CyberArk Posture Overview
This dashboard displays security related information from the CyberArk account
CyberArk Identity ENABLED
Details
| ID | b25555dbd9ca47d089adda9a96ae7883 |
|---|---|
| From Version | 6.10.0 |
| Supported Modules | xsiam |
Screenshot
Widgets (5)
CyberArk Top IP Locations
This widget displays the IP's locations used to access the account
Custom XQL map
datamodel dataset = cyberark_identity_raw |filter xdm.source.ipv4 != null |comp count(xdm.source.ipv4) as Count by xdm.source.ipv4 |iploc xdm.source.ipv4 loc_country as country | view graph type = map header = "IP Locations" xaxis = country yaxis = Count headerfontsize = 15 legendfontsize = 10 legend = `false`
CyberArk Top Apps Usage
This Widget displays the app usage within the CyberArk account
Custom XQL pie
datamodel dataset = cyberark_identity_raw | filter xdm.target.resource.name !="" |filter xdm.event.type="Cloud.Saas.Application.App*" |comp count(xdm.target.resource.name) as `Count` by xdm.target.resource.name |fields xdm.target.resource.name, Count |filter count!=0 | view graph type = pie xaxis = xdm.target.resource.name yaxis = Count
CyberArk Top Authentication Methods
This widget displays the authentication methods used in the CyberArk account
Custom XQL column
datamodel dataset = cyberark_identity_raw |filter xdm.auth.auth_method!="" |filter xdm.auth.auth_method!="None" |comp count(xdm.auth.auth_method) as `Count` by xdm.auth.auth_method |fields xdm.auth.auth_method, Count | view graph type = column subtype = grouped xaxis = xdm.auth.auth_method yaxis = Count
CyberArk MFA Status
This widget displays the MFA authentication status for users in the CyberArk account
Custom XQL pie
datamodel dataset = cyberark_identity_raw | filter xdm.event.outcome!=null |comp count(xdm.event.outcome) as `Count` by xdm.event.outcome |fields xdm.event.outcome, Count | view graph type = pie xaxis = xdm.event.outcome yaxis = Count valuecolor("Success","#51c062") valuecolor("Failed","#b67678")
CyberArk Active Users
This widget displays the users who are making actions in the CyberArk account
Custom XQL table
datamodel dataset = cyberark_identity_raw | filter xdm.target.user.username!=null and xdm.target.user.username!="Portal" |comp count_distinct(xdm.target.user.username) by xdm.target.user.username |alter Users=regextract(xdm.target.user.username,"(\w+)@") |filter Users!="" |fields Users
{ "dashboards_data": [ { "id": "b25555dbd9ca47d089adda9a96ae7883", "name": "CyberArk Posture Overview", "description": "This dashboard displays security related information from the CyberArk account", "status": "ENABLED", "layout": [ { "id": "row-1321", "data": [ { "key": "xql_1668684048672", "data": { "type": "Custom XQL", "width": 50, "height": 466, "params": [], "phrase": "datamodel dataset = cyberark_identity_raw \r\n|filter xdm.source.ipv4 != null \r\n|comp count(xdm.source.ipv4) as Count by xdm.source.ipv4 \r\n|iploc xdm.source.ipv4 loc_country as country\r\n| view graph type = map header = \"IP Locations\" xaxis = country yaxis = Count headerfontsize = 15 legendfontsize = 10 legend = `false` ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "map", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"IP Locations\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "country" } }, { "command": { "op": "=", "name": "yaxis", "value": "Count" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "15" } }, { "command": { "op": "=", "name": "legendfontsize", "value": "10" } }, { "command": { "op": "=", "name": "legend", "value": "`false`" } } ] } } }, { "key": "xql_1668683909917", "data": { "type": "Custom XQL", "width": 50, "height": 466, "params": [], "phrase": "datamodel dataset = cyberark_identity_raw \r\n| filter xdm.target.resource.name !