Name	Description	Required
date_from	The start date/time to fetch events from (format: YYYY-MM-DD HH:MM:SS). Supports relative time (e.g., “3 days ago”, “2 hours ago”) or specific absolute dates (e.g., “2025-09-15 17:10:00”). Default is “1 minute ago”.	Optional
date_to	The end date/time to fetch events until (format: YYYY-MM-DD HH:MM:SS). Supports relative time (e.g., “1 hour ago”, “now”) or specific absolute dates (e.g., “2025-09-15 17:11:00”). If not specified, fetches until now.	Optional
limit	Maximum number of events to retrieve. Default is 50.	Optional
should_push_events	Set to true to push events to XSIAM (use with caution to avoid duplicates), false to only return them in the War Room. Default is false. Possible values are: true, false.	Optional

Context Output

Path	Type	Description
CyberArkISP.Event.uuid	String	Unique identifier of the audit event.
CyberArkISP.Event.tenantId	String	Tenant identifier.
CyberArkISP.Event.timestamp	Number	Event timestamp (Unix milliseconds).
CyberArkISP.Event.username	String	Username associated with the event.
CyberArkISP.Event.applicationCode	String	Application code (e.g., IDP).
CyberArkISP.Event.auditCode	String	Audit code identifier.
CyberArkISP.Event.auditType	String	Type of audit event (e.g., Info, Warning, Error).
CyberArkISP.Event.action	String	Action performed.
CyberArkISP.Event.userId	String	User ID associated with the event.
CyberArkISP.Event.source	String	Source IP address.
CyberArkISP.Event.actionType	String	Type of action (e.g., Start, End).
CyberArkISP.Event.component	String	Component name.
CyberArkISP.Event.serviceName	String	Service name.
CyberArkISP.Event.message	String	Event message.
CyberArkISP.Event.customData	Unknown	Custom event data.
CyberArkISP.Event.cloudProvider	String	Cloud provider (e.g., aws).
CyberArkISP.Event.identityType	String	Identity type (e.g., NON_HUMAN, HUMAN).
CyberArkISP.Event.originRegion	String	Origin region.

Command Example

!cyberark-isp-get-events date_from="3 days ago" limit=50

!cyberark-isp-get-events date_from="2025-09-15 17:10:00" date_to="2025-09-15 17:11:00" limit=100

!cyberark-isp-get-events date_from="1 hour ago" limit=10 should_push_events=false

Additional Resources

For more information about CyberArk Identity Security Platform integration, refer to the official CyberArk documentation:

cyberark-isp-get-users

Manually fetches CyberArk Cloud Directory user snapshots via the Redrock Query API. For developing/debugging only. Use with caution if ‘should_push_assets’ is set to true, as it may interfere with the scheduled fetch cycle’s snapshot sealing.

Base Command

cyberark-isp-get-users

Input

Argument Name	Description	Required
limit	Maximum number of user records to retrieve. Default is 50.	Optional
should_push_assets	Set to true to push the retrieved users to XSIAM as a snapshot in the cyberark_users_raw dataset. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
CyberArkISP.User.ID	String	Unique identifier of the CyberArk Cloud Directory user.
CyberArkISP.User.Username	String	Username (login name) of the user.
CyberArkISP.User.DisplayName	String	Display name of the user.
CyberArkISP.User.Email	String	Email address of the user.
CyberArkISP.User.LastLogin	Date	Timestamp of the user’s last login.

cyberark-isp-get-roles

Manually fetches CyberArk Cloud Directory role snapshots via the Redrock Query API. For developing/debugging only.

Base Command

cyberark-isp-get-roles

Input

Argument Name	Description	Required
limit	Maximum number of role records to retrieve. Default is 50.	Optional
should_push_assets	Set to true to push the retrieved roles to XSIAM as a snapshot in the cyberark_roles_raw dataset. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
CyberArkISP.Role.ID	String	Unique identifier of the role.
CyberArkISP.Role.Name	String	Name of the role.
CyberArkISP.Role.Description	String	Description of the role.

cyberark-isp-get-groups

Manually fetches CyberArk Cloud Directory group snapshots via the Redrock Query API. For developing/debugging only.

