CyberArk PAM

This document provides guidance on how to integrate CyberArk Privileged Access Manager (PAM) with Google Security Operations SOAR.

Integration version: 6.0

Before you begin

To configure CyberArk PAM to work with the integration you need to create a user for the integration and provide that user with the permissions to access needed CyberArk PAM vaults.

Create a user

Complete the following steps to create a user for the integration:

1. Sign in to the PrivateArk Client as an administrator.
2. Go to Tools > Administrative Tools > Users and Groups.
3. In the Users and Groupsdialog, select the user location, click New, and select User.
4. In the different tabs of the New Userdialog, fill in the information as needed. The Generaland the Authenticationtabs are mandatory.

For more information about creating a user, see Add a user to a Vault .

Grant permissions to the created user

Complete the following steps to add access to a vault to a newly created user:

1. Sign in to the PrivateArk Client as an administrator.
2. Select the vault you want to provide access to and sign in to it (double-click it).
3. From the top menu, click Owners.
4. To add a new user, click Add.
5. In the dialog, select the user.
6. In the Authorized tosection, select at least the following permissions:
   • Monitor Safe
   • Retrieve files from Safe
   • Store files in Safe
   • Admisiter Safe
7. To save changes, click OK.
8. To exit the dialog window, click Close.

Optional: Configure client certificate

You can use existing or make a new client certificate for secure communications between the CyberArk PAM instance and Google SecOps SOAR. For more information about how to configure the client certificate, see Central Credential Provider web service configuration .

Integrate CyberArk PAM and Google SecOps

The integration requires the following parameters:

For more information about how to configure the integration in Google SecOps SOAR, see Configure integrations .

Actions

The CyberArk PAM integration includes the following actions:

• Get Account Password Value
• List Accounts
• Ping

Get Account Password Value

Use the Get Account Password Valueaction to get the account password value from CyberArk.

With this action, you can retrieve both the password and SSH key.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Account Password Valueaction requires the following parameters:

Action outputs

The Get Account Password Valueaction provides the following outputs:

JSON result

The following example describes the JSON result output received when using the Get Account Password Valueaction:

  { 
  
 "content" 
 : 
  
 " PASSWORD_VALUE 
" 
 } 
 

Output messages

The Get Account Password Valueaction provides the following output messages:

Script result

The following table describes the values for the script result output when using the Get Account Password Valueaction:

List Accounts

Use the List Accountsaction to list accounts available in CyberArk PAM based on the criteria provided.

This action doesn't run on Google SecOps SOAR entities.

Action inputs

The List Accountsaction requires the following parameters:

Action outputs

The List Accountsaction provides the following outputs:

Case wall Table

On a Case Wall, the List Accountsaction provides the following table:

Table name: Available PAM Accounts

Table columns:

• ID
• Safe Name
• User Name
• Secret Type

JSON result

The following example describes the JSON result output received when using the List Accountsaction:

  { 
  
 "value" 
 : 
  
 [ 
  
 { 
  
 "categoryModificationTime" 
 : 
  
 1672051160 
 , 
  
 "platformId" 
 : 
  
 "WinDomain" 
 , 
  
 "safeName" 
 : 
  
 "UserTestSafe" 
 , 
  
 "id" 
 : 
  
 "33_3" 
 , 
  
 "name" 
 : 
  
 "user@example.com" 
 , 
  
 "address" 
 : 
  
 "user@example.com" 
 , 
  
 "userName" 
 : 
  
 "user" 
 , 
  
 "secretType" 
 : 
  
 "password" 
 , 
  
 "platformAccountProperties" 
 : 
  
 {}, 
  
 "secretManagement" 
 : 
  
 { 
  
 "automaticManagementEnabled" 
 : 
  
 true 
 , 
  
 "lastModifiedTime" 
 : 
  
 1672051160 
  
 }, 
  
 "createdTime" 
 : 
  
 1672051160 
  
 } 
  
 ], 
  
 "count" 
 : 
  
 1 
 } 
 

Output messages

The List Accountsaction provides the following output messages:

Script result

The following table describes the values for the script result output when using the List Accountsaction:

Ping

Use the * Pingaction to test connectivity to CyberArk.

This action doesn't run on Google SecOps entities.

Integration inputs

None.

Action outputs

The Pingaction provides the following outputs:

Output messages

The Pingaction provides the following output messages:

Script result

The following table describes the values for the script result output when using the Pingaction:

Need more help? Get answers from Community members and Google SecOps professionals.