Skip to content

CyberArk Identity Audit Logs

Overview

  • Supported environment: SaaS
  • Detection based on: Audit
  • Supported application or feature:
    • Audit Events

Warning

Important note - This format is currently in beta. We highly value your feedback to improve its performance.

Configure

How to create credentials

  1. Log in the CyberArk Administration Console

  2. On the left panel, click on the application switcher and click Audit

    step2

  3. On the left panel, Click SIEM integrations

    step3

  4. Click Create SIEM integration

    step4 step5

  5. Click on the link on the first link to go on the CyberArk Identity Administration console

  6. On the left panel, go to Apps & Widgets > Web Apps

  7. Click Add Web Apps

    step5c

  8. In the popup, click on the tab Custom

  9. Look for OAuth2 Server and click Add

    step5d

  10. Click Yes in the new popup

    step5e

  11. Type an Application ID, a Name, and a Category

    step5f

  12. Go to the section Scope

  13. Click the Add button and type isp.audit.events:read in the new entry

    step5g

  14. Go to the section Token

  15. Select jwtRS256 as token type

  16. Check Client creds as authentication method and uncheck other options

    step5h

  17. Go to the section Advanced

  18. Paste the following script 

        setClaim('tenant_id', TenantData.Get("CybrTenantID"));
    setClaim('aud', 'cyberark.isp.audit');

    step5c

  19. Click Save

  20. On the left panel, go to Core Services > Users

  21. On the right panel, Select CyberArk Cloud Directory Users then click Add User

    step5c

  22. In the section Status, check Is service user and Is OAuth confidential client

  23. Type a login name, a display name, and a password

  24. Click Create User

    step5c

  25. Click on the user and go to the section Application Settings

  26. Click Add

    step5c

  27. Select the Web application previous created

    step5c

  28. On the left panel, go to Apps & Widgets > Web Apps

  29. Click on the application previously created
  30. Go to the section Permissions

  31. Click Add

    step5c

  32. Look for the user previously created

  33. Check it and click Add

    step5c

  34. Check Grant, View, Manage, and Delete for the user

  35. Click Save

    step5c

  36. On the Create SIEM Page, type the name and the description of the integration and click Apply

Instruction on Sekoia

Configure Your Intake

This section will guide you through creating the intake object in Sekoia, which provides a unique identifier called the "Intake key." The Intake key is essential for later configuration, as it references the Community, Entity, and Parser (Intake Format) used when receiving raw events on Sekoia.

  1. Go to the Sekoia Intake page.
  2. Click on the + New Intake button at the top right of the page.
  3. Search for your Intake by the product name in the search bar.
  4. Give it a Name and associate it with an Entity (and a Community if using multi-tenant mode).
  5. Click on Create.

Note

For more details on how to use the Intake page and to find the Intake key you just created, refer to this documentation.

Raw Events Samples

In this section, you will find examples of raw logs as generated natively by the source. These examples are provided to help integrators understand the data format before ingestion into Sekoia.io. It is crucial for setting up the correct parsing stages and ensuring that all relevant information is captured.

{
    "uuid": "5fe03d80-98b2-4857-8288-1a0a0ff03e47",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739269449904,
    "username": "john.doe@cyberark.cloud.xxxxx",
    "applicationCode": "IDP",
    "auditCode": "IDP2001",
    "auditType": "Info",
    "action": "add-user",
    "userId": "7f93b762-618e-4e6e-b6dd-36ab6fc13e69",
    "source": "2a01:e34:ec57:b230:f188:56c5:7089:d987",
    "actionType": "Create",
    "component": "Identity",
    "serviceName": "Identity",
    "accessMethod": null,
    "accountId": null,
    "target": null,
    "command": null,
    "sessionId": null,
    "message": "add-user",
    "customData": {
        "directory_service_id": "38ca614f-6315-4af6-a4ee-f4ea9d5a747c",
        "user_id": "b94d0198-1e2d-4008-9fee-73ce2bd682aa",
        "user_name": "example@cyberark.cloud.xxxxx"
    },
    "cloudProvider": "aws",
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": null,
    "accountName": null,
    "targetPlatform": null,
    "targetAccount": null,
    "identityType": "HUMAN"
}

{
    "uuid": "66f9ee7e-8d2d-4a32-9997-4f5beaeffa98",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739156795332,
    "username": "CYBERARKACCOUNTSINTEGRATION",
    "applicationCode": "IDP",
    "auditCode": "IDP2009",
    "auditType": "Info",
    "action": "cloud.core.oauthtoken.create",
    "userId": "9a3416a8-3f8c-49ad-962e-663cc57fd224",
    "source": "1.2.3.4",
    "actionType": "Create",
    "component": "Identity",
    "serviceName": "Identity",
    "accessMethod": null,
    "accountId": null,
    "target": null,
    "command": null,
    "sessionId": null,
    "message": "cloud.core.oauthtoken.create",
    "customData": {
        "start_time": "2/10/2025 3:06:30 AM",
        "is_internal_application": true,
        "end_time": "2/10/2025 3:21:30 AM",
        "client": "__idaptive_cybr_user_oidc",
        "user_guid": "9a3416a8-3f8c-49ad-962e-663cc57fd224",
        "scopes": "openid api profile",
        "token_type": "Id",
        "app_id": "__idaptive_cybr_user_oidc"
    },
    "cloudProvider": "aws",
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": null,
    "accountName": null,
    "targetPlatform": null,
    "targetAccount": null,
    "identityType": "HUMAN"
}

{
    "uuid": "de0c99e4-d692-4b61-96c4-5c5e62639232",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739268304920,
    "username": "john.doe@cyberark.cloud.xxxxx",
    "applicationCode": "IDP",
    "auditCode": "IDP6004",
    "auditType": "Info",
    "action": "cloud.saas.application.appmodify",
    "userId": "7f93b762-618e-4e6e-b6dd-36ab6fc13e69",
    "source": "2a01:e34:ec57:b230:f188:56c5:7089:d987",
    "actionType": "Edit",
    "component": "Identity",
    "serviceName": "Identity",
    "accessMethod": null,
    "accountId": null,
    "target": null,
    "command": null,
    "sessionId": null,
    "message": "cloud.saas.application.appmodify",
    "customData": {
        "app_url": "",
        "not_self_service": true,
        "service_name": "MyAppId",
        "geoip_latitude": 48.8717,
        "description": "Integration to pull events from CyberArk",
        "app_display_name": "MyApp",
        "geoip_city_name": "Paris",
        "type": "Web",
        "web_app_type": "OAuth",
        "web_app_type_display_name": "Other Type",
        "app_type_display_name": "Web - Other Type",
        "on_prem": false,
        "auth_method": "OAuth2",
        "request_browser_name": "Chrome",
        "geoip_country_name": "France",
        "request_device_os": "Linux",
        "name": "Example",
        "id": "5bdc0c20-b605-4972-be9a-6c93794ec987",
        "category": "Other",
        "geoip_longitude": 2.32075,
        "geoip_country_code": "FR"
    },
    "cloudProvider": "aws",
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": null,
    "accountName": null,
    "targetPlatform": null,
    "targetAccount": null,
    "identityType": "HUMAN"
}

