CyberArk Identity Event Collector

This integration collects events from the Idaptive Next-Gen Access (INGA) using REST APIs.

Analytics & SIEM · CyberArk Identity

Details

IDCyberArk Identity Event Collector
ProviderCyberArk
CategoryAnalytics & SIEM
From Version6.8.0
Docker Imagedemisto/py3-tools:1.0.0.10120494
Supported ModulesAgentix XSIAM

README

CyberArk Identity log event collector integration for Cortex XSIAM.
This integration was integrated and tested with version 22.4 of CyberArk Identity Event Collector.

Configure CyberArk Identity Event Collector in Cortex

Parameter Description Required
Server URL The CyberArk Identity URL to get the logs from. For example, https://{{tenant}}.my.idaptive.app. True
App ID The application ID to fetch the logs from. True
User name The user that was created in CyberArk for the XSIAM integration. For example, admin@example.com. True
Password The password for the user that was created in CyberArk for the XSIAM integration. True
First fetch time The period to retrieve events for.
Format: <number> <time unit>, for example 12 hours, 1 day, 3 months.
Default is 3 days.		 True
Maximum number of events per fetch The maximum number of items to retrieve per request from CyberArk’s API. True
Trust any certificate (not secure) When selected, certificates are not checked. False
Use system proxy settings Runs the integration instance using the proxy server (HTTP or HTTPS) that you defined in the server configuration. False

Commands

You can execute these commands from the Cortex XSIAM Alerts War Room as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

cyberarkidentity-get-events

Returns a list of events

Base Command

cyberarkidentity-get-events

Input

Argument Name Description Required
should_push_events Set this argument to True to create events, otherwise events will only be displayed. Default is False. Required
limit The maximum number of events per fetch. Default is 1000. Optional
from The first fetch time (<number> <time unit>, for example 12 hours, 1 day, 3 months). Default is 3 days. Optional

Context Output

There is no context output for this command.

Command example

!cyberarkidentity-get-events should_push_events=false limit=10 from="3 days"

Human Readable Output

CyberArkIdentity RedRock records

Auth Method Directory Service Uuid From IP Address ID Level Normalized User Request Device OS Request Host Name Request Is Mobile Device Tenant User Guid When Logged When Occurred _ Table Name
None 123456abcdef.123456.abcdef 1.1.1.1 123456abcdef.123456.abcdef Info admin@example.com.11 Unknown 1.1.1.1 false AAM4730 123456abcdef.123456.abcdef /Date(1652376432605)/ /Date(1652376432605)/ events
None 123456abcdef.123456.abcdef 1.1.1.1 123456abcdef.123456.abcdeg Info admin@example.com.11 Unknown 1.1.1.1 false AAM4730 123456abcdef.123456.abcdef /Date(1652376492682)/ /Date(1652376492682)/ events
None 123456abcdef.123456.abcdef 1.1.1.1 123456abcdef.123456.abcdeh Info admin@example.com.11 Unknown 1.1.1.1 false AAM4730 123456abcdef.123456.abcdef /Date(1652376552546)/ /Date(1652376552546)/ events

Configuration parameters

  • url — Server URL (required)
  • app_id — App ID (required)
  • credentials — User name (required)
  • from — First fetch time (required)
  • limit — Maximum number of events per fetch (required)
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings

Commands (1)

  • cyberarkidentity-get-events

    Returns a list of events

Source

CyberArkIdentityEventCollector.py CyberArkIdentityEventCollector_test.py CyberArkIdentityEventCollector.yml CyberArkIdentityEventCollector_description.md command_examples.txt
Download History Raw 
category: Analytics & SIEM
provider: CyberArk
sectionorder:
- Connect
- Collect
commonfields:
  id: CyberArk Identity Event Collector
  version: -1
configuration:
- defaultvalue: https://<tenant>.my.idaptive.app
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- defaultvalue: oauthsiem
  display: App ID
  name: app_id
  required: true
  type: 0
  section: Collect
- display: User name
  additionalinfo: The user name (admin@example.com) and password.
  name: credentials
  required: true
  type: 9
  section: Connect
- display: First fetch time
  name: from
  type: 0
  defaultvalue: 3 days
  required: true
  section: Collect
- display: Maximum number of events per fetch
  name: limit
  type: 0
  defaultvalue: 1000
  required: true
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
description: This integration collects events from the Idaptive Next-Gen Access (INGA) using REST APIs.
display: CyberArk Identity Event Collector
name: CyberArk Identity Event Collector
script:
  commands:
  - description: 'Returns a list of events'
    name: cyberarkidentity-get-events
    arguments:
    - description: The maximum number of events per fetch. Default is 1000.
      defaultValue: 1000
      isArray: true
      name: limit
    - description: Set this argument to True to create events, otherwise events will only be displayed.
      auto: PREDEFINED
      defaultValue: 'False'
      name: should_push_events
      predefined:
      - 'True'
      - 'False'
      required: true
    - description: First fetch time (<number> <time unit>, for example 12 hours, 1 day, 3 months). Default is 3 days.
      isArray: true
      name: from
  runonce: false
  script: '-'
  isfetchevents: true
  type: python
  subtype: python3
  dockerimage: demisto/py3-tools:1.0.0.10120494
marketplaces:
- marketplacev2
- platform
fromversion: 6.8.0
tests:
- No tests (auto formatted)
supportedModules:
- xsiam