Source types

The Splunk Add-on for CyberArk EPM supports the following source types.

Source type	Event type	CIM compatibility
cyberark:epm:account:admin:audit	cyberark_epm_account_admin_audit_logs_all_changes, cyberark_epm_account_admin_audit_logs_account_changes	Change - All_Changes, Change - Account_Management
cyberark:epm:admin:audit	cyberark_epm_admin_audit_logs_all_changes, cyberark_epm_admin_audit_logs_account_changes	Change - All_Changes, Change - Account_Management
cyberark:epm:policies	N/A	N/A
cyberark:epm:computers	cyberark_epm_computers	Inventory
cyberark:epm:computer:groups	N/A	N/A
cyberark:epm:raw:events	cyberark_epm_raw_events_endpoint_process, cyberark_epm_events_ids_attack, cyberark_epm_events_malware_attack	Endpoint - Processes, Intrusion Detection, Malware Attacks
cyberark:epm:aggregated:events	cyberark_epm_events_ids_attack, cyberark_epm_events_malware_attack	Intrusion Detection, Malware Attacks
cyberark:epm:raw:policy:audit	cyberark_epm_raw_policyaudit_endpoint_process	Endpoint - Processes
cyberark:epm:aggregated:policy:audit	N/A	N/A

API Logout events for the cyberark:epm:admin:audit sourcetype use action="logoff". For the cyberark:epm:account:admin:audit sourcetype, an API Logout description alone does not map an event to Change.Account_Management; events with Feature="Account Mgmt" remain mapped. To find all Account Admin Audit API Logout events directly, use sourcetype="cyberark:epm:account:admin:audit" Description="API Logout*".