{
    "uuid": "66f9ee7e-8d2d-4a32-9997-4f5beaeffa98",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739268337147,
    "username": "john.doe@cyberark.cloud.xxxxx",
    "applicationCode": "IDP",
    "auditCode": "IDP6010",
    "auditType": "Info",
    "action": "cloud.saas.application.appdelete",
    "userId": "7f93b762-618e-4e6e-b6dd-36ab6fc13e69",
    "source": "2a01:e34:ec57:b230:f188:56c5:7089:d987",
    "actionType": "Delete",
    "component": "Identity",
    "serviceName": "Identity",
    "accessMethod": null,
    "accountId": null,
    "target": null,
    "command": null,
    "sessionId": null,
    "message": "cloud.saas.application.appdelete",
    "customData": {
        "not_self_service": false,
        "service_name": "",
        "geoip_latitude": 48.8717,
        "geoip_city_name": "Paris",
        "type": "Web",
        "web_app_type": "OAuth",
        "on_prem": false,
        "auth_method": "OAuth2",
        "request_browser_name": "Chrome",
        "geoip_country_name": "France",
        "request_device_os": "Linux",
        "name": "Example",
        "id": "5bdc0c20-b605-4972-be9a-6c93794ec987",
        "geoip_longitude": 2.32075,
        "geoip_country_code": "FR"
    },
    "cloudProvider": "aws",
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": null,
    "accountName": null,
    "targetPlatform": null,
    "targetAccount": null,
    "identityType": "HUMAN"
}

{
    "uuid": "f6397849-56d5-4bb3-b6ed-bdda7f15051f",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739363055593,
    "username": "john.doe@cyberark.cloud.xxxxx",
    "applicationCode": "PAM",
    "auditCode": "PAM00032",
    "auditType": "Info",
    "action": "Add Owner",
    "userId": "john.doe@cyberark.cloud.xxxxx",
    "source": "PVWA",
    "actionType": "Edit",
    "component": "Vault",
    "serviceName": "Privilege Cloud",
    "accessMethod": null,
    "accountId": "",
    "target": "",
    "command": null,
    "sessionId": null,
    "message": "",
    "customData": {
        "PAM": {
            "new_target": "",
            "target": "PVWAGWUser"
        }
    },
    "cloudProvider": null,
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": "Integration safe",
    "accountName": "",
    "targetPlatform": "",
    "targetAccount": "",
    "identityType": null
}

{
    "uuid": "fee8499d-faf4-41bf-bb30-45475d2d1056",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739147898151,
    "username": "PVWAGWUser",
    "applicationCode": "PAM",
    "auditCode": "PAM00088",
    "auditType": "Info",
    "action": "Set Password",
    "userId": "PVWAGWUser",
    "source": "PVWAAPP",
    "actionType": "Password",
    "component": "Vault",
    "serviceName": "Privilege Cloud",
    "accessMethod": null,
    "accountId": null,
    "target": "",
    "command": null,
    "sessionId": null,
    "message": "",
    "customData": {
        "PAM": {
            "new_target": "",
            "target": ""
        }
    },
    "cloudProvider": null,
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": "",
    "accountName": "",
    "targetPlatform": "",
    "targetAccount": "",
    "identityType": null
}

{
    "uuid": "fe2b3e00-d8f9-4942-aa63-5fcaebc489f2",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739266337571,
    "username": "john.doe@cyberark.cloud.xxxxx",
    "applicationCode": "PAM",
    "auditCode": "PAM00099",
    "auditType": "Info",
    "action": "Open File",
    "userId": "john.doe@cyberark.cloud.xxxxx",
    "source": "PVWA",
    "actionType": "Execute",
    "component": "Vault",
    "serviceName": "Privilege Cloud",
    "accessMethod": null,
    "accountId": null,
    "target": "",
    "command": null,
    "sessionId": null,
    "message": "",
    "customData": {
        "PAM": {
            "new_target": "",
            "target": "Root\\PVConfiguration.xml"
        }
    },
    "cloudProvider": null,
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": "PVWAConfig",
    "accountName": "",
    "targetPlatform": "",
    "targetAccount": "",
    "identityType": null
}

{
    "uuid": "b81f8a47-19db-4a7f-ad8b-3f855fcf868d",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739363115168,
    "username": "john.doe@cyberark.cloud.xxxxx",
    "applicationCode": "PAM",
    "auditCode": "PAM00105",
    "auditType": "Info",
    "action": "Add File Category",
    "userId": "john.doe@cyberark.cloud.xxxxx",
    "source": "PVWA",
    "actionType": "Create",
    "component": "Vault",
    "serviceName": "Privilege Cloud",
    "accessMethod": null,
    "accountId": "15_3",
    "target": "127.0.0.1",
    "command": null,
    "sessionId": null,
    "message": "Value=[PVWA]",
    "customData": {
        "PAM": {
            "new_target": "CreationMethod",
            "target": "Root\\Operating System-UnixSSH-127.0.0.1-integrationteam"
        }
    },
    "cloudProvider": null,
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": "Integration safe",
    "accountName": "Operating System-UnixSSH-127.0.0.1-integrationteam",
    "targetPlatform": "UnixSSH",
    "targetAccount": "integrationteam",
    "identityType": null
}

{
    "uuid": "fc32fb82-5321-46f8-811d-4de63e539e5a",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739363055534,
    "username": "mjohn.doe@cyberark.cloud.xxxxx",
    "applicationCode": "PAM",
    "auditCode": "PAM00185",
    "auditType": "Info",
    "action": "Add Safe",
    "userId": "john.doe@cyberark.cloud.xxxxx",
    "source": "PVWA",
    "actionType": "Execute",
    "component": "Vault",
    "serviceName": "Privilege Cloud",
    "accessMethod": null,
    "accountId": "",
    "target": "",
    "command": null,
    "sessionId": null,
    "message": "",
    "customData": {
        "PAM": {
            "new_target": "",
            "target": ""
        }
    },
    "cloudProvider": null,
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": "Integration safe",
    "accountName": "",
    "targetPlatform": "",
    "targetAccount": "",
    "identityType": null
}

{
    "uuid": "f0db2c85-adf5-402d-9adc-f8d35eb49154",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739363055693,
    "username": "john.doe@cyberark.cloud.xxxxx",
    "applicationCode": "PAM",
    "auditCode": "PAM00273",
    "auditType": "Info",
    "action": "Remove Owner",
    "userId": "john.doe@cyberark.cloud.xxxxx",
    "source": "PVWA",
    "actionType": "Edit",
    "component": "Vault",
    "serviceName": "Privilege Cloud",
    "accessMethod": null,
    "accountId": "",
    "target": "",
    "command": null,
    "sessionId": null,
    "message": "",
    "customData": {
        "PAM": {
            "new_target": "",
            "target": "PVWAGWUser"
        }
    },
    "cloudProvider": null,
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": "Integration safe",
    "accountName": "",
    "targetPlatform": "",
    "targetAccount": "",
    "identityType": null
}

{
    "uuid": "09ad5ce5-996b-406c-a6cc-4ef0f3869d4c",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739363114854,
    "username": "john.doe@cyberark.cloud.xxxxx",
    "applicationCode": "PAM",
    "auditCode": "PAM00294",
    "auditType": "Info",
    "action": "Store password",
    "userId": "john.doe@cyberark.cloud.xxxxx",
    "source": "PVWA",
    "actionType": "Password",
    "component": "Vault",
    "serviceName": "Privilege Cloud",
    "accessMethod": null,
    "accountId": "15_3",
    "target": "",
    "command": null,
    "sessionId": null,
    "message": "",
    "customData": {
        "PAM": {
            "new_target": "",
            "target": "Root\\Operating System-UnixSSH-127.0.0.1-integrationteam"
        }
    },
    "cloudProvider": null,
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": "Integration safe",
    "accountName": "Operating System-UnixSSH-127.0.0.1-integrationteam",
    "targetPlatform": "",
    "targetAccount": "",
    "identityType": null
}

{
    "uuid": "6f00a100-43af-4787-a22e-567ca5c9845a",
    "tenantId": "43de6333-65f1-4626-aeec-2cff238e61ca",
    "timestamp": 1739363136939,
    "username": "john.doe@cyberark.cloud.xxxxx",
    "applicationCode": "PAM",
    "auditCode": "PAM00295",
    "auditType": "Info",
    "action": "Retrieve password",
    "userId": "john.doe@cyberark.cloud.xxxxx",
    "source": "PVWA",
    "actionType": "Password",
    "component": "Vault",
    "serviceName": "Privilege Cloud",
    "accessMethod": null,
    "accountId": "15_3",
    "target": "127.0.0.1",
    "command": null,
    "sessionId": null,
    "message": "(Action: Copy Password)access",
    "customData": {
        "PAM": {
            "new_target": "",
            "target": "Root\\Operating System-UnixSSH-127.0.0.1-integrationteam"
        }
    },
    "cloudProvider": null,
    "cloudWorkspacesAndRoles": [],
    "cloudIdentities": null,
    "cloudAssets": null,
    "safe": "Integration safe",
    "accountName": "Operating System-UnixSSH-127.0.0.1-integrationteam",
    "targetPlatform": "UnixSSH",
    "targetAccount": "integrationteam",
    "identityType": null
}

Detection section

The following section provides information for those who wish to learn more about the detection capabilities enabled by collecting this intake. It includes details about the built-in rule catalog, event categories, and ECS fields extracted from raw events. This is essential for users aiming to create custom detection rules, perform hunting activities, or pivot in the events page.

The following Sekoia.io built-in rules match the intake CyberArk Audit Logs [BETA]. This documentation is updated automatically and is based solely on the fields used by the intake which are checked against our rules. This means that some rules will be listed but might not be relevant with the intake.

SEKOIA.IO x CyberArk Audit Logs [BETA] on ATT&CK Navigator

Account Added To A Security Enabled Group

Detection in order to investigate who has added a specific Domain User in Domain Admins or Group Policy Creator Owners (Security event 4728)

  • Effort: master
Account Removed From A Security Enabled Group

Detection in order to investigate who has removed a specific Domain User in Domain Admins or Group Policy Creator Owners (Security event 4729)

  • Effort: master
Adidnsdump Enumeration

Detects use of the tool adidnsdump for enumeration and discovering DNS records.

  • Effort: advanced
Advanced IP Scanner

Detects the use of Advanced IP Scanner. Seems to be a popular tool for ransomware groups.

  • Effort: master
Backup Catalog Deleted

The rule detects when the Backup Catalog has been deleted. It means the administrators will not be able to access any backups that were created earlier to perform recoveries. This is often being done using the wbadmin.exe tool.

  • Effort: intermediate
Certify Or Certipy

Detects the use of certify and certipy which are two different tools used to enumerate and abuse Active Directory Certificate Services.

  • Effort: advanced
Cobalt Strike Default Beacons Names

Detects the default names of Cobalt Strike beacons / payloads.

  • Effort: intermediate
Computer Account Deleted

Detects computer account deletion.

  • Effort: master
Credential Dump Tools Related Files

Detects processes or file names related to credential dumping tools and the dropped files they generate by default.

  • Effort: advanced
Cron Files Alteration

Cron Files and Cron Directory alteration used by attacker for persistency or privilege escalation. To ensure full performance on this rule, auditbeat intake must be configure with the module file_integrity containing path mentionned in the pattern.

  • Effort: advanced
Cryptomining

Detection of domain names potentially related to cryptomining activities.

  • Effort: master
DHCP Server Error Failed Loading the CallOut DLL

This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be loaded.

  • Effort: intermediate
DHCP Server Loaded the CallOut DLL

This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded. This would indicate a succesful attack against DHCP service allowing to disrupt the service or alter the integrity of the responses.

  • Effort: intermediate
DNS Server Error Failed Loading The ServerLevelPluginDLL

This rule detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded. This requires the dedicated Windows event provider Microsoft-Windows-DNS-Server-Service.

  • Effort: master
Domain Trust Created Or Removed

A trust was created or removed to a domain. An attacker could perform that in order to do lateral movement easily between domains or shutdown the ability of two domains to communicate.

  • Effort: advanced
Dynamic DNS Contacted

Detect communication with dynamic dns domain. This kind of domain is often used by attackers. This rule can trigger false positive in non-controlled environment because dynamic dns is not always malicious.

  • Effort: master
Exfiltration Domain

Detects traffic toward a domain flagged as a possible exfiltration vector.

  • Effort: master
HackTools Suspicious Names

Quick-win rule to detect the default process names or file names of several HackTools.

  • Effort: advanced
Impacket Addcomputer

Detects suspicious computer account creation based on impacket default pattern

  • Effort: intermediate
Microsoft Defender Antivirus History Deleted

Windows Defender history has been deleted. Could be an attempt by an attacker to remove its traces.

  • Effort: master
Microsoft Defender Antivirus Tampering Detected

Detection of Windows Defender Tampering, from definitions' deletion to deactivation of parts or all of Defender.

  • Effort: advanced
Microsoft Defender Antivirus Threat Detected

Detection of a windows defender alert indicating the presence of potential malware

  • Effort: advanced
NTDS.dit File In Suspicious Directory

The file NTDS.dit is supposed to be located mainly in C:\Windows\NTDS. The rule checks whether the file is in a legitimate directory or not (through file creation events). This is usually really suspicious and could indicate an attacker trying copy the file to then look for users password hashes.

