CyberArk PAM

This document provides guidance on how to integrate CyberArk Privileged Access Manager (PAM) with Google Security Operations SOAR.

Integration version: 4.0

Before you begin

To configure CyberArk PAM to work with the integration you need to create a user for the integration and provide that user with the permissions to access needed CyberArk PAM vaults.

Create a user

Complete the following steps to create a user for the integration:

1. Sign in to the PrivateArk Client as an administrator.
2. Go to Tools > Administrative Tools > Users and Groups.
3. In the Users and Groups dialog, select the user location, click New, and select User.
4. In the different tabs of the New User dialog, fill in the information as needed. The General and the Authentication tabs are mandatory.

For more information about creating a user, see Add a user to a Vault.

Grant permissions to the created user

Complete the following steps to add access to a vault to a newly created user:

1. Sign in to the PrivateArk Client as an administrator.
2. Select the vault you want to provide access to and sign in to it (double-click it).
3. From the top menu, click Owners.
4. To add a new user, click Add.
5. In the dialog, select the user.
6. In the Authorized to section, select at least the following permissions:
   • Monitor Safe
   • Retrieve files from Safe
   • Store files in Safe
   • Admisiter Safe
7. To save changes, click OK.
8. To exit the dialog window, click Close.

Optional: Configure client certificate

You can use existing or make a new client certificate for secure communications between the CyberArk PAM instance and Google SecOps SOAR. For more information about how to configure the client certificate, see Central Credential Provider web service configuration.

Integrate CyberArk PAM and Google SecOps

The integration requires the following parameters:

For more information about how to configure the integration in Google SecOps SOAR, see Configure integrations.

Actions

The CyberArk PAM integration includes the following actions:

• Get Account Password Value
• List Accounts
• Ping

Get Account Password Value

Use the Get Account Password Value action to get the account password value from CyberArk.

With this action, you can retrieve both the password and SSH key.

This action doesn't run on Google SecOps entities.

Action inputs

The Get Account Password Value action requires the following parameters:

Action outputs

The Get Account Password Value action provides the following outputs:

JSON result

The following example describes the JSON result output received when using the Get Account Password Value action:

{
 "content": "PASSWORD_VALUE"
}

Output messages

The Get Account Password Value action provides the following output messages:

Script result

The following table describes the values for the script result output when using the Get Account Password Value action:

List Accounts

Use the List Accounts action to list accounts available in CyberArk PAM based on the criteria provided.

This action doesn't run on Google SecOps SOAR entities.

Action inputs

The List Accounts action requires the following parameters:

Action outputs

The List Accounts action provides the following outputs:

Case wall Table

On a Case Wall, the List Accounts action provides the following table:

Table name: Available PAM Accounts

Table columns:

• ID
• Safe Name
• User Name
• Secret Type

JSON result

The following example describes the JSON result output received when using the List Accounts action:

{
   "value": [
       {
           "categoryModificationTime": 1672051160,
           "platformId": "WinDomain",
           "safeName": "UserTestSafe",
           "id": "33_3",
           "name": "user@example.com",
           "address": "user@example.com",
           "userName": "user",
           "secretType": "password",
           "platformAccountProperties": {},
           "secretManagement": {
               "automaticManagementEnabled": true,
               "lastModifiedTime": 1672051160
           },
           "createdTime": 1672051160
       }
   ],
   "count": 1
}

Output messages

The List Accounts action provides the following output messages:

Script result

The following table describes the values for the script result output when using the List Accounts action:

Ping

Use the *Ping action to test connectivity to CyberArk.

This action doesn't run on Google SecOps entities.

Integration inputs

None.

Action outputs

The Ping action provides the following outputs:

Output messages

The Ping action provides the following output messages:

Script result

The following table describes the values for the script result output when using the Ping action: