Is there any way to monitor cyberark logs?

[agentsofshield]

Hello! So I installed the Cyberark add on in order to monitor Cyberark.

I already have a syslog server which produces .log files from Cyberark. Is there any way to monitor it directly from the .log files, or do I absolutely have to do it they way they specified in: https://docs.splunk.com/Documentation/AddOns/released/CyberArk/Setup (translating the files)?

It's just, so much easier if I could just translate the log files locally on the syslog server. Thank you!

[koshyk · Accepted solution]

Why you want to translate the file in your syslog server? Splunk is the best regex engine and you could do within Splunk

If you need to use CyberArk addon directly is:
1. Put the Translator (xsl) file in the CyberARk Vault System. This has to be done by your cyberark admin.
2. After you put the translator file, it will send syslog message to the destination & port
3. Use your syslog server to capture this message. Please use rfc5424 if possible. This will put all the data correctly in your syslog server
4. Use Splunk to index this data and put the sourcetype as mentioned in CyberArk addon.

If you don't want to use CyberARk addon
1. You need to put some translator file in cyberark and point to your syslog. Try to use a key-value translator if possible
2. Just use inputs.conf and collect into Splunk into an index and put your own sourcetype eg. custom:cyberark:vault
3. You can write your own extraction rules in your TA and is flexible. Ensure you collect important fields including safe-name, address,messageId,requestorId etc.

[deva1995]

How to capture those messages on the syslog server? PLease help. thanks in advance

[rajanala]

Account activities are successfully collected using the Splunk add-on for CyberArk.
Is there a way to ingest CyberArk's ITA logs into Splunk ?