  • Effort: advanced
OneNote Embedded File

Detects creation or uses of OneNote embedded files with unusual extensions.

  • Effort: intermediate
Package Manager Alteration

Package manager (eg: apt, yum) can be altered to install malicious software. To ensure full performance on this rule, auditbeat intake must be configure with the module file_integrity containing path mentionned in the pattern.

  • Effort: advanced
Password Change On Directory Service Restore Mode (DSRM) Account

The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password to gain persistence.

  • Effort: intermediate
PasswordDump SecurityXploded Tool

Detects the execution of the PasswordDump SecurityXploded Tool

  • Effort: elementary
Possible Replay Attack

This event can be a sign of Kerberos replay attack or, among other things, network device configuration or routing problems.

  • Effort: master
Process Trace Alteration

PTrace syscall provides a means by which one process ("tracer") may observe and control the execution of another process ("tracee") and examine and change the tracee's memory and registers. Attacker might want to abuse ptrace functionnality to analyse memory process. It requires to be admin or set ptrace_scope to 0 to allow all user to trace any process.

  • Effort: advanced
RTLO Character

Detects RTLO (Right-To-Left character) in file and process names.

  • Effort: elementary
Remote Access Tool Domain

Detects traffic toward a domain flagged as a Remote Administration Tool (RAT).

  • Effort: master
Remote Monitoring and Management Software - AnyDesk

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool AnyDesk.

  • Effort: master
Remote Monitoring and Management Software - Atera

Detect artifacts related to the installation or execution of the Remote Monitoring and Management tool Atera.

  • Effort: master
SEKOIA.IO Intelligence Feed

Detect threats based on indicators of compromise (IOCs) collected by SEKOIA's Threat and Detection Research team.

  • Effort: elementary
SSH Authorized Key Alteration

The file authorized_keys is used by SSH server to identify SSH keys that are authorized to connect to the host, alteration of one of those files might indicate a user compromision.

  • Effort: advanced
Sekoia.io EICAR Detection

Detects observables in Sekoia.io CTI tagged as EICAR, which are fake samples meant to test detection.

  • Effort: master
Sign-In Via Known AiTM Phishing Kit

Detects a sign-in attempt from an IP address belonging to a known adversary-in-the-middle phishing kit.

  • Effort: elementary
Suspicious File Name

Detects suspicious file name possibly linked to malicious tool.

  • Effort: advanced
Suspicious PROCEXP152.sys File Created In Tmp

Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (https://github.com/hfiref0x/KDU) or Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs), which uses KDU. Note - Clever attackers may easily bypass this detection by just renaming the driver filename. Therefore just Medium-level and don't rely on it.

  • Effort: advanced
TOR Usage Generic Rule

Detects TOR usage globally, whether the IP is a destination or source. TOR is short for The Onion Router, and it gets its name from how it works. TOR intercepts the network traffic from one or more apps on user’s computer, usually the user web browser, and shuffles it through a number of randomly-chosen computers before passing it on to its destination. This disguises user location, and makes it harder for servers to pick him/her out on repeat visits, or to tie together separate visits to different sites, this making tracking and surveillance more difficult. Before a network packet starts its journey, user’s computer chooses a random list of relays and repeatedly encrypts the data in multiple layers, like an onion. Each relay knows only enough to strip off the outermost layer of encryption, before passing what’s left on to the next relay in the list.

  • Effort: master
User Account Created

Detects user creation on windows servers, which shouldn't happen in an Active Directory environment. Apply this on your windows server logs and not on your DC logs. One default account defaultuser0 is excluded as only used during Windows set-up. This detection use Security Event ID 4720.

  • Effort: master
User Account Deleted

Detects local user deletion

  • Effort: master
WCE wceaux.dll Creation

Detects wceaux.dll creation while Windows Credentials Editor (WCE) is executed.

  • Effort: intermediate
Webshell Creation

Detects possible webshell file creation. It requires File Creation monitoring, which can be done using Sysmon's Event ID 11. However the recommended SwiftOnSecurity configuration does not fully cover the needs for this rule, it needs to be updated with the proper file names extensions.

  • Effort: master

Event Categories

The following table lists the data source offered by this integration.

Data Source Description
Application logs None
Authentication logs None

In details, the following table denotes the type of events produced by this integration.

Name Values
Kind ``
Category authentication, configuration, iam
Type access, change, creation, deletion, info, start

Transformed Events Samples after Ingestion

This section demonstrates how the raw logs will be transformed by our parsers. It shows the extracted fields that will be available for use in the built-in detection rules and hunting activities in the events page. Understanding these transformations is essential for analysts to create effective detection mechanisms with custom detection rules and to leverage the full potential of the collected data.

{
    "message": "{\"uuid\": \"5fe03d80-98b2-4857-8288-1a0a0ff03e47\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739269449904, \"username\": \"john.doe@cyberark.cloud.xxxxx\", \"applicationCode\": \"IDP\", \"auditCode\": \"IDP2001\", \"auditType\": \"Info\", \"action\": \"add-user\", \"userId\": \"7f93b762-618e-4e6e-b6dd-36ab6fc13e69\", \"source\": \"2a01:e34:ec57:b230:f188:56c5:7089:d987\", \"actionType\": \"Create\", \"component\": \"Identity\", \"serviceName\": \"Identity\", \"accessMethod\": null, \"accountId\": null, \"target\": null, \"command\": null, \"sessionId\": null, \"message\": \"add-user\", \"customData\": {\"directory_service_id\": \"38ca614f-6315-4af6-a4ee-f4ea9d5a747c\", \"user_id\": \"b94d0198-1e2d-4008-9fee-73ce2bd682aa\", \"user_name\": \"example@cyberark.cloud.xxxxx\"}, \"cloudProvider\": \"aws\", \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": null, \"accountName\": null, \"targetPlatform\": null, \"targetAccount\": null, \"identityType\": \"HUMAN\"}",
    "event": {
        "action": "add-user",
        "category": [
            "configuration"
        ],
        "code": "IDP2001",
        "dataset": "IDP",
        "provider": "Identity",
        "reason": "add-user",
        "type": [
            "creation"
        ]
    },
    "@timestamp": "2025-02-11T10:24:09.904000Z",
    "cloud": {
        "provider": "aws"
    },
    "cyberark": {
        "audit": {
            "directory_service_id": "38ca614f-6315-4af6-a4ee-f4ea9d5a747c",
            "uuid": "5fe03d80-98b2-4857-8288-1a0a0ff03e47"
        }
    },
    "observer": {
        "product": "Identity",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "related": {
        "ip": [
            "2a01:e34:ec57:b230:f188:56c5:7089:d987"
        ]
    },
    "source": {
        "address": "2a01:e34:ec57:b230:f188:56c5:7089:d987",
        "ip": "2a01:e34:ec57:b230:f188:56c5:7089:d987"
    },
    "user": {
        "email": "john.doe@cyberark.cloud.xxxxx",
        "id": "7f93b762-618e-4e6e-b6dd-36ab6fc13e69",
        "target": {
            "email": "example@cyberark.cloud.xxxxx",
            "id": "b94d0198-1e2d-4008-9fee-73ce2bd682aa"
        }
    }
}

