receivers:
tcplog:
# Replace the below port <54525> and IP <0.0.0.0> with your specific values
listen_address: "0.0.0.0:54525"
exporters:
chronicle/chronicle_w_labels:
compression: gzip
# Adjust the creds location below according the placement of the credentials file you downloaded
creds: '{ json file for creds }'
# Replace <customer_id> below with your actual ID that you copied
customer_id: <customer_id>
endpoint: malachiteingestion-pa.googleapis.com
# You can apply ingestion labels below as preferred
ingestion_labels:
log_type: SYSLOG
namespace: Cyberark_PAM
raw_log_field: body
service:
pipelines:
logs/source0__chronicle_w_labels-0:
receivers:
- tcplog
exporters:
- chronicle/chronicle_w_labels
[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[[["\u003cp\u003eThis guide outlines how to collect CyberArk Privileged Access Manager (PAM) logs and send them to Google SecOps for analysis, using the Bindplane Agent to ingest syslog messages.\u003c/p\u003e\n"],["\u003cp\u003eThe process involves setting up Bindplane Agent on Windows or Linux, configuring it to receive syslog data, and then exporting that data to Google SecOps with the appropriate authentication and customer ID.\u003c/p\u003e\n"],["\u003cp\u003eYou will need to configure syslog export settings within the CyberArk Vault, PVWA, and PTA servers to ensure logs are sent to the specified syslog server IP and port, in either TCP or UDP protocol.\u003c/p\u003e\n"],["\u003cp\u003eThe collected CyberArk PAM log fields are mapped to a unified data model (UDM), which includes mapping specific fields to UDM properties such as \u003ccode\u003emetadata.description\u003c/code\u003e, \u003ccode\u003eadditional.fields\u003c/code\u003e, \u003ccode\u003etarget.hostname\u003c/code\u003e, and \u003ccode\u003esecurity_result.severity\u003c/code\u003e, among others.\u003c/p\u003e\n"],["\u003cp\u003eThis feature is a Pre-GA Offering and is supported in Google SecOps, but might have limited support, and the changes made could be incompatible with other versions.\u003c/p\u003e\n"]]],[],null,["# Collect CyberArk PAM logs\n=========================\n\nSupported in: \nGoogle secops [SIEM](/chronicle/docs/secops/google-secops-siem-toc)\n| **Note:** This feature is covered by [Pre-GA Offerings Terms](https://chronicle.security/legal/service-terms/) of the Google Security Operations Service Specific Terms. Pre-GA features might have limited support, and changes to pre-GA features might not be compatible with other pre-GA versions. For more information, see the [Google SecOps Technical Support Service guidelines](https://chronicle.security/legal/technical-support-services-guidelines/) and the [Google SecOps Service Specific Terms](https://chronicle.security/legal/service-terms/).\n\nThis parser code first extracts fields from CyberArk Privileged Access Manager (PAM) syslog messages using regular expressions. Then, it maps the extracted fields to a unified data model (UDM), enriching the data with additional context and standardizing the event type based on specific criteria.\n\nBefore you begin\n----------------\n\n- Ensure that you have a Google Security Operations instance.\n- Ensure that you are using Windows 2016 or later, or a Linux host with systemd.\n- If running behind a proxy, ensure firewall [ports](/chronicle/docs/ingestion/use-bindplane-agent#verify_the_firewall_configuration) are open.\n\nGet Google SecOps ingestion authentication file\n-----------------------------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Collection Agents**.\n3. Download the **Ingestion Authentication File**.\n\nGet Google SecOps customer ID\n-----------------------------\n\n1. Sign in to the Google SecOps console.