CyberArkIdentityEventCollector

Modeling Rule

CyberArk Identity

Details

IDCyberArkIdentityEventCollector
From Version6.10.0

Rules (XIF)

[MODEL: dataset=cyberark_identity_raw]
filter
    EventType in ("Cloud.Core.OAuthToken.Create", "Cloud.Core.Logout", "Cloud.Core.MfaSummary", "Cloud.Core.StartImpersonate","Cloud.Core.Login", "Cloud.Core.LoginFail", "Cloud.Core.Logout", "Cloud.Core.OAuthToken.InvalidClient" )
| alter
    xdm.target.user.identifier = ImpersonateTargetUuid,
    xdm.target.user.username = coalesce(NormalizedUser,UserName,ImpersonateTargetName),
    xdm.session_context_id = Session,
    xdm.event.outcome = MfaResult,
    xdm.event.outcome_reason = MfaReason,
    xdm.target.application.name = coalesce(ProfileName, ApplicationName, AppName),
	xdm.auth.auth_method = AuthMethod,
    xdm.event.type=EventType,
    xdm.source.ipv4 = FromIPAddress,
    xdm.source.application.name = AppId;
    
filter  EventType not in ("Cloud.Core.OAuthToken.Create", "Cloud.Core.Logout", "Cloud.Core.MfaSummary", "Cloud.Core.StartImpersonate","Cloud.Core.Login", "Cloud.Core.LoginFail", "Cloud.Core.Logout", "Cloud.Core.OAuthToken.InvalidClient" )
 |   alter
    xdm.target.resource.name = coalesce(ObjectName, Role, Alias, ProfileName, TargetUser, DSName, ImpersonateTargetName, Cname, AffectedTenant, OU, DeviceName, ApplicationName, AppName, EntityName),
    xdm.target.resource.type = coalesce(ObjectType, Type, DSType, LicenseType, NewLicenseType, ApplicationType, EntityType),
    xdm.target.resource.id = coalesce( if(EventType NOT IN ("Cloud.AfwEnterprise.Enroll", "Cloud.AfwEnterprise.Unenroll", "Cloud.Core.EmmTenantMigrated", "Cloud.Saas.Application.AppPublish", "Cloud.Saas.Application.AppUnpublish"), RoleId), Id, TargetUserID, Uuid, Key, DSUuid, ImpersonateTargetUuid, ProxyId, ConnectorUuid, DeviceID, ApplicationID, AppId, EntityUuid),
    xdm.source.user.username =coalesce(Changer, EmailAddress, UserName),
    xdm.source.user.identifier =coalesce(ChangerUuid,EntityName, UserGuid),
    xdm.source.ipv4 = FromIPAddress,
    xdm.event.outcome = coalesce(Result, SyncResult, MfaResult),
    xdm.event.outcome_reason = coalesce(Exception, FailedMessage, FailureReason, DeleteReason, SyncActionReason),
    xdm.target.resource.value = coalesce(ReplaceDomain, Thumbprint, Value, UserState, SetPath, NewState, To, NewEntity),
    xdm.target.resource_before.value =coalesce(PreviousUserState, OldState, From, OldEntity),
    xdm.event.description = coalesce(Exception, Description),
    xdm.target.user.username =coalesce(EntityName, ProfileName,ApplicationName, MachineName, ClientAddress, HostAddress, UserName, `Target`, EnrollProfileUser, NormalizedUser),
    xdm.target.user.identifier = coalesce(UserGuid, LocalAccountUuid),
    xdm.target.resource_before.type = OldLicenseType,
    xdm.target.resource.sub_type = MobileAppType,
    xdm.session_context_id = coalesce(JobUniqueId, SessionId),
	xdm.event.type=EventType;

