topic Re: How to ingest Cyberark logs in Splunk? in Getting Data In

How to ingest Cyberark logs in Splunk?

janclairmont — Tue, 01 Jul 2014 14:12:22 GMT

Is there a published method or documentation on how to ingest Cyberark logs?

Thanks,
Jan Clairmont
302-669-9972

Re: How to ingest Cyberark logs in Splunk?

bosburn_splunk — Wed, 02 Jul 2014 02:47:38 GMT

Jan -

Are cyberark's logs in a text format? I used it at my last job and don't remember if that's the case. If it is, it would be a simple matter of installing a forwarder on the Cyberark server and pointing it at the logs. Then you would have to set up field extractions.

Brian

Re: How to ingest Cyberark logs in Splunk?

michtek — Tue, 08 Jul 2014 23:23:18 GMT

Jan, Cyberark offers syslog containing audit events which can be easily fed into Splunk (directly or indirectly). If you just need audit events out of everything that Cyberark is logging, with syslog you won't need a Splunk forwarder installed on any of Cyberark boxes.

Michal

Re: How to ingest Cyberark logs in Splunk?

koshyk — Tue, 28 Jul 2015 11:21:13 GMT

just bumping to see if anyone have implemented TA for Cyberark? Would be very helpful to see how CIM is mapped

Re: How to ingest Cyberark logs in Splunk?

James_wang — Thu, 22 Dec 2016 02:02:51 GMT

My approach is using CyberArk EVD to export the data into MSSQL (almost no program effort) and then using python to export the log (JSON) which I really want in later analysis. During this period, you can do more correlative process on your data such as binding PolicyID and other customization file category.

The best of this way is that you can save your splunk license and make the log easy to handle, because splunk natively support JSON format log.

The cons: it could only do the near real-time, because EVD only export the data which is about 30 min before.

Re: How to ingest Cyberark logs in Splunk?

rajanala — Tue, 11 Jun 2019 16:05:18 GMT

Can Splunk ingest CyberArk ITA logs also ?