Base Command

cyberark-isp-get-groups

Input

Argument Name	Description	Required
limit	Maximum number of group records to retrieve. Default is 50.	Optional
should_push_assets	Set to true to push the retrieved groups to XSIAM as a snapshot in the cyberark_groups_raw dataset. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
CyberArkISP.Group.ID	String	Unique identifier of the group.
CyberArkISP.Group.Name	String	Name of the group.

cyberark-isp-get-applications

Manually fetches CyberArk Cloud Directory application snapshots via the Redrock Query API. For developing/debugging only.

Base Command

cyberark-isp-get-applications

Input

Argument Name	Description	Required
limit	Maximum number of application records to retrieve. Default is 50.	Optional
should_push_assets	Set to true to push the retrieved applications to XSIAM as a snapshot in the cyberark_applications_raw dataset. Possible values are: true, false. Default is false.	Optional

Context Output

Path	Type	Description
CyberArkISP.Application.ID	String	Unique identifier of the application.
CyberArkISP.Application.Name	String	Name of the application.
CyberArkISP.Application.AppType	String	Type of the application.

Configuration parameters

url — Audit Server URL (required)
identity_url — Identity URL (required)
web_app_id — Web App ID (required)
api_key — API Key (required)
client_id — Client ID (required)
credentials — Client Secret (Service User Password) (required)
insecure — Trust any certificate (not secure)
proxy — Use system proxy settings
max_fetch — Maximum number of audit events per fetch
isFetchAssets — Fetch Assets
directory_data_collection — Directory Data Collection
max_assets_per_source_per_page — Maximum number of records per Redrock page

Commands (5)

cyberark-isp-get-applications
Manually fetches CyberArk Cloud Directory application snapshots via the Redrock Query API. For developing/debugging only.
cyberark-isp-get-events
Gets audit events from CyberArk Identity Security Platform. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and API request limitation exceeding.
cyberark-isp-get-groups
Manually fetches CyberArk Cloud Directory group snapshots via the Redrock Query API. For developing/debugging only.
cyberark-isp-get-roles
Manually fetches CyberArk Cloud Directory role snapshots via the Redrock Query API. For developing/debugging only.
cyberark-isp-get-users
Manually fetches CyberArk Cloud Directory user snapshots via the Redrock Query API. For developing/debugging only. Use with caution if 'should_push_assets' is set to true, as it may interfere with the scheduled fetch cycle's snapshot sealing.

Source

CyberArkISP.py CyberArkISP_test.py CyberArkISP.yml CyberArkISP_description.md command_examples.txt

Download History Raw

commonfields:
  id: CyberArkISP
  version: -1
name: CyberArkISP
display: CyberArk Identity Security Platform
category: Identity and Access Management
provider: CyberArk
description: CyberArk Identity Security Platform secures human and machine identities across hybrid/multi-cloud environments with intelligent privilege controls, AI-driven threat detection, and Zero Trust enforcement.
sectionorder:
- Connect
- Collect
configuration:
- name: url
  display: Audit Server URL
  required: true
  type: 0
  section: Connect
  additionalinfo: The Audit API base URL from the SIEM integration (e.g., https://example-domain.audit.cyberark.cloud).
- name: identity_url
  display: Identity URL
  required: true
  type: 0
  section: Connect
  additionalinfo: The CyberArk Identity FQDN for OAuth2 authentication (e.g., https://abc1234.id.cyberark.cloud).
- name: web_app_id
  display: Web App ID
  required: true
  type: 0
  section: Connect
  additionalinfo: The Application ID of the OAuth2 Server web app configured in Identity Administration.
- name: api_key
  display: API Key
  required: true
  type: 14
  section: Connect
  additionalinfo: The API key from the SIEM integration created in the Administration space.
- name: client_id
  display: Client ID
  required: true
  type: 0
  section: Connect
  additionalinfo: Service username without domain (configured as OAuth confidential client).
- name: credentials
  display: Client Secret (Service User Password)
  displaypassword: Client Secret
  required: true
  type: 9
  section: Connect
  hiddenusername: true
  additionalinfo: Service user password for OAuth2 authentication.