Schema

cyberark_identity_raw

Field Type Array?
AffectedTenant string —
Alias string —
AppId string —
AppName string —
ApplicationID string —
ApplicationName string —
ApplicationType string —
AuthMethod string —
Changer string —
ChangerUuid string —
ClientAddress string —
Cname string —
ConnectorUuid string —
DSName string —
DSType string —
DSUuid string —
DeleteReason string —
Description string —
DeviceID string —
DeviceName string —
DirectoryServicePartnerName string —
DirectoryServiceUuid string —
EmailAddress string —
EnrollProfileUser string —
EntityName string —
EntityType string —
EntityUuid string —
EventType string —
Exception string —
FailedMessage string —
FailureReason string —
From string —
FromIPAddress string —
HostAddress string —
ID string —
ImpersonateTargetName string —
ImpersonateTargetUuid string —
ImpersonatorUuid string —
JobUniqueId string —
Key string —
Level string —
LicenseType string —
LocalAccountUuid string —
MachineName string —
MfaReason string —
MfaResult string —
MobileAppType string —
NewEntity string —
NewLicenseType string —
NewState string —
NormalizedUser string —
OU string —
ObjectName string —
ObjectType string —
OldEntity string —
OldLicenseType string —
OldState string —
PreviousUserState string —
ProfileName string —
ProxyId string —
ReplaceDomain string —
RequestDeviceOS string —
RequestHostName string —
RequestIsMobileDevice string —
Result string —
Role string —
RoleId string —
Session string —
SessionId string —
SetPath string —
SyncAction string —
SyncActionReason string —
SyncResult string —
Target string —
TargetUser string —
TargetUserID string —
Tenant string —
Thumbprint string —
To string —
Type string —
UserGuid string —
UserName string —
UserState string —
Uuid string —
Value string —
WhenLogged string —
WhenOccurred string —
_TableName string —
_product string —
_vendor string —
Raw JSON 
{
  "cyberark_identity_raw": {
    "ID": {
      "type": "string",
      "is_array": false
    },
    "_vendor": {
      "type": "string",
      "is_array": false
    },
    "_product": {
      "type": "string",
      "is_array": false
    },
    "UserName": {
      "type": "string",
      "is_array": false
    },
    "EnrollProfileUser": {
      "type": "string",
      "is_array": false
    },
    "Changer": {
      "type": "string",
      "is_array": false
    },
    "LicenseType": {
      "type": "string",
      "is_array": false
    },
    "ImpersonateTargetUuid": {
      "type": "string",
      "is_array": false
    },
    "RoleId": {
      "type": "string",
      "is_array": false
    },
    "SetPath": {
      "type": "string",
      "is_array": false
    },
    "JobUniqueId": {
      "type": "string",
      "is_array": false
    },
    "ProfileName": {
      "type": "string",
      "is_array": false
    },
    "Target": {
      "type": "string",
      "is_array": false
    },
    "Role": {
      "type": "string",
      "is_array": false
    },
    "TargetUser": {
      "type": "string",
      "is_array": false
    },
    "MfaResult": {
      "type": "string",
      "is_array": false
    },
    "Value": {
      "type": "string",
      "is_array": false
    },
    "NewEntity": {
      "type": "string",
      "is_array": false
    },
    "_TableName": {
      "type": "string",
      "is_array": false
    },
    "Type": {
      "type": "string",
      "is_array": false
    },
    "HostAddress": {
      "type": "string",
      "is_array": false
    },
    "Result": {
      "type": "string",
      "is_array": false
    },
    "EntityUuid": {
      "type": "string",
      "is_array": false
    },
    "DSName": {
      "type": "string",
      "is_array": false
    },
    "LocalAccountUuid": {
      "type": "string",
      "is_array": false
    },
    "OldState": {
      "type": "string",
      "is_array": false
    },
    "DeleteReason": {
      "type": "string",
      "is_array": false
    },
    "WhenLogged": {
      "type": "string",
      "is_array": false
    },
    "AuthMethod": {
      "type": "string",
      "is_array": false
    },
    "SyncAction": {
      "type": "string",
      "is_array": false
    },
    "Cname": {
      "type": "string",
      "is_array": false
    },
    "From": {
      "type": "string",
      "is_array": false
    },
    "ProxyId": {
      "type": "string",
      "is_array": false
    },