=\"\"\r\n|filter xdm.event.type=\"Cloud.Saas.Application.App*\"\r\n|comp count(xdm.target.resource.name) as `Count` by xdm.target.resource.name\r\n|fields xdm.target.resource.name, Count\r\n|filter count!=0\r\n| view graph type = pie xaxis = xdm.target.resource.name yaxis = Count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "xdm.target.resource.name" } }, { "command": { "op": "=", "name": "yaxis", "value": "Count" } } ] } } } ] }, { "id": "row-8766", "data": [ { "key": "xql_1668683958060", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 466, "params": [], "phrase": "datamodel dataset = cyberark_identity_raw \r\n|filter xdm.auth.auth_method!=\"\"\r\n|filter xdm.auth.auth_method!=\"None\"\r\n|comp count(xdm.auth.auth_method) as `Count` by xdm.auth.auth_method\r\n|fields xdm.auth.auth_method, Count\r\n| view graph type = column subtype = grouped xaxis = xdm.auth.auth_method yaxis = Count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "column", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "grouped" } }, { "command": { "op": "=", "name": "xaxis", "value": "xdm.auth.auth_method" } }, { "command": { "op": "=", "name": "yaxis", "value": "Count" } } ] } } }, { "key": "xql_1668683844352", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 466, "params": [], "phrase": "datamodel dataset = cyberark_identity_raw \r\n| filter xdm.event.outcome!=null\r\n|comp count(xdm.event.outcome) as `Count` by xdm.event.outcome\r\n|fields xdm.event.outcome, Count\r\n| view graph type = pie xaxis = xdm.event.outcome yaxis = Count valuecolor(\"Success\",\"#51c062\") valuecolor(\"Failed\",\"#b67678\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "xdm.event.outcome" } }, { "command": { "op": "=", "name": "yaxis", "value": "Count" } }, { "func": { "args": [ "\"Success\"", "\"#51c062\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"Failed\"", "\"#b67678\"" ], "name": "valuecolor" } } ] } } }, { "key": "xql_1668684128957", "data": { "type": "Custom XQL", "width": 33.333333333333336, "height": 466, "params": [], "phrase": "datamodel dataset = cyberark_identity_raw \r\n| filter xdm.target.user.username!=null and xdm.target.user.username!=\"Portal\"\r\n|comp count_distinct(xdm.target.user.username) by xdm.target.user.username\r\n|alter Users=regextract(xdm.target.user.username,\"(\\w+)@\")\r\n|filter Users!=\"\"\r\n|fields Users", "entityType": "xql-widget-table-6a4cd14e-ba02-410c-82aa-863637b4c733", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"stretch\",\"gridRowsHeight\":\"high-row\"}", "columnWidth": "\"stretch\"" } } } ] } ], "default_dashboard_id": 1, "global_id": "b25555dbd9ca47d089adda9a96ae7883" } ], "widgets_data": [ { "widget_key": "xql_1668683844352", "title": "CyberArk MFA Status", "creation_time": 1668683844352, "description": "This widget displays the MFA authentication status for users in the CyberArk account", "data": { "params": [], "phrase": "datamodel dataset = cyberark_identity_raw \r\n| filter xdm.event.outcome!=null\r\n|comp count(xdm.event.outcome) as `Count` by xdm.event.outcome\r\n|fields xdm.event.outcome, Count\r\n| view graph type = pie xaxis = xdm.event.outcome yaxis = Count valuecolor(\"Success\",\"#51c062\") valuecolor(\"Failed\",\"#b67678\") ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "xdm.event.outcome" } }, { "command": { "op": "=", "name": "yaxis", "value": "Count" } }, { "func": { "args": [ "\"Success\"", "\"#51c062\"" ], "name": "valuecolor" } }, { "func": { "args": [ "\"Failed\"", "\"#b67678\"" ], "name": "valuecolor" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [], "query_uses_library": false } }, { "widget_key": "xql_1668683909917", "title": "CyberArk Top Apps Usage", "creation_time": 1668683909917, "description": "This Widget displays the app usage within the CyberArk account", "data": { "params": [], "phrase": "datamodel dataset = cyberark_identity_raw \r\n| filter xdm.target.resource.name !