{
    "message": "{\"uuid\": \"66f9ee7e-8d2d-4a32-9997-4f5beaeffa98\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739156795332, \"username\": \"CYBERARKACCOUNTSINTEGRATION\", \"applicationCode\": \"IDP\", \"auditCode\": \"IDP2009\", \"auditType\": \"Info\", \"action\": \"cloud.core.oauthtoken.create\", \"userId\": \"9a3416a8-3f8c-49ad-962e-663cc57fd224\", \"source\": \"1.2.3.4\", \"actionType\": \"Create\", \"component\": \"Identity\", \"serviceName\": \"Identity\", \"accessMethod\": null, \"accountId\": null, \"target\": null, \"command\": null, \"sessionId\": null, \"message\": \"cloud.core.oauthtoken.create\", \"customData\": {\"start_time\": \"2/10/2025 3:06:30 AM\", \"is_internal_application\": true, \"end_time\": \"2/10/2025 3:21:30 AM\", \"client\": \"__idaptive_cybr_user_oidc\", \"user_guid\": \"9a3416a8-3f8c-49ad-962e-663cc57fd224\", \"scopes\": \"openid api profile\", \"token_type\": \"Id\", \"app_id\": \"__idaptive_cybr_user_oidc\"}, \"cloudProvider\": \"aws\", \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": null, \"accountName\": null, \"targetPlatform\": null, \"targetAccount\": null, \"identityType\": \"HUMAN\"}",
    "event": {
        "action": "cloud.core.oauthtoken.create",
        "category": [
            "authentication"
        ],
        "code": "IDP2009",
        "dataset": "IDP",
        "provider": "Identity",
        "reason": "cloud.core.oauthtoken.create",
        "type": [
            "start"
        ]
    },
    "@timestamp": "2025-02-10T03:06:35.332000Z",
    "cloud": {
        "provider": "aws"
    },
    "cyberark": {
        "audit": {
            "uuid": "66f9ee7e-8d2d-4a32-9997-4f5beaeffa98"
        }
    },
    "observer": {
        "product": "Identity",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "related": {
        "ip": [
            "1.2.3.4"
        ],
        "user": [
            "CYBERARKACCOUNTSINTEGRATION"
        ]
    },
    "source": {
        "address": "1.2.3.4",
        "ip": "1.2.3.4"
    },
    "user": {
        "id": "9a3416a8-3f8c-49ad-962e-663cc57fd224",
        "name": "CYBERARKACCOUNTSINTEGRATION"
    }
}

{
    "message": "{\"uuid\": \"de0c99e4-d692-4b61-96c4-5c5e62639232\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739268304920, \"username\": \"john.doe@cyberark.cloud.xxxxx\", \"applicationCode\": \"IDP\", \"auditCode\": \"IDP6004\", \"auditType\": \"Info\", \"action\": \"cloud.saas.application.appmodify\", \"userId\": \"7f93b762-618e-4e6e-b6dd-36ab6fc13e69\", \"source\": \"2a01:e34:ec57:b230:f188:56c5:7089:d987\", \"actionType\": \"Edit\", \"component\": \"Identity\", \"serviceName\": \"Identity\", \"accessMethod\": null, \"accountId\": null, \"target\": null, \"command\": null, \"sessionId\": null, \"message\": \"cloud.saas.application.appmodify\", \"customData\": {\"app_url\": \"\", \"not_self_service\": true, \"service_name\": \"MyAppId\", \"geoip_latitude\": 48.8717, \"description\": \"Integration to pull events from CyberArk\", \"app_display_name\": \"MyApp\", \"geoip_city_name\": \"Paris\", \"type\": \"Web\", \"web_app_type\": \"OAuth\", \"web_app_type_display_name\": \"Other Type\", \"app_type_display_name\": \"Web - Other Type\", \"on_prem\": false, \"auth_method\": \"OAuth2\", \"request_browser_name\": \"Chrome\", \"geoip_country_name\": \"France\", \"request_device_os\": \"Linux\", \"name\": \"Example\", \"id\": \"5bdc0c20-b605-4972-be9a-6c93794ec987\", \"category\": \"Other\", \"geoip_longitude\": 2.32075, \"geoip_country_code\": \"FR\"}, \"cloudProvider\": \"aws\", \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": null, \"accountName\": null, \"targetPlatform\": null, \"targetAccount\": null, \"identityType\": \"HUMAN\"}",
    "event": {
        "action": "cloud.saas.application.appmodify",
        "category": [
            "configuration"
        ],
        "code": "IDP6004",
        "dataset": "IDP",
        "provider": "Identity",
        "reason": "cloud.saas.application.appmodify",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2025-02-11T10:05:04.920000Z",
    "cloud": {
        "provider": "aws"
    },
    "cyberark": {
        "audit": {
            "application": {
                "description": "Integration to pull events from CyberArk",
                "display_name": "MyApp",
                "id": "5bdc0c20-b605-4972-be9a-6c93794ec987",
                "service_name": "MyAppId"
            },
            "uuid": "de0c99e4-d692-4b61-96c4-5c5e62639232"
        }
    },
    "host": {
        "os": {
            "platform": "Linux"
        }
    },
    "observer": {
        "product": "Identity",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "related": {
        "ip": [
            "2a01:e34:ec57:b230:f188:56c5:7089:d987"
        ]
    },
    "source": {
        "address": "2a01:e34:ec57:b230:f188:56c5:7089:d987",
        "geo": {
            "city_name": "Paris",
            "country_iso_code": "FR",
            "country_name": "France"
        },
        "ip": "2a01:e34:ec57:b230:f188:56c5:7089:d987"
    },
    "user": {
        "email": "john.doe@cyberark.cloud.xxxxx",
        "id": "7f93b762-618e-4e6e-b6dd-36ab6fc13e69"
    },
    "user_agent": {
        "name": "Chrome"
    }
}