- name: insecure
  display: Trust any certificate (not secure)
  required: false
  type: 8
  defaultvalue: "false"
  section: Connect
  advanced: true
  additionalinfo: When selected, the integration will not verify SSL certificates.
- name: proxy
  display: Use system proxy settings
  required: false
  defaultvalue: "false"
  type: 8
  section: Connect
  advanced: true
  additionalinfo: When selected, the integration will use the system proxy settings.
- name: max_fetch
  display: Maximum number of audit events per fetch
  required: false
  type: 0
  section: Collect
  advanced: true
  defaultvalue: "10000"
  additionalinfo: Maximum number of events to fetch per cycle (default 10000, based on API paging definition).
- name: isFetchAssets
  display: Fetch Assets
  required: false
  type: 8
  defaultvalue: "false"
  section: Collect
  additionalinfo: When enabled, the integration periodically fetches CyberArk Cloud Directory snapshots (Users, Groups, Roles, Applications) selected in 'Directory Data Collection' below.
- name: directory_data_collection
  display: Directory Data Collection
  required: false
  type: 16
  defaultvalue: "Users,Groups,Roles,Applications"
  options:
  - Users
  - Groups
  - Roles
  - Applications
  section: Collect
  additionalinfo: Select which CyberArk Cloud Directory data sources to fetch as snapshots. Each selected source produces its own dataset (cyberark_users_raw, cyberark_groups_raw, cyberark_roles_raw, cyberark_applications_raw). Has no effect unless 'Fetch Assets' is enabled.
- name: max_assets_per_source_per_page
  display: Maximum number of records per Redrock page
  required: false
  type: 0
  section: Collect
  advanced: true
  defaultvalue: "10000"
  additionalinfo: Maximum number of records to request per page from the Redrock API (default 10000). Snapshots are paginated automatically across multiple invocations within a fetch cycle when needed.
script:
  commands:
  - name: cyberark-isp-get-users
    description: |-
      Manually fetches CyberArk Cloud Directory user snapshots via the Redrock Query API. For developing/debugging only. Use with caution if 'should_push_assets' is set to true, as it may interfere with the scheduled fetch cycle's snapshot sealing.
    arguments:
    - name: limit
      description: >-
        Maximum number of user records to retrieve.
      defaultValue: "50"
    - name: should_push_assets
      description: >-
        Set to true to push the retrieved users to XSIAM as a snapshot in the cyberark_users_raw dataset.
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: CyberArkISP.User.ID
      description: Unique identifier of the CyberArk Cloud Directory user.
      type: String
    - contextPath: CyberArkISP.User.Username
      description: Username (login name) of the user.
      type: String
    - contextPath: CyberArkISP.User.DisplayName
      description: Display name of the user.
      type: String
    - contextPath: CyberArkISP.User.Email
      description: Email address of the user.
      type: String
    - contextPath: CyberArkISP.User.LastLogin
      description: Timestamp of the user's last login.
      type: Date
  - name: cyberark-isp-get-groups
    description: |-
      Manually fetches CyberArk Cloud Directory group snapshots via the Redrock Query API. For developing/debugging only.
    arguments:
    - name: limit
      description: Maximum number of group records to retrieve.
      defaultValue: "50"
    - name: should_push_assets
      description: Set to true to push the retrieved groups to XSIAM as a snapshot in the cyberark_groups_raw dataset.
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: CyberArkISP.Group.ID
      description: Unique identifier of the group.
      type: String
    - contextPath: CyberArkISP.Group.Name
      description: Name of the group.
      type: String
  - name: cyberark-isp-get-roles
    description: |-
      Manually fetches CyberArk Cloud Directory role snapshots via the Redrock Query API. For developing/debugging only.
    arguments:
    - name: limit
      description: Maximum number of role records to retrieve.
      defaultValue: "50"
    - name: should_push_assets
      description: Set to true to push the retrieved roles to XSIAM as a snapshot in the cyberark_roles_raw dataset.
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: CyberArkISP.Role.ID
      description: Unique identifier of the role.
      type: String
    - contextPath: CyberArkISP.Role.Name
