Skip to content

BeyondTrust PRA Vault Account Activity

Overview

BeyondTrust Privileged Remote Access enables secure, controlled remote access to critical systems for employees and vendors, focusing on protecting privileged credentials and sessions.

This integration collects the VaultAccountActivity logs.

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

  • Vendor: BeyondTrust
  • Supported environment: SaaS
  • Detection based on: Telemetry
  • Supported application or feature:
    • Vault Account Activity

Configure

How to create an API token

  1. Log in the BeyondTrust Privileged Remote Access console

    Step 1

  2. Click the Burger menu

    Step 2

  3. On the left panel, click Management

    Step 3

  4. Click API Configuration

    Step 4

  5. Check Enable XML API and click + Add

    Step 5

  6. Check Enable

  7. Type a name for the API Account and add a comment (optional)
  8. Check Reporting > Allow Access to Vault Account Activity Reports
  9. Copy the OAuth client ID and the OAuth client Secret

  10. Click Save

    Step 6

Create an intake

  1. Go to the intake page and create a new intake from the format BeyondTrust PRA Vault Account Activity.
  2. Set up the intake configuration with the Base URL, Client ID and Client Secret

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

{
    "timestamp": "1773671926",
    "event_type": "Account Created",
    "account_id": "1",
    "performed_by": {
        "id": "2",
        "type": "User",
        "name": "John Doe"
    },
    "data": null
}

{
    "timestamp": "1773672107",
    "event_type": "Account Deleted",
    "account_id": "1",
    "performed_by": {
        "id": "2",
        "type": "User",
        "name": "John Doe"
    },
    "data": null
}

{
    "timestamp": "1773672020",
    "event_type": "Password Changed",
    "account_id": "1",
    "performed_by": {
        "id": "2",
        "type": "User",
        "name": "John Doe"
    },
    "data": "Manually Edited"
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

No related built-in rules was found. This message is automatically generated.

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Third-party application logs None

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind ``
Category iam
Type info

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

{
    "message": "{\"timestamp\": \"1773671926\", \"event_type\": \"Account Created\", \"account_id\": \"1\", \"performed_by\": {\"id\": \"2\", \"type\": \"User\", \"name\": \"John Doe\"}, \"data\": null}",
    "event": {
        "category": [
            "iam"
        ],
        "code": "Account Created",
        "dataset": "Vault Account Activity",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-03-16T14:38:46Z",
    "beyondtrust": {
        "pra": {
            "performed_by": {
                "type": "User"
            }
        }
    },
    "observer": {
        "product": "Privileged Remote Access",
        "vendor": "BeyondTrust"
    },
    "related": {
        "user": [
            "John Doe"
        ]
    },
    "user": {
        "id": "2",
        "name": "John Doe",
        "target": {
            "id": "1"
        }
    }
}

{
    "message": "{\"timestamp\": \"1773672107\", \"event_type\": \"Account Deleted\", \"account_id\": \"1\", \"performed_by\": {\"id\": \"2\", \"type\": \"User\", \"name\": \"John Doe\"}, \"data\": null}",
    "event": {
        "category": [
            "iam"
        ],
        "code": "Account Deleted",
        "dataset": "Vault Account Activity",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-03-16T14:41:47Z",
    "beyondtrust": {
        "pra": {
            "performed_by": {
                "type": "User"
            }
        }
    },
    "observer": {
        "product": "Privileged Remote Access",
        "vendor": "BeyondTrust"
    },
    "related": {
        "user": [
            "John Doe"
        ]
    },
    "user": {
        "id": "2",
        "name": "John Doe",
        "target": {
            "id": "1"
        }
    }
}

{
    "message": "{\"timestamp\": \"1773672020\", \"event_type\": \"Password Changed\", \"account_id\": \"1\", \"performed_by\": {\"id\": \"2\", \"type\": \"User\", \"name\": \"John Doe\"}, \"data\": \"Manually Edited\"}",
    "event": {
        "category": [
            "iam"
        ],
        "code": "Password Changed",
        "dataset": "Vault Account Activity",
        "reason": "Manually Edited",
        "type": [
            "info"
        ]
    },
    "@timestamp": "2026-03-16T14:40:20Z",
    "beyondtrust": {
        "pra": {
            "performed_by": {
                "type": "User"
            }
        }
    },
    "observer": {
        "product": "Privileged Remote Access",
        "vendor": "BeyondTrust"
    },
    "related": {
        "user": [
            "John Doe"
        ]
    },
    "user": {
        "id": "2",
        "name": "John Doe",
        "target": {
            "id": "1"
        }
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
beyondtrust.pra.performed_by.type keyword
event.category keyword Event category. The second categorization field in the hierarchy.
event.code keyword Identification code for this event.
event.dataset keyword Name of the dataset.
event.reason keyword Reason why this event happened, according to the source
event.type keyword Event type. The third categorization field in the hierarchy.
observer.product keyword The product name of the observer.
observer.vendor keyword Vendor name of the observer.
user.id keyword Unique identifier of the user.
user.name keyword Short name or login of the user.
user.target.id keyword Unique identifier of the user.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.

Further readings