BeyondTrust PM Cloud

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Connectors Index

| Attribute | Value | |:----------|:------| | Connector ID | BeyondTrustPMCloud | | Publisher | BeyondTrust | | Used in Solutions | BeyondTrustPMCloud | | Collection Method | Azure Function | | Connector Definition Files | BeyondTrustPMCloud_API_FunctionApp.json | | Ingestion API | Log Ingestion API|HTTP Data Collector API — Sibling ARM template declares DCR / Log Ingestion API resources|Connector definition requires workspace key (SharedKey pattern) | | Microsoft Learn | View on Learn |

The BeyondTrust Privilege Management Cloud data connector provides the capability to ingest activity audit logs and client event logs from BeyondTrust PM Cloud into Microsoft Sentinel.

This connector uses Azure Functions to pull data from the BeyondTrust PM Cloud API and ingest it into custom Log Analytics tables.

Tables Ingested

This connector ingests data into the following tables:

Table Transformations Ingestion API Lake-Only
BeyondTrustPM_ActivityAudits_CL ✓ ✓ ✓
BeyondTrustPM_ClientEvents_CL ✓ ✓ ✓

💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.

Permissions

Resource Provider Permissions:

Custom Permissions:

Setup Instructions

⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.

NOTE: This connector uses Azure Functions to connect to the BeyondTrust PM Cloud API to pull logs into Microsoft Sentinel. This might result in additional data ingestion costs. Check the Azure Functions pricing page for details.

NOTE: This connector uses the OAuth 2.0 client credentials flow to authenticate with the BeyondTrust PM Cloud API.

1. STEP 1 - Obtain BeyondTrust PM Cloud API credentials

Create an API Account in your BeyondTrust PM Cloud instance with OAuth API credentials (Client ID and Client Secret). The API account requires the following permissions:

2. STEP 2 - Deploy the connector and the associated Azure Function

Use this method for automated deployment of the BeyondTrust PM Cloud data connector using an ARM Template.

  1. Click the Deploy to Azure button below.

    Deploy To Azure

  2. Select the preferred Subscription, Resource Group (must contain your Log Analytics workspace), and Location.

  3. Enter the required parameters:

    • Workspace Name: Name of your Log Analytics workspace (e.g., beyondtrust-pmcloud)
    • BeyondTrust PM Cloud Base URL: Your tenant URL (e.g., https://yourcompany.beyondtrustcloud.com)
    • BeyondTrust Client ID: OAuth Client ID from Step 1
    • BeyondTrust Client Secret: OAuth Client Secret from Step 1
    • Activity Audits Polling Interval: How often to collect Activity Audits (default: 15 minutes)
    • Client Events Polling Interval: How often to collect Client Events (default: 5 minutes)
    • Log Level: Logging level for troubleshooting (default: Information)
    • Historical Data Timeframe: How far back to collect data on first run (default: 1 day)

  4. Review advanced settings (Hosting Plan SKU, Storage Account Type) and adjust if needed.

  5. Mark the checkbox labeled I agree to the terms and conditions stated above.

  6. Click Purchase to deploy.

  7. The deployment creates all required resources: Function App, Storage Account, Data Collection Endpoint, Data Collection Rules, and custom Log Analytics tables.

  8. Data should begin flowing within 15-30 minutes of deployment.

Additional Documentation

📄 Source: [BeyondTrustPMCloud\Data Connectors\README.md](https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/BeyondTrustPMCloud\Data Connectors\README.md)

BeyondTrust Privilege Management Cloud Data Connector for Microsoft Sentinel

This data connector ingests security events and administrative activity from BeyondTrust Privilege Management Cloud into Microsoft Sentinel using REST API polling with Azure Functions.

📝 Note About Placeholders: Throughout this documentation, you'll see placeholders that you need to replace with your actual values:

Overview

The BeyondTrust PM Cloud Data Connector retrieves data from two primary API endpoints:

  1. Activity Audits (/v3/ActivityAudits/Details) - Administrative and configuration activities
  2. Client Events (/v3/Events/FromStartDate) - Endpoint security events in ECS format

The connector uses OAuth 2.0 client credentials flow for authentication and implements rate limiting to comply with BeyondTrust API limits (1000 requests per 100 seconds).

