Skip to content

Configure the Splunk Add-on for CyberArk EPM

Use the user interface to set up CyberArk EPM credentials and optional proxy and logging levels. When you complete this task, you then configure inputs.

Set up your account

Use Splunk Web to set up your CyberArk EPM account to collect data and make it available to Splunk.

  1. In the Splunk Add-on for CyberArk EPM go to the Accounts tab.
  2. Click Add.
  3. Add a unique Account Name.
  4. Add the EPM Server URL. The URL must start with https and must not contain a path, query, or fragment.
    • For Basic Auth, use the dispatcher URL (e.g. https://login.epm.cyberark.com).
    • For OAuth2, use your specific EPM server node URL (e.g. https://naXXX.epm.cyberark.com).
  5. Select an Authentication Type:
    • Basic (Username/Password) — authenticate using a CyberArk EPM username and password.
    • OAuth2 (Client Credentials) — authenticate using an OAuth2 client credentials flow via CyberArk Identity.
  6. Complete the fields for the selected authentication type (see below).
  7. Click Add to save the new account.

Basic (Username/Password)

Field Description
Username The CyberArk EPM account username.
Password The CyberArk EPM account password.

OAuth2 (Client Credentials)

OAuth2 authentication uses the client_credentials grant flow. The add-on obtains a JWT access token from CyberArk Identity and caches it for the duration of its validity (up to 12 hours). The token is automatically refreshed when it expires.

Field Description
Client ID The service user login name configured in CyberArk Identity for this OAuth2 application.
Client Secret The service user password configured in CyberArk Identity for this OAuth2 application.
Identity Tenant URL The base URL of your CyberArk Identity tenant — hostname only, no path (e.g. https://axXXX.id.cyberark.cloud).
OAuth2 App Alias The web application alias configured in CyberArk Identity Administration for this OAuth2 app (e.g. MyEPMApp).

Note

When using OAuth2 authentication, the EPM Server URL must be the URL of your specific EPM server node — not the dispatcher URL. The add-on uses this URL directly for all API calls. Use the hostname-only format with no path (e.g. https://naXXX.epm.cyberark.com).

The add-on does not force an EPM REST API version in supported API URLs. The EPM server automatically uses its latest available API version, as recommended by CyberArk.

Set up Proxy and Logging level

If you are using a proxy, you must set up your proxy and logging levels.

  1. Check Enable Proxy.
  2. Specify the Host, Port, Username, and Password values.
  3. Check DNS resolution to perform DNS resolution through your proxy.
  4. Select your proxy type in the Proxy Type field.
  5. Optionally select a different Logging level.
  6. Click Save.