      description: Name of the role.
      type: String
    - contextPath: CyberArkISP.Role.Description
      description: Description of the role.
      type: String
  - name: cyberark-isp-get-applications
    description: |-
      Manually fetches CyberArk Cloud Directory application snapshots via the Redrock Query API. For developing/debugging only.
    arguments:
    - name: limit
      description: Maximum number of application records to retrieve.
      defaultValue: "50"
    - name: should_push_assets
      description: Set to true to push the retrieved applications to XSIAM as a snapshot in the cyberark_applications_raw dataset.
      defaultValue: "false"
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
    outputs:
    - contextPath: CyberArkISP.Application.ID
      description: Unique identifier of the application.
      type: String
    - contextPath: CyberArkISP.Application.Name
      description: Name of the application.
      type: String
    - contextPath: CyberArkISP.Application.AppType
      description: Type of the application.
      type: String
  - name: cyberark-isp-get-events
    description: |-
      Gets audit events from CyberArk Identity Security Platform. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and API request limitation exceeding.
    deprecated: false
    arguments:
    - name: date_from
      description: >-
        The start date/time to fetch events from (format: YYYY-MM-DD HH:MM:SS).
        Supports relative time (e.g., "3 days ago", "2 hours ago")
        or specific absolute dates (e.g., "2025-09-15 17:10:00").
      defaultValue: "1 minute ago"
    - name: date_to
      description: >-
        The end date/time to fetch events until (format: YYYY-MM-DD HH:MM:SS).
        Supports relative time (e.g., "1 hour ago", "now")
        or specific absolute dates (e.g., "2025-09-15 17:11:00").
    - name: limit
      description: Maximum number of events to retrieve.
      defaultValue: "50"
    - name: should_push_events
      description: Set to true to push events to XSIAM (use with caution to avoid duplicates).
      defaultValue: 'false'
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    outputs:
    - contextPath: CyberArkISP.Event.uuid
      description: Unique identifier of the audit event.
      type: String
    - contextPath: CyberArkISP.Event.tenantId
      description: Tenant identifier.
      type: String
    - contextPath: CyberArkISP.Event.timestamp
      description: Event timestamp (Unix milliseconds).
      type: Number
    - contextPath: CyberArkISP.Event.username
      description: Username associated with the event.
      type: String
    - contextPath: CyberArkISP.Event.applicationCode
      description: Application code (e.g., IDP).
      type: String
    - contextPath: CyberArkISP.Event.auditCode
      description: Audit code identifier.
      type: String
    - contextPath: CyberArkISP.Event.auditType
      description: Type of audit event (e.g., Info, Warning, Error).
      type: String
    - contextPath: CyberArkISP.Event.action
      description: Action performed.
      type: String
    - contextPath: CyberArkISP.Event.userId
      description: User ID associated with the event.
      type: String
    - contextPath: CyberArkISP.Event.source
      description: Source IP address.
      type: String
    - contextPath: CyberArkISP.Event.actionType
      description: Type of action (e.g., Start, End).
      type: String
    - contextPath: CyberArkISP.Event.component
      description: Component name.
      type: String
    - contextPath: CyberArkISP.Event.serviceName
      description: Service name.
      type: String
    - contextPath: CyberArkISP.Event.message
      description: Event message.
      type: String
    - contextPath: CyberArkISP.Event.customData
      description: Custom event data.
      type: Unknown
    - contextPath: CyberArkISP.Event.cloudProvider
      description: Cloud provider (e.g., aws).
      type: String
    - contextPath: CyberArkISP.Event.identityType
      description: Identity type (e.g., NON_HUMAN, HUMAN).
      type: String
    - contextPath: CyberArkISP.Event.originRegion
      description: Origin region.
      type: String
  isfetchevents: true
  runonce: false
  script: ''
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
  isfetchassets: true
fromversion: 8.11.0
supportlevelheader: xsoar
marketplaces:
- marketplacev2
- platform
tests:
- No tests (auto formatted)

supportedModules:
- xsiam