{
    "message": "{\"uuid\": \"66f9ee7e-8d2d-4a32-9997-4f5beaeffa98\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739268337147, \"username\": \"john.doe@cyberark.cloud.xxxxx\", \"applicationCode\": \"IDP\", \"auditCode\": \"IDP6010\", \"auditType\": \"Info\", \"action\": \"cloud.saas.application.appdelete\", \"userId\": \"7f93b762-618e-4e6e-b6dd-36ab6fc13e69\", \"source\": \"2a01:e34:ec57:b230:f188:56c5:7089:d987\", \"actionType\": \"Delete\", \"component\": \"Identity\", \"serviceName\": \"Identity\", \"accessMethod\": null, \"accountId\": null, \"target\": null, \"command\": null, \"sessionId\": null, \"message\": \"cloud.saas.application.appdelete\", \"customData\": {\"not_self_service\": false, \"service_name\": \"\", \"geoip_latitude\": 48.8717, \"geoip_city_name\": \"Paris\", \"type\": \"Web\", \"web_app_type\": \"OAuth\", \"on_prem\": false, \"auth_method\": \"OAuth2\", \"request_browser_name\": \"Chrome\", \"geoip_country_name\": \"France\", \"request_device_os\": \"Linux\", \"name\": \"Example\", \"id\": \"5bdc0c20-b605-4972-be9a-6c93794ec987\", \"geoip_longitude\": 2.32075, \"geoip_country_code\": \"FR\"}, \"cloudProvider\": \"aws\", \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": null, \"accountName\": null, \"targetPlatform\": null, \"targetAccount\": null, \"identityType\": \"HUMAN\"}",
    "event": {
        "action": "cloud.saas.application.appdelete",
        "category": [
            "configuration"
        ],
        "code": "IDP6010",
        "dataset": "IDP",
        "provider": "Identity",
        "reason": "cloud.saas.application.appdelete",
        "type": [
            "deletion"
        ]
    },
    "@timestamp": "2025-02-11T10:05:37.147000Z",
    "cloud": {
        "provider": "aws"
    },
    "cyberark": {
        "audit": {
            "uuid": "66f9ee7e-8d2d-4a32-9997-4f5beaeffa98"
        }
    },
    "host": {
        "os": {
            "platform": "Linux"
        }
    },
    "observer": {
        "product": "Identity",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "related": {
        "ip": [
            "2a01:e34:ec57:b230:f188:56c5:7089:d987"
        ]
    },
    "source": {
        "address": "2a01:e34:ec57:b230:f188:56c5:7089:d987",
        "geo": {
            "city_name": "Paris",
            "country_iso_code": "FR",
            "country_name": "France"
        },
        "ip": "2a01:e34:ec57:b230:f188:56c5:7089:d987"
    },
    "user": {
        "email": "john.doe@cyberark.cloud.xxxxx",
        "id": "7f93b762-618e-4e6e-b6dd-36ab6fc13e69"
    },
    "user_agent": {
        "name": "Chrome"
    }
}

{
    "message": "{\"uuid\": \"f6397849-56d5-4bb3-b6ed-bdda7f15051f\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739363055593, \"username\": \"john.doe@cyberark.cloud.xxxxx\", \"applicationCode\": \"PAM\", \"auditCode\": \"PAM00032\", \"auditType\": \"Info\", \"action\": \"Add Owner\", \"userId\": \"john.doe@cyberark.cloud.xxxxx\", \"source\": \"PVWA\", \"actionType\": \"Edit\", \"component\": \"Vault\", \"serviceName\": \"Privilege Cloud\", \"accessMethod\": null, \"accountId\": \"\", \"target\": \"\", \"command\": null, \"sessionId\": null, \"message\": \"\", \"customData\": {\"PAM\": {\"new_target\": \"\", \"target\": \"PVWAGWUser\"}}, \"cloudProvider\": null, \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": \"Integration safe\", \"accountName\": \"\", \"targetPlatform\": \"\", \"targetAccount\": \"\", \"identityType\": null}",
    "event": {
        "action": "Add Owner",
        "category": [
            "configuration"
        ],
        "code": "PAM00032",
        "dataset": "PAM",
        "provider": "Vault",
        "type": [
            "creation"
        ]
    },
    "@timestamp": "2025-02-12T12:24:15.593000Z",
    "cyberark": {
        "audit": {
            "safe": "Integration safe",
            "uuid": "f6397849-56d5-4bb3-b6ed-bdda7f15051f"
        }
    },
    "observer": {
        "name": "PVWA",
        "product": "Privilege Cloud",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "user": {
        "email": "john.doe@cyberark.cloud.xxxxx",
        "id": "john.doe@cyberark.cloud.xxxxx"
    }
}

{
    "message": "{\"uuid\": \"fee8499d-faf4-41bf-bb30-45475d2d1056\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739147898151, \"username\": \"PVWAGWUser\", \"applicationCode\": \"PAM\", \"auditCode\": \"PAM00088\", \"auditType\": \"Info\", \"action\": \"Set Password\", \"userId\": \"PVWAGWUser\", \"source\": \"PVWAAPP\", \"actionType\": \"Password\", \"component\": \"Vault\", \"serviceName\": \"Privilege Cloud\", \"accessMethod\": null, \"accountId\": null, \"target\": \"\", \"command\": null, \"sessionId\": null, \"message\": \"\", \"customData\": {\"PAM\": {\"new_target\": \"\", \"target\": \"\"}}, \"cloudProvider\": null, \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": \"\", \"accountName\": \"\", \"targetPlatform\": \"\", \"targetAccount\": \"\", \"identityType\": null}",
    "event": {
        "action": "Set Password",
        "category": [
            "configuration"
        ],
        "code": "PAM00088",
        "dataset": "PAM",
        "provider": "Vault",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2025-02-10T00:38:18.151000Z",
    "cyberark": {
        "audit": {
            "uuid": "fee8499d-faf4-41bf-bb30-45475d2d1056"
        }
    },
    "observer": {
        "name": "PVWAAPP",
        "product": "Privilege Cloud",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "related": {
        "user": [
            "PVWAGWUser"
        ]
    },
    "user": {
        "id": "PVWAGWUser",
        "name": "PVWAGWUser"
    }
}

{
    "message": "{\"uuid\": \"fe2b3e00-d8f9-4942-aa63-5fcaebc489f2\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739266337571, \"username\": \"john.doe@cyberark.cloud.xxxxx\", \"applicationCode\": \"PAM\", \"auditCode\": \"PAM00099\", \"auditType\": \"Info\", \"action\": \"Open File\", \"userId\": \"john.doe@cyberark.cloud.xxxxx\", \"source\": \"PVWA\", \"actionType\": \"Execute\", \"component\": \"Vault\", \"serviceName\": \"Privilege Cloud\", \"accessMethod\": null, \"accountId\": null, \"target\": \"\", \"command\": null, \"sessionId\": null, \"message\": \"\", \"customData\": {\"PAM\": {\"new_target\": \"\", \"target\": \"Root\\\\PVConfiguration.xml\"}}, \"cloudProvider\": null, \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": \"PVWAConfig\", \"accountName\": \"\", \"targetPlatform\": \"\", \"targetAccount\": \"\", \"identityType\": null}",
    "event": {
        "action": "Open File",
        "category": [
            "configuration"
        ],
        "code": "PAM00099",
        "dataset": "PAM",
        "provider": "Vault",
        "type": [
            "access"
        ]
    },
    "@timestamp": "2025-02-11T09:32:17.571000Z",
    "cyberark": {
        "audit": {
            "safe": "PVWAConfig",
            "uuid": "fe2b3e00-d8f9-4942-aa63-5fcaebc489f2"
        }
    },
    "file": {
        "name": "PVConfiguration.xml",
        "path": "Root\\PVConfiguration.xml"
    },
    "observer": {
        "name": "PVWA",
        "product": "Privilege Cloud",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "user": {
        "email": "john.doe@cyberark.cloud.xxxxx",
        "id": "john.doe@cyberark.cloud.xxxxx"
    }
}

