commonfields: id: CyberArkISP version: -1 name: CyberArkISP display: CyberArk Identity Security Platform category: Identity and Access Management provider: CyberArk description: CyberArk Identity Security Platform secures human and machine identities across hybrid/multi-cloud environments with intelligent privilege controls, AI-driven threat detection, and Zero Trust enforcement. sectionorder: - Connect - Collect configuration: - name: url display: Audit Server URL required: true type: 0 section: Connect additionalinfo: The Audit API base URL from the SIEM integration (e.g., https://example-domain.audit.cyberark.cloud). - name: identity_url display: Identity URL required: true type: 0 section: Connect additionalinfo: The CyberArk Identity FQDN for OAuth2 authentication (e.g., https://abc1234.id.cyberark.cloud). - name: web_app_id display: Web App ID required: true type: 0 section: Connect additionalinfo: The Application ID of the OAuth2 Server web app configured in Identity Administration. - name: api_key display: API Key required: true type: 14 section: Connect additionalinfo: The API key from the SIEM integration created in the Administration space. - name: client_id display: Client ID required: true type: 0 section: Connect additionalinfo: Service username without domain (configured as OAuth confidential client). - name: credentials display: Client Secret (Service User Password) displaypassword: Client Secret required: true type: 9 section: Connect hiddenusername: true additionalinfo: Service user password for OAuth2 authentication. - name: insecure display: Trust any certificate (not secure) required: false type: 8 defaultvalue: "false" section: Connect advanced: true additionalinfo: When selected, the integration will not verify SSL certificates. - name: proxy display: Use system proxy settings required: false defaultvalue: "false" type: 8 section: Connect advanced: true additionalinfo: When selected, the integration will use the system proxy settings. - name: max_fetch display: Maximum number of audit events per fetch required: false type: 0 section: Collect advanced: true defaultvalue: "10000" additionalinfo: Maximum number of events to fetch per cycle (default 10000, based on API paging definition). - name: isFetchAssets display: Fetch Assets required: false type: 8 defaultvalue: "false" section: Collect additionalinfo: When enabled, the integration periodically fetches CyberArk Cloud Directory snapshots (Users, Groups, Roles, Applications) selected in 'Directory Data Collection' below. - name: directory_data_collection display: Directory Data Collection required: false type: 16 defaultvalue: "Users,Groups,Roles,Applications" options: - Users - Groups - Roles - Applications section: Collect additionalinfo: Select which CyberArk Cloud Directory data sources to fetch as snapshots. Each selected source produces its own dataset (cyberark_users_raw, cyberark_groups_raw, cyberark_roles_raw, cyberark_applications_raw). Has no effect unless 'Fetch Assets' is enabled. - name: max_assets_per_source_per_page display: Maximum number of records per Redrock page required: false type: 0 section: Collect advanced: true defaultvalue: "10000" additionalinfo: Maximum number of records to request per page from the Redrock API (default 10000). Snapshots are paginated automatically across multiple invocations within a fetch cycle when needed. script: commands: - name: cyberark-isp-get-users description: |- Manually fetches CyberArk Cloud Directory user snapshots via the Redrock Query API. For developing/debugging only. Use with caution if 'should_push_assets' is set to true, as it may interfere with the scheduled fetch cycle's snapshot sealing. arguments: - name: limit description: >- Maximum number of user records to retrieve. defaultValue: "50" - name: should_push_assets description: >- Set to true to push the retrieved users to XSIAM as a snapshot in the cyberark_users_raw dataset. defaultValue: "false" auto: PREDEFINED predefined: - "true" - "false" outputs: - contextPath: CyberArkISP.User.ID description: Unique identifier of the CyberArk Cloud Directory user. type: String - contextPath: CyberArkISP.User.Username description: Username (login name) of the user. type: String - contextPath: CyberArkISP.User.DisplayName description: Display name of the user. type: String - contextPath: CyberArkISP.User.Email description: Email address of the user. type: String - contextPath: CyberArkISP.User.LastLogin description: Timestamp of the user's last login. type: Date - name: cyberark-isp-get-groups description: |- Manually fetches CyberArk Cloud Directory group snapshots via the Redrock Query API. For developing/debugging only. arguments: - name: limit description: Maximum number of group records to retrieve. defaultValue: "50" - name: should_push_assets description: Set to true to push the retrieved groups to XSIAM as a snapshot in the