Suggest some Cyberark and proofpoint Use cases

[mohammadsharukh]

Hi All,

I am working on Arcsight and i am seeing there are use cases available on Splunk for both the Proof point and Cyber-ark.

Can anyone of you please suggest or attach some screenshot for these use cases.

I just need an idea waht can be created mainly for Cyberark.

Please suggest.

Thanks in advance.

[koshyk]

One of the use-case you can create is
"An employee does a modification/change to the host without checking out in Cyberark"

So the data inputs you need is
1. Change record (from a cmdb system). This should have entry for hosts/cmdb_elements linked.
2. Monitor file modifications (for certain files or there are tools for it)
3. Cyberark logs.

If you co-relate all the 3 and then can create a use-case within Enterprise Security to trigger alert, saying "User modification without proper checking out in cyberark or without accessing the credentials"

[mohammadsharukh]

I want to create rules/use case/notable/alert that will trigger when they will find the required condition. FOR CYEBRARK.
I don't have any idea for use cases, please suggest me some along with conditions

For example on windows we have failed login alert that will trigger when it finds 3 device event class id 4625 in 2 minutes.

Can anyone please suggest some use cases for cyberarl also

[adonio]

hello there,
what exactly do you mean by "use case"?
yes, you can bring data from CyberArk and ProofPoint to Splunk and query it, report on it, visualize it however you find fit.
looks like there are also TAs and apps wit some stuff out of the box.
download and see for yourself:
CyberArk:
https://splunkbase.splunk.com/app/2891/#/overview
Proof Point (has many TAs supporting different data sources) here is a link for the app itself. download the TAs as well
https://splunkbase.splunk.com/app/3727/