CyberArkEPMEventCollector

Collects policy audits, admin audits, and detailed (raw) events from CyberArk Endpoint Privilege Manager (EPM).

Category

Analytics & SIEM

Pack

CyberArkEPM

Configuration parameters

• authentication_method — Authentication Method (required)
• server_url — Server URL (only for Idira Oauth)
• url — SAML/EPM Logon URL
• identity_url — Identity URL
• web_app_id — Web App ID
• credentials — Username (required)
• set_name — Set name (required)
• application_id — Application ID
• authentication_url — Authentication URL
• application_url — Application URL
• insecure — Trust any certificate (not secure)
• proxy — Use system proxy settings
• max_fetch — Maximum number of events per fetch
• enable_admin_audits — Enable admin audits events
• policy_audits_event_type — Policy Audit Events
• raw_events_event_type — Detailed Events
• isFetchEvents — Fetch events
• eventFetchInterval — Events Fetch Interval

Commands (3)

• cyberarkepm-get-admin-audits — Gets admin audits from Cyber Ark EPM.
• cyberarkepm-get-events — Gets events from Cyber Ark EPM. Use this command for development and debugging only, as it may produce duplicate events, exceed API rate limits, or disrupt the fetch mechanism.
• cyberarkepm-get-policy-audits — Gets policy audits from Cyber Ark EPM.