Skip to content

BeyondTrust PRA Team

Overview

BeyondTrust Privileged Remote Access enables secure, controlled remote access to critical systems for employees and vendors, focusing on protecting privileged credentials and sessions.

This integration collects the Team logs.

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

  • Vendor: BeyondTrust
  • Supported environment: SaaS
  • Detection based on: Telemetry
  • Supported application or feature:
    • Team Activity

Configure

How to create an API token

  1. Log in the BeyondTrust Privileged Remote Access console

    Step 1

  2. Click the Burger menu

    Step 2

  3. On the left panel, click Management

    Step 3

  4. Click API Configuration

    Step 4

  5. Check Enable XML API and click + Add

    Step 5

  6. Check Enable

  7. Type a name for the API Account and add a comment (optional)
  8. Check Reporting > Allow Access to Access Session Reports and Recordings
  9. Copy the OAuth client ID and the OAuth client Secret

  10. Click Save

    Step 6

Create an intake

  1. Go to the intake page and create a new intake from the format BeyondTrust PRA Vault Account Activity.
  2. Set up the intake configuration with the Base URL, Client ID and Client Secret

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

{
    "timestamp": "1773679963",
    "team": {
        "name": "Integration",
        "id": "1"
    },
    "performed_by": {
        "name": "John Doe",
        "type": "representative"
    },
    "event_type": "Conference Member Added",
    "data": {
        "private_ip": "1.2.3.4",
        "private_name": "John Doe",
        "public_ip": "4.3.2.1:41286",
        "public_name": "John Doe",
        "support_teams": "Integration",
        "os": "Unknown"
    }
}

{
    "timestamp": "1773679963",
    "team": {
        "name": "Integration",
        "id": "1"
    },
    "performed_by": {
        "name": "John Doe",
        "type": "representative"
    },
    "event_type": "Conference Member State Changed",
    "data": {
        "private_ip": "Unknown",
        "public_ip": "4.3.2.1:41286",
        "state": "connected"
    }
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Third-party application logs None

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind ``
Category configuration, file, registry, session
Type change, delete, end, info, start

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

{
    "message": "{\"timestamp\": \"1773679963\", \"team\": {\"name\": \"Integration\", \"id\": \"1\"}, \"performed_by\": {\"name\": \"John Doe\", \"type\": \"representative\"}, \"event_type\": \"Conference Member Added\", \"data\": {\"private_ip\": \"1.2.3.4\", \"private_name\": \"John Doe\", \"public_ip\": \"4.3.2.1:41286\", \"public_name\": \"John Doe\", \"support_teams\": \"Integration\", \"os\": \"Unknown\"}}",
    "event": {
        "category": [
            "configuration"
        ],
        "code": "Conference Member Added",
        "dataset": "Team",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2026-03-16T16:52:43Z",
    "beyondtrust": {
        "pra": {
            "performed_by": {
                "type": "representative"
            }
        }
    },
    "group": {
        "id": "1",
        "name": "Integration"
    },
    "observer": {
        "product": "Privileged Remote Access",
        "vendor": "BeyondTrust"
    },
    "related": {
        "ip": [
            "1.2.3.4",
            "4.3.2.1"
        ],
        "user": [
            "John Doe"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4",
        "nat": {
            "ip": "4.3.2.1",
            "port": 41286
        }
    },
    "user": {
        "name": "John Doe"
    }
}

{
    "message": "{\"timestamp\": \"1773679963\", \"team\": {\"name\": \"Integration\", \"id\": \"1\"}, \"performed_by\": {\"name\": \"John Doe\", \"type\": \"representative\"}, \"event_type\": \"Conference Member State Changed\", \"data\": {\"private_ip\": \"Unknown\", \"public_ip\": \"4.3.2.1:41286\", \"state\": \"connected\"}}",
    "event": {
        "category": [
            "configuration"
        ],
        "code": "Conference Member State Changed",
        "dataset": "Team",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2026-03-16T16:52:43Z",
    "beyondtrust": {
        "pra": {
            "performed_by": {
                "type": "representative"
            },
            "state": "connected"
        }
    },
    "group": {
        "id": "1",
        "name": "Integration"
    },
    "observer": {
        "product": "Privileged Remote Access",
        "vendor": "BeyondTrust"
    },
    "related": {
        "ip": [
            "4.3.2.1"
        ],
        "user": [
            "John Doe"
        ]
    },
    "source": {
        "nat": {
            "ip": "4.3.2.1",
            "port": 41286
        }
    },
    "user": {
        "name": "John Doe"
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
beyondtrust.pra.owner keyword
beyondtrust.pra.performed_by.type keyword
beyondtrust.pra.state keyword
event.action keyword The action captured by the event.
event.category keyword Event category. The second categorization field in the hierarchy.
event.code keyword Identification code for this event.
event.dataset keyword Name of the dataset.
event.reason keyword Reason why this event happened, according to the source
event.type keyword Event type. The third categorization field in the hierarchy.
file.name keyword Name of the file including the extension, without the directory.
file.path keyword Full path to the file, including the file name.
group.id keyword Unique identifier for the group on the system/platform.
group.name keyword Name of the group.
host.name keyword Name of the host.
host.os.full keyword Operating system name, including the version or code name.
observer.product keyword The product name of the observer.
observer.vendor keyword Vendor name of the observer.
process.executable keyword Absolute path to the process executable.
process.title keyword Process title.
registry.data.strings wildcard List of strings representing what was written to the registry.
registry.data.type keyword Standard registry type for encoding contents
registry.key keyword Hive-relative path of keys.
registry.value keyword Name of the value written.
source.ip ip IP address of the source.
source.nat.ip ip Source NAT ip
source.nat.port long Source NAT port
url.original wildcard Unmodified original url as seen in the event source.
user.name keyword Short name or login of the user.
user.target.id keyword Unique identifier of the user.
user.target.name keyword Short name or login of the user.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.

Further readings