{
    "message": "{\"uuid\": \"b81f8a47-19db-4a7f-ad8b-3f855fcf868d\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739363115168, \"username\": \"john.doe@cyberark.cloud.xxxxx\", \"applicationCode\": \"PAM\", \"auditCode\": \"PAM00105\", \"auditType\": \"Info\", \"action\": \"Add File Category\", \"userId\": \"john.doe@cyberark.cloud.xxxxx\", \"source\": \"PVWA\", \"actionType\": \"Create\", \"component\": \"Vault\", \"serviceName\": \"Privilege Cloud\", \"accessMethod\": null, \"accountId\": \"15_3\", \"target\": \"127.0.0.1\", \"command\": null, \"sessionId\": null, \"message\": \"Value=[PVWA]\", \"customData\": {\"PAM\": {\"new_target\": \"CreationMethod\", \"target\": \"Root\\\\Operating System-UnixSSH-127.0.0.1-integrationteam\"}}, \"cloudProvider\": null, \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": \"Integration safe\", \"accountName\": \"Operating System-UnixSSH-127.0.0.1-integrationteam\", \"targetPlatform\": \"UnixSSH\", \"targetAccount\": \"integrationteam\", \"identityType\": null}",
    "event": {
        "action": "Add File Category",
        "category": [
            "configuration"
        ],
        "code": "PAM00105",
        "dataset": "PAM",
        "provider": "Vault",
        "reason": "Value=[PVWA]",
        "type": [
            "creation"
        ]
    },
    "@timestamp": "2025-02-12T12:25:15.168000Z",
    "cyberark": {
        "audit": {
            "account_id": "15_3",
            "account_name": "Operating System-UnixSSH-127.0.0.1-integrationteam",
            "new_target": "CreationMethod",
            "safe": "Integration safe",
            "target_platform": "UnixSSH",
            "uuid": "b81f8a47-19db-4a7f-ad8b-3f855fcf868d"
        }
    },
    "destination": {
        "address": "127.0.0.1",
        "ip": "127.0.0.1"
    },
    "observer": {
        "name": "PVWA",
        "product": "Privilege Cloud",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "related": {
        "ip": [
            "127.0.0.1"
        ],
        "user": [
            "Operating System-UnixSSH-127.0.0.1-integrationteam"
        ]
    },
    "user": {
        "email": "john.doe@cyberark.cloud.xxxxx",
        "id": "john.doe@cyberark.cloud.xxxxx",
        "target": {
            "domain": "Root",
            "name": "Operating System-UnixSSH-127.0.0.1-integrationteam"
        }
    }
}

{
    "message": "{\"uuid\": \"fc32fb82-5321-46f8-811d-4de63e539e5a\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739363055534, \"username\": \"mjohn.doe@cyberark.cloud.xxxxx\", \"applicationCode\": \"PAM\", \"auditCode\": \"PAM00185\", \"auditType\": \"Info\", \"action\": \"Add Safe\", \"userId\": \"john.doe@cyberark.cloud.xxxxx\", \"source\": \"PVWA\", \"actionType\": \"Execute\", \"component\": \"Vault\", \"serviceName\": \"Privilege Cloud\", \"accessMethod\": null, \"accountId\": \"\", \"target\": \"\", \"command\": null, \"sessionId\": null, \"message\": \"\", \"customData\": {\"PAM\": {\"new_target\": \"\", \"target\": \"\"}}, \"cloudProvider\": null, \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": \"Integration safe\", \"accountName\": \"\", \"targetPlatform\": \"\", \"targetAccount\": \"\", \"identityType\": null}",
    "event": {
        "action": "Add Safe",
        "category": [
            "configuration"
        ],
        "code": "PAM00185",
        "dataset": "PAM",
        "provider": "Vault",
        "type": [
            "creation"
        ]
    },
    "@timestamp": "2025-02-12T12:24:15.534000Z",
    "cyberark": {
        "audit": {
            "safe": "Integration safe",
            "uuid": "fc32fb82-5321-46f8-811d-4de63e539e5a"
        }
    },
    "observer": {
        "name": "PVWA",
        "product": "Privilege Cloud",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "user": {
        "email": "mjohn.doe@cyberark.cloud.xxxxx",
        "id": "john.doe@cyberark.cloud.xxxxx"
    }
}

{
    "message": "{\"uuid\": \"f0db2c85-adf5-402d-9adc-f8d35eb49154\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739363055693, \"username\": \"john.doe@cyberark.cloud.xxxxx\", \"applicationCode\": \"PAM\", \"auditCode\": \"PAM00273\", \"auditType\": \"Info\", \"action\": \"Remove Owner\", \"userId\": \"john.doe@cyberark.cloud.xxxxx\", \"source\": \"PVWA\", \"actionType\": \"Edit\", \"component\": \"Vault\", \"serviceName\": \"Privilege Cloud\", \"accessMethod\": null, \"accountId\": \"\", \"target\": \"\", \"command\": null, \"sessionId\": null, \"message\": \"\", \"customData\": {\"PAM\": {\"new_target\": \"\", \"target\": \"PVWAGWUser\"}}, \"cloudProvider\": null, \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": \"Integration safe\", \"accountName\": \"\", \"targetPlatform\": \"\", \"targetAccount\": \"\", \"identityType\": null}",
    "event": {
        "action": "Remove Owner",
        "category": [
            "configuration"
        ],
        "code": "PAM00273",
        "dataset": "PAM",
        "provider": "Vault",
        "type": [
            "deletion"
        ]
    },
    "@timestamp": "2025-02-12T12:24:15.693000Z",
    "cyberark": {
        "audit": {
            "safe": "Integration safe",
            "uuid": "f0db2c85-adf5-402d-9adc-f8d35eb49154"
        }
    },
    "observer": {
        "name": "PVWA",
        "product": "Privilege Cloud",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "user": {
        "email": "john.doe@cyberark.cloud.xxxxx",
        "id": "john.doe@cyberark.cloud.xxxxx"
    }
}

