Configure inputs¶
Breaking change in v5.0.0
The Application Events, Policy Audit, and Threat Detection inputs were removed in v5.0.0. The underlying CyberArk EPM API endpoints were removed by CyberArk in EPM v24.12.x. If you are upgrading from an earlier version, migrate your existing inputs before upgrading:
| Removed input | Replacement input | Replacement API type |
|---|---|---|
| Application Events | Inbox Events | Aggregated Events |
| Threat Detection | Inbox Events | Aggregated Events |
| Policy Audit | Policy Audit Events | Aggregated Events |
Update any saved searches, dashboards, or alerts that reference the sourcetypes cyberark:epm:application:events, cyberark:epm:policy:audit, or cyberark:epm:threat:detection.
The following input type is new as of version 3.0.0. This input has a “Start Date” field which can be configured by the user to collect data from the desired date and time:
- Account Admin Audit Logs
The following input type is new as of version 2.1.0. This input has a “Start Date” field which can be configured by the user to collect data from the desired date and time:
- Admin Audit Logs
The following input types are new as of version 2.0.0. These inputs have a “Start Date” field which can be configured by the user to collect data from the desired date and time:
- Inbox Events
- Policy Audit Events
The Splunk Add-on for CyberArk EPM collects all events for the Policies and Computers input type.
For supported EPM REST endpoints, the add-on omits the API version so that the EPM server selects its latest available version. The dedicated Computer Groups endpoint continues to use its documented v2 path.
Configure inputs¶
You can use Splunk Web to configure these inputs.
- Go to the Inputs tab.
- Select Create New Input.
- Select an Input Type.
- Enter the details using the following input parameters tables and select the Add button.
Account Admin Audit logs¶
| Field | Description |
|---|---|
| Account (required) | The CyberArk EPM account to use to get the data in. The account should already be configured on the Configuration page. |
| Interval (required) | Data collection interval. (Default value: 300) |
| Index (required) | Index to ingest data in. |
| Start Date (optional) | Date to start the data collection from. Default value is current UTC time - 6 minutes |
Admin Audit logs¶
| Field | Description |
|---|---|
| Account (required) | The CyberArk EPM account to use to get the data in. The account should already be configured on the Configuration page. |
| Interval (required) | Data collection interval. (Default value: 300) |
| Index (required) | Index to ingest data in. |
| Start Date (optional) | Date to start the data collection from. Default value is current UTC time - 6 minutes |
| SetIDs (required) | Fetch data only for the selected Set IDs to ensure targeted and relevant event collection. Note: The SetID value will now appear in the raw events. |
Inbox events¶
| Field | Description |
|---|---|
| Account (required) | The CyberArk EPM account to use to get the data in. The account should already be configured on the Configuration page. |
| Application Type (required) | Type of application that triggers the event. Utilises “IN” filter operation in API (Default value: All, Valid application types as per the API document of CyberArk EPM: Executable, Script, MSI, MSU, ActiveX, Com, Win8App, DLL, AdminTask, URL, UserRequest, Temp, DMG, PKG, MacAdminTask, MacExecutable) |
| Publisher(optional) | A digital signature of the application that triggered the event (if applicable). Utilises “CONTAINS” filter operation in API |
| Interval (required) | Data collection interval. (Default value: 360) |
| Index (required) | Index to ingest data in. |
| Justification (optional) | Determines if the event has justification details (Valid values: NULL, NOTNULL). Utilises “IS” filter operation in API |
| Start Date (optional) | Date to start the data collection from. Default value: current UTC time - 6 minutes |
| Api Type (required) | Type of API the user wants to collect data from (Valid values: Raw Events, Aggregated Events). Raw Events API Type brings enriched data and detailed events from the EPM environment. |
| SetIDs (required) | Fetch data only for the selected Set IDs to ensure targeted and relevant event collection. Note: The SetID value will now appear in the raw events. |
Policy Audit events¶
| Field | Description |
|---|---|
| Account (required) | The CyberArk EPM account to use to get the data in. The account should already be configured on the Configuration page. |
| Application Type (required) | Type of application that triggers the event. Utilizes “IN” filter operation in API (Default value: All, Valid application types as per the API document of CyberArk EPM: Executable, Script, MSI, MSU, ActiveX, Com, Win8App, DLL, AdminTask, URL, UserRequest, Temp, DMG, PKG, MacAdminTask, MacExecutable) |
| Publisher(optional) | A digital signature of the application that triggered the event (if applicable). Uses the “CONTAINS” filter operation in the API. |
| Policy Name(optional) | Name of the policy that triggers the event. Utilizes “CONTAINS” filter operation in API |
| Interval (required) | Data collection interval. (Default value: 360) |
| Index (required) | Index to ingest data in. |
| Justification (optional) | Determines if the event has justification details (Valid values: NULL, NOTNULL). Utilises “IS” filter operation in API |
| Start Date (optional) | Date to start the data collection from. Default value: current UTC time - 6 minutes |
| Api Type (required) | Type of API the user wants to collect data from (Valid values: Raw Events, Aggregated Events). Raw Events API Type brings enriched data and detailed events from the EPM environment. |
| SetIDs (required) | Fetch data only for the selected Set IDs to ensure targeted and relevant event collection. Note: The SetID value will now appear in the raw events. |
Policies and Computers¶
Note that the Interval field cannot be modified and is fixed to 86400 seconds. It will fetch all available events on each invocation.
| Field | Description |
|---|---|
| Account (required) | The CyberArk EPM account to get the data in. The account should be configured on the Configuration page. |
| Collect Data For (required) | Collects data for selected options. Default value: Policies, Computers, or Computer Groups |
| Collect Policy Details | A checkbox to collect the Policy details. |
| Index (required) | Index to ingest data in. |
| SetIDs (required) | Fetch data only for the selected Set IDs to ensure targeted and relevant event collection. Note: The SetID value will now appear in the raw events. |