Data Tables

The connector creates two custom tables in your Log Analytics workspace:

Prerequisites

  1. BeyondTrust PM Cloud tenant with API access enabled
  2. OAuth Client Credentials for BeyondTrust PM Cloud Management API
  3. Azure Log Analytics workspace configured for Microsoft Sentinel (must be in the same resource group as the deployment)
  4. Azure subscription with permissions to deploy Azure Functions and Data Collection Rules

📋 Information You'll Need Before Deployment

Before starting deployment, gather these required values:

From Azure:

  1. Resource Group Name: The resource group containing your Log Analytics workspace (deployment will create resources here)
  2. Workspace Name: Your Log Analytics workspace name (not the GUID - just the name)
    • Navigate to: Azure Portal → Log Analytics workspaces → [Your workspace] → Overview
    • Copy the workspace name (e.g., beyondtrust-pmcloud)

From BeyondTrust PM Cloud:

  1. Tenant Name: Your BeyondTrust PM Cloud tenant name (e.g., if your URL is https://yourcompany.beyondtrustcloud.com, use yourcompany)
  2. OAuth Client ID: From Configuration → API Clients
  3. OAuth Client Secret: From Configuration → API Clients

Deployment

Option 1: Azure Portal (Recommended)

  1. Click the "Deploy to Azure" button below:

    Deploy to Azure

  2. Fill in the required parameters:

    • WorkspaceName: Your Azure Log Analytics workspace name (e.g., beyondtrust-pmcloud)
    • BeyondTrustTenantName: Your BeyondTrust PM Cloud tenant name (e.g., yourcompany)
    • BeyondTrustClientId: OAuth Client ID from BeyondTrust PM Cloud
    • BeyondTrustClientSecret: OAuth Client Secret from BeyondTrust PM Cloud
    • ActivityAuditsPollingIntervalMinutes: Polling interval for Activity Audits (default: 15)
    • ClientEventsPollingIntervalMinutes: Polling interval for Client Events (default: 5)
    • HistoricalDataTimeframe: How far back to retrieve events on first run (default: 1d)
      • Format: number followed by 'd' (days), 'h' (hours), or 'm' (minutes)
      • Examples: '7d' (7 days), '12h' (12 hours), '30m' (30 minutes)
      • Use '0' to start from current time (no historical data)

  3. Click "Review + create" and then "Create"

Note: The deployment automatically creates the custom tables (BeyondTrustPM_ActivityAudits_CL and BeyondTrustPM_ClientEvents_CL) and Data Collection Rules (DCRs) for log ingestion. No pre-deployment scripts are required.

Option 2: Azure CLI

# Create resource group
az group create --name "rg-beyondtrust-pmcloud" --location "East US"

# Deploy the template
az deployment group create `
  --resource-group "rg-beyondtrust-pmcloud" `
  --template-file "azuredeploy_BeyondTrustPMCloud_API_FunctionApp.json" `
  --parameters `
    WorkspaceName="your-workspace-name" `
    BeyondTrustTenantName="yourcompany" `
    BeyondTrustClientId="your-client-id" `
    BeyondTrustClientSecret="your-client-secret" `
    HistoricalDataTimeframe="1d"

Configuration

BeyondTrust PM Cloud Setup

  1. Create API Client:

    • Log into your BeyondTrust PM Cloud management console
    • Navigate to Configuration > API Clients
    • Create a new API client with the required permissions for Activity Audits and Events
    • Note the Client ID and Client Secret

  2. Required API Permissions:

    • urn:management:api scope
    • Access to /v3/ActivityAudits/Details endpoint
    • Access to /v3/Events/FromStartDate endpoint

Polling Intervals

Important: Consider the API rate limits when setting polling intervals:

Customizing Polling Intervals

You can adjust polling intervals in the Azure Function App settings:

Historical Data Timeframe

When the connector runs for the first time (or when state is reset), it retrieves historical events based on the HistoricalDataTimeframe parameter:

Note: After the initial run, the connector tracks state and only retrieves new events since the last successful run.

You can adjust this setting in the Azure Function App settings:

BeyondTrust PM Cloud Base URL

The connector requires your specific BeyondTrust PM Cloud base URL. For example:

The connector will automatically:

  1. Add -services to the subdomain (e.g., yourcompany-services.beyondtrustcloud.com)
  2. Append the appropriate API paths (/management-api and /oauth/connect/token)
  3. Handle trailing slashes appropriately

Note: If your URL already contains -services, the connector will not add it again.

Data Schema

BeyondTrustPM_ActivityAudits_CL

The Activity Audits table captures administrative and configuration changes in BeyondTrust PM Cloud with comprehensive audit details.

Core Fields:

Field Type Description
TimeGenerated datetime Log Analytics ingestion timestamp
id int Unique audit record ID
details string Description of the activity
userId int Numeric user ID
user string User who performed the action
entity string Type of entity modified
entityName string Name of the entity
auditType string Type of audit action
created datetime When the activity occurred
changedBy string Source of the change
timeTransmitted datetime When transmitted to Azure

Audit Detail Fields (dynamic type for complex nested data):

Note: Total ~40 columns. Dynamic fields contain detailed JSON objects with before/after state for configuration changes.