\n2. Go to **SIEM Settings \\\u003e Profile**.\n3. Copy and save the **Customer ID** from the **Organization Details** section.\n\nInstall Bindplane Agent\n-----------------------\n\n1. For **Windows installation** , run the following script: \n `msiexec /i \"https://github.com/observIQ/bindplane-agent/releases/latest/download/observiq-otel-collector.msi\" /quiet`\n2. For **Linux installation** , run the following script: \n `sudo sh -c \"$(curl -fsSlL https://github.com/observiq/bindplane-agent/releases/latest/download/install_unix.sh)\" install_unix.sh`\n3. Additional installation options can be found in this [installation guide](/chronicle/docs/ingestion/use-bindplane-agent#install_the_bindplane_agent).\n\nConfigure Bindplane Agent to ingest Syslog and send to Google SecOps\n--------------------------------------------------------------------\n\n1. Access the machine where Bindplane Agent is installed.\n2. Edit the `config.yaml` file as follows:\n\n receivers:\n tcplog:\n # Replace the below port \u003c54525\u003e and IP \u003c0.0.0.0\u003e with your specific values\n listen_address: \"0.0.0.0:54525\" \n\n exporters:\n chronicle/chronicle_w_labels:\n compression: gzip\n # Adjust the creds location below according the placement of the credentials file you downloaded\n creds: '{ json file for creds }'\n # Replace \u003ccustomer_id\u003e below with your actual ID that you copied\n customer_id: \u003ccustomer_id\u003e\n endpoint: malachiteingestion-pa.googleapis.com\n # You can apply ingestion labels below as preferred\n ingestion_labels:\n log_type: SYSLOG\n namespace: Cyberark_PAM\n raw_log_field: body\n service:\n pipelines:\n logs/source0__chronicle_w_labels-0:\n receivers:\n - tcplog\n exporters:\n - chronicle/chronicle_w_labels\n\n3. Restart the Bindplane Agent to apply the changes:\n\n sudo systemctl restart bindplane\n\nConfigure Syslog Export for CyberArk Vault\n------------------------------------------\n\n1. Log in to the Vault server.\n2. Open the configuration file `dbparm.ini`, located at: `C:\\Program Files (x86)\\CyberArk\\Vault\\Server\\dbparm.ini`.\n3. Add or modify the following parameters:\n\n SyslogServer=\u003csyslog_server_ip\u003e\n SyslogPort=\u003csyslog_server_port\u003e\n SyslogProtocol=\u003cTCP or UDP\u003e\n SyslogFormat=Syslog\n\n4. Save the `dbparm.ini` file.\n\n5. Restart the Vault Server:\n\n net stop CyberArkVault\n net start CyberArkVault\n\nConfigure Syslog Export in PVWA\n-------------------------------\n\n1. Log in to the PVWA Server.\n2. Open the `Web.config` file, located at: `C:\\inetpub\\wwwroot\\PasswordVault\\`\n3. Add or modify the following keys:\n\n \u003cadd key=\"SyslogServer\" value=\"\u003csyslog_server_ip\u003e\" /\u003e\n \u003cadd key=\"SyslogPort\" value=\"\u003csyslog_server_port\u003e\" /\u003e\n \u003cadd key=\"SyslogProtocol\" value=\"\u003cTCP or UDP\u003e\" /\u003e\n \u003cadd key=\"SyslogFormat\" value=\"Syslog\" /\u003e\n\n4. Save the changes to the `Web.config` file.\n\n5. Restart the IIS service:\n\n iisreset\n\nConfigure Syslog Export in PTA\n------------------------------\n\n1. Access the PTA server using SSH.\n2. Open the `application.properties` file, located at: `/opt/cta/config/application.properties`\n3. Add or modify the following lines:\n\n syslog.server.ip=\u003csyslog_server_ip\u003e\n syslog.server.port=\u003csyslog_server_port\u003e\n syslog.protocol=\u003cTCP or UDP\u003e\n\n4. Save the `application.properties` file.\n\n5. Restart the PTA service to apply the changes:\n\n sudo service pta restart\n\nUDM Mapping Table\n-----------------\n\n**Need more help?** [Get answers from Community members and Google SecOps professionals.](https://security.googlecloudcommunity.com/google-security-operations-2)"]]