cyberark_groups_raw dataset. defaultValue: "false" auto: PREDEFINED predefined: - "true" - "false" outputs: - contextPath: CyberArkISP.Group.ID description: Unique identifier of the group. type: String - contextPath: CyberArkISP.Group.Name description: Name of the group. type: String - name: cyberark-isp-get-roles description: |- Manually fetches CyberArk Cloud Directory role snapshots via the Redrock Query API. For developing/debugging only. arguments: - name: limit description: Maximum number of role records to retrieve. defaultValue: "50" - name: should_push_assets description: Set to true to push the retrieved roles to XSIAM as a snapshot in the cyberark_roles_raw dataset. defaultValue: "false" auto: PREDEFINED predefined: - "true" - "false" outputs: - contextPath: CyberArkISP.Role.ID description: Unique identifier of the role. type: String - contextPath: CyberArkISP.Role.Name description: Name of the role. type: String - contextPath: CyberArkISP.Role.Description description: Description of the role. type: String - name: cyberark-isp-get-applications description: |- Manually fetches CyberArk Cloud Directory application snapshots via the Redrock Query API. For developing/debugging only. arguments: - name: limit description: Maximum number of application records to retrieve. defaultValue: "50" - name: should_push_assets description: Set to true to push the retrieved applications to XSIAM as a snapshot in the cyberark_applications_raw dataset. defaultValue: "false" auto: PREDEFINED predefined: - "true" - "false" outputs: - contextPath: CyberArkISP.Application.ID description: Unique identifier of the application. type: String - contextPath: CyberArkISP.Application.Name description: Name of the application. type: String - contextPath: CyberArkISP.Application.AppType description: Type of the application. type: String - name: cyberark-isp-get-events description: |- Gets audit events from CyberArk Identity Security Platform. This command is used for developing/debugging and is to be used with caution, as it can create events, leading to events duplication and API request limitation exceeding. deprecated: false arguments: - name: date_from description: >- The start date/time to fetch events from (format: YYYY-MM-DD HH:MM:SS). Supports relative time (e.g., "3 days ago", "2 hours ago") or specific absolute dates (e.g., "2025-09-15 17:10:00"). defaultValue: "1 minute ago" - name: date_to description: >- The end date/time to fetch events until (format: YYYY-MM-DD HH:MM:SS). Supports relative time (e.g., "1 hour ago", "now") or specific absolute dates (e.g., "2025-09-15 17:11:00"). - name: limit description: Maximum number of events to retrieve. defaultValue: "50" - name: should_push_events description: Set to true to push events to XSIAM (use with caution to avoid duplicates). defaultValue: 'false' auto: PREDEFINED predefined: - 'true' - 'false' outputs: - contextPath: CyberArkISP.Event.uuid description: Unique identifier of the audit event. type: String - contextPath: CyberArkISP.Event.tenantId description: Tenant identifier. type: String - contextPath: CyberArkISP.Event.timestamp description: Event timestamp (Unix milliseconds). type: Number - contextPath: CyberArkISP.Event.username description: Username associated with the event. type: String - contextPath: CyberArkISP.Event.applicationCode description: Application code (e.g., IDP). type: String - contextPath: CyberArkISP.Event.auditCode description: Audit code identifier. type: String - contextPath: CyberArkISP.Event.auditType description: Type of audit event (e.g., Info, Warning, Error). type: String - contextPath: CyberArkISP.Event.action description: Action performed. type: String - contextPath: CyberArkISP.Event.userId description: User ID associated with the event. type: String - contextPath: CyberArkISP.Event.source description: Source IP address. type: String - contextPath: CyberArkISP.Event.actionType description: Type of action (e.g., Start, End). type: String - contextPath: CyberArkISP.Event.component description: Component name. type: String - contextPath: CyberArkISP.Event.serviceName description: Service name. type: String - contextPath: CyberArkISP.Event.message description: Event message. type: String - contextPath: CyberArkISP.Event.customData description: Custom event data. type: Unknown - contextPath: CyberArkISP.Event.cloudProvider description: Cloud provider (e.g., aws). type: String - contextPath: CyberArkISP.Event.identityType description: Identity type (e.g., NON_HUMAN, HUMAN). type: String - contextPath: CyberArkISP.Event.originRegion description: Origin region. type: String isfetchevents: true runonce: false script: '' type: python subtype: python3 dockerimage: demisto/python3:3.12.13.10116658 isfetchassets: true fromversion: 8.11.0 supportlevelheader: xsoar marketplaces: - marketplacev2 - platform tests: - No tests (auto formatted) supportedModules: - xsiam