BeyondTrustPM_ClientEvents_CL

The Client Events table captures endpoint security events in Elastic Common Schema (ECS) format with comprehensive context.

Event Fields:

Field Type Description
TimeGenerated datetime Log Analytics ingestion timestamp
eventId string Unique event identifier
eventCode string Event type code
eventKind string Event kind (event, alert, etc.)
eventCategory string Event category
eventAction string Action performed
eventOutcome string Success/failure outcome
eventType string Event type classification
eventProvider string Event source provider
eventIngested datetime When event was ingested
eventReason string Reason for the event

Host Fields:

Field Type Description
hostHostname string Source hostname
hostName string Host name
hostId string Unique host identifier
hostIp string Host IP address
hostArchitecture string System architecture
hostDomain string Domain name
hostOsType string OS type (Windows, Linux, etc.)
hostOsPlatform string OS platform
hostOsName string OS name
hostOsVersion string OS version

User & Identity Fields:

Field Type Description
userId string User identifier
userName string Username
userDomain string User domain

File Fields:

Field Type Description
fileName string File name
filePath string Full file path
fileHashMd5 string MD5 hash
fileHashSha1 string SHA1 hash
fileHashSha256 string SHA256 hash

Process Fields:

Field Type Description
processPid int Process ID
processExecutable string Process executable path
processCommandLine string Command line arguments

EPM-Specific Fields:

Field Type Description
epmSchemaVersion string EPM schema version
epmGroupId int EPM group ID
epmTenantId int EPM tenant ID
epmEventAction string EPM-specific action
epmEventType string EPM-specific event type

Additional Fields:

Field Type Description
ecsVersion string ECS version
tags string Event tags
timestamp datetime Original event timestamp
timeTransmitted datetime When transmitted to Azure

Complex Data Fields (dynamic type for nested JSON):

Note: Total ~50+ columns. Dynamic fields contain detailed nested objects with full context for security analysis.

Sample Queries

Activity Audits

// Recent administrative activities
BeyondTrustPM_ActivityAudits_CL
| where TimeGenerated >= ago(24h)
| project TimeGenerated, User, AuditType, Entity, EntityName, Details
| order by TimeGenerated desc

// Policy changes
BeyondTrustPM_ActivityAudits_CL
| where AuditType contains "Policy"
| project TimeGenerated, User, AuditType, EntityName, Details
| order by TimeGenerated desc

Client Events

// Blocked process executions
BeyondTrustPM_ClientEvents_CL
| where EventAction == "process-start-blocked"
| project TimeGenerated, HostHostname, UserName, FileName, FilePath, EventReason
| order by TimeGenerated desc

// Authentication events
BeyondTrustPM_ClientEvents_CL
| where EventCategory contains "authentication"
| project TimeGenerated, HostHostname, UserName, EventAction, EventOutcome
| order by TimeGenerated desc

// High-risk file executions
BeyondTrustPM_ClientEvents_CL
| where EventAction contains "process-start" and EventOutcome == "success"
| where FileName has_any ("powershell.exe", "cmd.exe", "wscript.exe", "cscript.exe")
| project TimeGenerated, HostHostname, UserName, FileName, FilePath
| order by TimeGenerated desc

📚 Documentation

Comprehensive documentation is available in the docs/ folder:

See the Documentation Index for the complete list.

Monitoring and Troubleshooting

Function App Monitoring

  1. Application Insights: The deployment creates an Application Insights instance for monitoring
  2. Function Logs: View execution logs in the Azure portal under Function App > Functions > Monitor
  3. State Management: The connector maintains state in Azure Table Storage for incremental data retrieval

For detailed information on viewing and querying logs, see Where Do Logs Go.

Common Issues

  1. Authentication Failures:

    • Verify Client ID and Client Secret are correct
    • Ensure OAuth client has proper permissions in BeyondTrust PM Cloud

  2. Rate Limiting:

    • If you see rate limit warnings, increase polling intervals
    • Monitor Application Insights for rate limit exceptions

  3. No Data Ingestion:

    • Check Function App logs for errors
    • Verify Log Analytics Workspace ID and Key
    • Ensure BeyondTrust PM Cloud has data in the specified time range

Log Levels

Set the log level in Function App settings:

Security Considerations

  1. Credentials: All sensitive configuration is stored in Azure Function App settings
  2. HTTPS: All API communications use HTTPS/TLS
  3. Minimal Permissions: OAuth client should have only required API permissions
  4. Network Security: Consider implementing network restrictions if required

Support

For issues related to:

Cost Considerations

Estimated monthly costs depend on data volume and polling frequency. Monitor usage through Azure Cost Management.

Version History

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

↑ Back to Connectors Index