=\"\"\r\n|filter xdm.event.type=\"Cloud.Saas.Application.App*\"\r\n|comp count(xdm.target.resource.name) as `Count` by xdm.target.resource.name\r\n|fields xdm.target.resource.name, Count\r\n|filter count!=0\r\n| view graph type = pie xaxis = xdm.target.resource.name yaxis = Count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "pie", "commands": [ { "command": { "op": "=", "name": "xaxis", "value": "xdm.target.resource.name" } }, { "command": { "op": "=", "name": "yaxis", "value": "Count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [], "query_uses_library": false } }, { "widget_key": "xql_1668683958060", "title": "CyberArk Top Authentication Methods", "creation_time": 1668683958060, "description": "This widget displays the authentication methods used in the CyberArk account", "data": { "params": [], "phrase": "datamodel dataset = cyberark_identity_raw \r\n|filter xdm.auth.auth_method!=\"\"\r\n|filter xdm.auth.auth_method!=\"None\"\r\n|comp count(xdm.auth.auth_method) as `Count` by xdm.auth.auth_method\r\n|fields xdm.auth.auth_method, Count\r\n| view graph type = column subtype = grouped xaxis = xdm.auth.auth_method yaxis = Count ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "column", "commands": [ { "command": { "op": "=", "name": "subtype", "value": "grouped" } }, { "command": { "op": "=", "name": "xaxis", "value": "xdm.auth.auth_method" } }, { "command": { "op": "=", "name": "yaxis", "value": "Count" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [], "query_uses_library": false } }, { "widget_key": "xql_1668684048672", "title": "CyberArk Top IP Locations", "creation_time": 1668684048672, "description": "This widget displays the IP's locations used to access the account", "data": { "params": [], "phrase": "datamodel dataset = cyberark_identity_raw \r\n|filter xdm.source.ipv4 != null \r\n|comp count(xdm.source.ipv4) as Count by xdm.source.ipv4 \r\n|iploc xdm.source.ipv4 loc_country as country\r\n| view graph type = map header = \"IP Locations\" xaxis = country yaxis = Count headerfontsize = 15 legendfontsize = 10 legend = `false` ", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "map", "commands": [ { "command": { "op": "=", "name": "header", "value": "\"IP Locations\"" } }, { "command": { "op": "=", "name": "xaxis", "value": "country" } }, { "command": { "op": "=", "name": "yaxis", "value": "Count" } }, { "command": { "op": "=", "name": "headerfontsize", "value": "15" } }, { "command": { "op": "=", "name": "legendfontsize", "value": "10" } }, { "command": { "op": "=", "name": "legend", "value": "`false`" } } ] } }, "support_time_range": true, "additional_info": { "query_tables": [], "query_uses_library": false } }, { "widget_key": "xql_1668684128957", "title": "CyberArk Active Users", "creation_time": 1668684128957, "description": "This widget displays the users who are making actions in the CyberArk account", "data": { "params": [], "phrase": "datamodel dataset = cyberark_identity_raw \r\n| filter xdm.target.user.username!=null and xdm.target.user.username!=\"Portal\"\r\n|comp count_distinct(xdm.target.user.username) by xdm.target.user.username\r\n|alter Users=regextract(xdm.target.user.username,\"(\\w+)@\")\r\n|filter Users!=\"\"\r\n|fields Users", "time_frame": { "relativeTime": 2592000000 }, "viewOptions": { "type": "table", "commands": [] }, "gridRawStorageInfo": { "sort": null, "coldefs": {}, "rowHeight": "{\"rowHeight\":\"stretch\",\"gridRowsHeight\":\"high-row\"}", "columnWidth": "\"stretch\"" } }, "support_time_range": true, "additional_info": { "query_tables": [], "query_uses_library": false } } ], "fromVersion": "6.10.0", "supportedModules": [ "xsiam" ] }