    "ApplicationID": {
      "type": "string",
      "is_array": false
    },
    "Level": {
      "type": "string",
      "is_array": false
    },
    "DSUuid": {
      "type": "string",
      "is_array": false
    },
    "ImpersonateTargetName": {
      "type": "string",
      "is_array": false
    },
    "ObjectType": {
      "type": "string",
      "is_array": false
    },
    "MachineName": {
      "type": "string",
      "is_array": false
    },
    "Tenant": {
      "type": "string",
      "is_array": false
    },
    "MobileAppType": {
      "type": "string",
      "is_array": false
    },
    "OldEntity": {
      "type": "string",
      "is_array": false
    },
    "RequestIsMobileDevice": {
      "type": "string",
      "is_array": false
    },
    "NewState": {
      "type": "string",
      "is_array": false
    },
    "EntityName": {
      "type": "string",
      "is_array": false
    },
    "NormalizedUser": {
      "type": "string",
      "is_array": false
    },
    "FailedMessage": {
      "type": "string",
      "is_array": false
    },
    "RequestHostName": {
      "type": "string",
      "is_array": false
    },
    "ApplicationName": {
      "type": "string",
      "is_array": false
    },
    "ObjectName": {
      "type": "string",
      "is_array": false
    },
    "ClientAddress": {
      "type": "string",
      "is_array": false
    },
    "Key": {
      "type": "string",
      "is_array": false
    },
    "Description": {
      "type": "string",
      "is_array": false
    },
    "OU": {
      "type": "string",
      "is_array": false
    },
    "Alias": {
      "type": "string",
      "is_array": false
    },
    "ApplicationType": {
      "type": "string",
      "is_array": false
    },
    "DirectoryServiceUuid": {
      "type": "string",
      "is_array": false
    },
    "UserState": {
      "type": "string",
      "is_array": false
    },
    "UserGuid": {
      "type": "string",
      "is_array": false
    },
    "Thumbprint": {
      "type": "string",
      "is_array": false
    },
    "DirectoryServicePartnerName": {
      "type": "string",
      "is_array": false
    },
    "AppId": {
      "type": "string",
      "is_array": false
    },
    "OldLicenseType": {
      "type": "string",
      "is_array": false
    },
    "WhenOccurred": {
      "type": "string",
      "is_array": false
    },
    "To": {
      "type": "string",
      "is_array": false
    },
    "NewLicenseType": {
      "type": "string",
      "is_array": false
    },
    "ReplaceDomain": {
      "type": "string",
      "is_array": false
    },
    "ImpersonatorUuid": {
      "type": "string",
      "is_array": false
    },
    "DeviceID": {
      "type": "string",
      "is_array": false
    },
    "DSType": {
      "type": "string",
      "is_array": false
    },
    "ConnectorUuid": {
      "type": "string",
      "is_array": false
    },
    "MfaReason": {
      "type": "string",
      "is_array": false
    },
    "EntityType": {
      "type": "string",
      "is_array": false
    },
    "FromIPAddress": {
      "type": "string",
      "is_array": false
    },
    "TargetUserID": {
      "type": "string",
      "is_array": false
    },
    "EventType": {
      "type": "string",
      "is_array": false
    },
    "Session": {
      "type": "string",
      "is_array": false
    },
    "FailureReason": {
      "type": "string",
      "is_array": false
    },
    "RequestDeviceOS": {
      "type": "string",
      "is_array": false
    },
    "Uuid": {
      "type": "string",
      "is_array": false
    },
    "AffectedTenant": {
      "type": "string",
      "is_array": false
    },
    "ChangerUuid": {
      "type": "string",
      "is_array": false
    },
    "PreviousUserState": {
      "type": "string",
      "is_array": false
    },
    "Exception": {
      "type": "string",
      "is_array": false
    },
    "SyncResult": {
      "type": "string",
      "is_array": false
    },
    "DeviceName": {
      "type": "string",
      "is_array": false
    },
    "AppName": {
      "type": "string",
      "is_array": false
    },
    "EmailAddress": {
      "type": "string",
      "is_array": false
    },
    "SyncActionReason": {
      "type": "string",
      "is_array": false
    },
    "SessionId": {
      "type": "string",
      "is_array": false
    }
  }
}