{
    "message": "{\"uuid\": \"09ad5ce5-996b-406c-a6cc-4ef0f3869d4c\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739363114854, \"username\": \"john.doe@cyberark.cloud.xxxxx\", \"applicationCode\": \"PAM\", \"auditCode\": \"PAM00294\", \"auditType\": \"Info\", \"action\": \"Store password\", \"userId\": \"john.doe@cyberark.cloud.xxxxx\", \"source\": \"PVWA\", \"actionType\": \"Password\", \"component\": \"Vault\", \"serviceName\": \"Privilege Cloud\", \"accessMethod\": null, \"accountId\": \"15_3\", \"target\": \"\", \"command\": null, \"sessionId\": null, \"message\": \"\", \"customData\": {\"PAM\": {\"new_target\": \"\", \"target\": \"Root\\\\Operating System-UnixSSH-127.0.0.1-integrationteam\"}}, \"cloudProvider\": null, \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": \"Integration safe\", \"accountName\": \"Operating System-UnixSSH-127.0.0.1-integrationteam\", \"targetPlatform\": \"\", \"targetAccount\": \"\", \"identityType\": null}",
    "event": {
        "action": "Store password",
        "category": [
            "configuration"
        ],
        "code": "PAM00294",
        "dataset": "PAM",
        "provider": "Vault",
        "type": [
            "change"
        ]
    },
    "@timestamp": "2025-02-12T12:25:14.854000Z",
    "cyberark": {
        "audit": {
            "account_id": "15_3",
            "account_name": "Operating System-UnixSSH-127.0.0.1-integrationteam",
            "safe": "Integration safe",
            "uuid": "09ad5ce5-996b-406c-a6cc-4ef0f3869d4c"
        }
    },
    "observer": {
        "name": "PVWA",
        "product": "Privilege Cloud",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "related": {
        "user": [
            "Operating System-UnixSSH-127.0.0.1-integrationteam"
        ]
    },
    "user": {
        "email": "john.doe@cyberark.cloud.xxxxx",
        "id": "john.doe@cyberark.cloud.xxxxx",
        "target": {
            "domain": "Root",
            "name": "Operating System-UnixSSH-127.0.0.1-integrationteam"
        }
    }
}

{
    "message": "{\"uuid\": \"6f00a100-43af-4787-a22e-567ca5c9845a\", \"tenantId\": \"43de6333-65f1-4626-aeec-2cff238e61ca\", \"timestamp\": 1739363136939, \"username\": \"john.doe@cyberark.cloud.xxxxx\", \"applicationCode\": \"PAM\", \"auditCode\": \"PAM00295\", \"auditType\": \"Info\", \"action\": \"Retrieve password\", \"userId\": \"john.doe@cyberark.cloud.xxxxx\", \"source\": \"PVWA\", \"actionType\": \"Password\", \"component\": \"Vault\", \"serviceName\": \"Privilege Cloud\", \"accessMethod\": null, \"accountId\": \"15_3\", \"target\": \"127.0.0.1\", \"command\": null, \"sessionId\": null, \"message\": \"(Action: Copy Password)access\", \"customData\": {\"PAM\": {\"new_target\": \"\", \"target\": \"Root\\\\Operating System-UnixSSH-127.0.0.1-integrationteam\"}}, \"cloudProvider\": null, \"cloudWorkspacesAndRoles\": [], \"cloudIdentities\": null, \"cloudAssets\": null, \"safe\": \"Integration safe\", \"accountName\": \"Operating System-UnixSSH-127.0.0.1-integrationteam\", \"targetPlatform\": \"UnixSSH\", \"targetAccount\": \"integrationteam\", \"identityType\": null}",
    "event": {
        "action": "Retrieve password",
        "category": [
            "configuration"
        ],
        "code": "PAM00295",
        "dataset": "PAM",
        "provider": "Vault",
        "reason": "(Action: Copy Password)access",
        "type": [
            "access"
        ]
    },
    "@timestamp": "2025-02-12T12:25:36.939000Z",
    "cyberark": {
        "audit": {
            "account_id": "15_3",
            "account_name": "Operating System-UnixSSH-127.0.0.1-integrationteam",
            "safe": "Integration safe",
            "target_platform": "UnixSSH",
            "uuid": "6f00a100-43af-4787-a22e-567ca5c9845a"
        }
    },
    "destination": {
        "address": "127.0.0.1",
        "ip": "127.0.0.1"
    },
    "observer": {
        "name": "PVWA",
        "product": "Privilege Cloud",
        "vendor": "CyberArk"
    },
    "organization": {
        "id": "43de6333-65f1-4626-aeec-2cff238e61ca"
    },
    "related": {
        "ip": [
            "127.0.0.1"
        ],
        "user": [
            "Operating System-UnixSSH-127.0.0.1-integrationteam"
        ]
    },
    "user": {
        "email": "john.doe@cyberark.cloud.xxxxx",
        "id": "john.doe@cyberark.cloud.xxxxx",
        "target": {
            "domain": "Root",
            "name": "Operating System-UnixSSH-127.0.0.1-integrationteam"
        }
    }
}

Extracted Fields

The following table lists the fields that are extracted, normalized under the ECS format, analyzed and indexed by the parser. It should be noted that infered fields are not listed.

Name Type Description
@timestamp date Date/time when the event originated.
cloud.provider keyword Name of the cloud provider.
cyberark.audit.account_id keyword
cyberark.audit.account_name keyword
cyberark.audit.application.description keyword
cyberark.audit.application.display_name keyword
cyberark.audit.application.id keyword
cyberark.audit.application.service_name keyword
cyberark.audit.directory_service_id keyword
cyberark.audit.new_target keyword
cyberark.audit.safe keyword
cyberark.audit.session_id keyword
cyberark.audit.target_platform keyword
cyberark.audit.uuid keyword
destination.ip ip IP address of the destination.
event.action keyword The action captured by the event.
event.category keyword Event category. The second categorization field in the hierarchy.
event.code keyword Identification code for this event.
event.dataset keyword Name of the dataset.
event.provider keyword Source of the event.
event.reason keyword Reason why this event happened, according to the source
event.type keyword Event type. The third categorization field in the hierarchy.
file.name keyword Name of the file including the extension, without the directory.
file.path keyword Full path to the file, including the file name.
host.os.platform keyword Operating system platform (such centos, ubuntu, windows).
observer.name keyword Custom name of the observer.
observer.product keyword The product name of the observer.
observer.vendor keyword Vendor name of the observer.
organization.id keyword Unique identifier for the organization.
source.geo.city_name keyword City name.
source.geo.country_iso_code keyword Country ISO code.
source.geo.country_name keyword Country name.
source.ip ip IP address of the source.
user.email keyword User email address.
user.id keyword Unique identifier of the user.
user.name keyword Short name or login of the user.
user.target.domain keyword Name of the directory the user is a member of.
user.target.email keyword User email address.
user.target.id keyword Unique identifier of the user.
user.target.name keyword Short name or login of the user.
user_agent.name keyword Name of the user agent.

For more information on the Intake Format, please find the code of the Parser, Smart Descriptions, and Supported Events here.

Further readings