Archive
Highlighted

How to ingest Cyberark logs in Splunk?

New Member

Is there a published method or documentation on how to ingest Cyberark logs?

Thanks,
Jan Clairmont
302-669-9972

Tags (1)
0 Karma
Highlighted

Re: How to ingest Cyberark logs in Splunk?

Splunk Employee
Splunk Employee

Jan -

Are cyberark's logs in a text format? I used it at my last job and don't remember if that's the case. If it is, it would be a simple matter of installing a forwarder on the Cyberark server and pointing it at the logs. Then you would have to set up field extractions.

Brian

0 Karma
Highlighted

Re: How to ingest Cyberark logs in Splunk?

Explorer

Jan, Cyberark offers syslog containing audit events which can be easily fed into Splunk (directly or indirectly). If you just need audit events out of everything that Cyberark is logging, with syslog you won't need a Splunk forwarder installed on any of Cyberark boxes.

Michal

Highlighted

Re: How to ingest Cyberark logs in Splunk?

Super Champion

just bumping to see if anyone have implemented TA for Cyberark? Would be very helpful to see how CIM is mapped

0 Karma
Highlighted

Re: How to ingest Cyberark logs in Splunk?

Engager

My approach is using CyberArk EVD to export the data into MSSQL (almost no program effort) and then using python to export the log (JSON) which I really want in later analysis. During this period, you can do more correlative process on your data such as binding PolicyID and other customization file category.

The best of this way is that you can save your splunk license and make the log easy to handle, because splunk natively support JSON format log.

The cons: it could only do the near real-time, because EVD only export the data which is about 30 min before.

0 Karma
Highlighted

Re: How to ingest Cyberark logs in Splunk?

Path Finder

Can Splunk ingest CyberArk ITA logs also ?

0 Karma