CyberArk EPM
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Connector ID | CyberArkEPMCCPDefinition |
| Publisher | CyberArk |
| Used in Solutions | CyberArkEPM |
| Collection Method | CCF |
| Connector Definition Files | mainTemplate.json |
| Ingestion API | Log Ingestion API — Sibling ARM template declares DCR / Log Ingestion API resources |
The CyberArk Endpoint Privilege Manager data connector enables Microsoft Sentinel to ingest security event logs and other events from CyberArk EPM via REST API.
Permissions
Resource Provider Permissions:
- Workspace (Workspace): Read and Write permissions are required.
Custom Permissions:
- CyberArk EPM Platform: Access to perform required configurations in CyberArk EPM platform
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Connect to CyberArk EPM API to start collecting event logs in Microsoft Sentinel
Follow the configuration steps here to integrate Microsoft Sentinel with CyberArk EPM and enable centralized monitoring of endpoint events within Microsoft Sentinel.
- Web App ID: The OAuth2 server web app ApplicationID
- Region based Tenant URL: e.g. api-na.epm.cyberark.cloud
- Set ID: List of comma seperated EPM Set IDs to poll events from
- Identity Endpoint: e.g. kln9281.id.cyberark.cloud
- OAuth Configuration:
- Oauth Username
- Oauth Password
- Click 'Connect' to authenticate
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