So this is a NICE extremely nice dashboard but I don't think my enterprise will let me download this unless it comes from like Splunk or CyberArk aka from a trusted sender trusted host etc. I / we could retype everything very time consuming and would have to ask the author's permission. Basically I cant import "internet code into a fortune 100 company. I need a dash board as well. the CyberArk one is like well people laugh at the CyberArk health monitor. CyberArk being a TIER ZERO application should really have some better monitoring and dashboards especially when its at a more important level than A/D Federation etc. I was sent this a few hours ago thank you to the senders its an amazing product but I don't think I can import internet code ... https://github.com/jcreameriii/PAS-APM-Dashboard-Package-for-Splunk Hi Kennet I'm a CyberArk CDE / SME - So The Vault being a bastion host does not respond to ping etc. it can open ports when the communication is initiated from within the vault. The vault can send SNMP traps thru an agent which is configured in 2 places and they share a private and public key sort of "trust" called a CRED file (this is how all of the CyberArk components "trust" and communicate. The Vault can send SNP traps to say the CPM server from thier the CPM server (not as hardened ) can have a snmp relay and send that to syslog - Splunk solar winds on and on. NOW for Syslog CyberArk uses a translator file located in the Vaults server folder. It usta be the Arcsight translator file but now it it the Splunk translator file. this will "translate" or transform the CyberArk Vault events into CEF. where my Splunk but not Siem knowledge get a bit grey is I believe I need to have the "Source Type" configured by my Splunk admins. I see F5 I see Cisco I see Hadoop I see all kinds of devices in my companies source type but I do not see CyberArk, read this artcle - good article and reverse engineer it and or check your Splunk systems to see if your getting *.monitor from your vaults (good starting Point) So after typing this I realized my question "Do I need my Splunk admins to create CyberArk source Type or is tis what the Splunk CyberArk add on configures/enables ?) contact me with any other idea and or CyberArk questions. Re: Ed
... View more
