Follow these instructions to configure CyberArk Vault to send logs to the Comm Broker.
Copy the
Arcsight.sampleXSL translator file from the Syslog subfolder of the CyberArk Server installation folder (PrivateArk\Server\syslog).Rename the copied file to
Helix.xsland use the specified file name and path in the SyslogTranslatorFile parameter inDBParm.ini.In
DBParm.ini, configure the following parameters:SyslogServerIP: The IP address(es) of the Comm Broker where messages will be sent. Specify multiple values with commas.
SyslogServerProtocol: – Specifies the Comm Broker protocol that will be used to send audit logs. Specify either TCP or UDP. The default value is UDP.
SyslogServerPort: The port used to connect to the Comm Broker server. The default value is 514.
SyslogMessageCodeFilter: Defines which message codes will be sent from the Vault to the Trellix Helix application through Comm Broker protocol. You can specify message numbers and/or ranges of numbers, separated by commas. For example, to specify messages 1,2,3,30 and 5-10, specify the following value: 1,2,3,5-10,30. Specify multiple values with pipelines. For a list of messages and codes, refer to the CyberArk Privileged Account Security Reference Guide.
SyslogTranslatorFile: Specifies the XSL file used to parse CyberArk audit records data into Comm Broker protocol. Specify multiple values with commas.
The following example shows a set of properties that will send a single message to multiple syslog servers:
SysLogServerIP=192.168.1.1,192.168.2.2 SysLogTranslatorFile=Syslog\Helix.xsl SyslogMessageCodeFilter=4,7,8,295
Restart the Vault Server.
This table displays a list of important events. For a complete list of events and action codes available, refer to the CyberArk Privileged Account Security Reference Guide.
Action Code | Description |
|---|---|
7 | User Authentication Logon |
8 | User Authentication Logoff |
4 | User Authentication Failed |
22 | CPM Verify Password |
24 | CPM Change Password |
31 | CPM Reconcile Password |
38 | CPM Verify Password Failed |
57 | CPM Change Password Failed |
60 | CPM Reconcile Password Failed |
130 | CPM Disable Password |
295 | Retrieve Password succeeded |
300 | PSM Connect |
302 | PSM Disconnect |
308 | Use Password |
344 | Privileged Command Initiated |
346 | Privileged Command Completed |
361 | PSM Command and SSH Command |
378 | PSM Secure Connect Session Start |
380 | PSM Secure Connect Session End |
411 | Window Title |