About the Splunk Add-on for CyberArk EPM¶
| Component | Description |
|---|---|
| Version | 5.0.1 |
| Splunk platform versions | 9.2, 9.3, 9.4, 10.0, 10.1, 10.2, 10.3, 10.4, 10.5, 10.6 |
| CIM | 8.6.0 |
| Platforms | Platform independent |
| Vendor Products | CyberArk Endpoint Privilege Manager v24.12.1, v25.6.1, v26.4, v26.5.0, v26.5.1, v26.6.0, v26.7.0, v26.7.1, v26.8.2 |
The Splunk Add-on for CyberArk EPM allows a Splunk software administrator to pull raw and aggregated events of Inbox Events, Policy Audit Events, Admin Audit Logs and can also collect logs related to policies, computers, and computer groups using the cloud administration APIs of CyberArk EPM. Inbox Events are comprised of events related to Application Events and Threat Detection events.
Release notes¶
For a summary of new features, fixed issues, and known issues, and for more information on release history, see Release notes for the Splunk Add-on for CyberArk EPM.
Compatibility¶
This add-on provides modular inputs and CIM-compatible knowledge to use with other Splunk apps, such as Splunk Enterprise Security and the Splunk App for PCI Compliance.
This add-on supports Python versions 3.9 through 3.13 and is not compatible with Python 2.
Source types and lookups¶
For more information about the source types for Splunk Add-on for CyberArk EPM, see Source types.
Download the add-on¶
Download the Splunk Add-on for CyberArk EPM from Splunkbase.
Install and configure the add-on¶
To install and configure the Splunk Add-on for CyberArk EPM, see Installation and configuration overview for the Splunk Add-on for CyberArk EPM.
Hardware and software requirements¶
For more information, see Hardware and software requirements.
Alerts¶
The add-on ships with built-in saved searches for detecting operational issues. For a list of available alerts and instructions on how to enable them, see Alerts.
Additional resources¶
See Troubleshooting guidelines specific for this add-on.