CyberArk – Splunk Integration Repository

This repository contains documentation on integrating CyberArk with Splunk using an Ubuntu server as an intermediate Syslog server.
The guide explains why SIEM integration is important, how to configure CyberArk to forward logs, and how to ingest them into Splunk.

---

Why Integrate CyberArk with SIEM?

CyberArk is a Privileged Access Management (PAM) solution that protects sensitive credentials, privileged sessions, and accounts.
Integrating it with a SIEM solution like Splunk enables:

• Centralized monitoring of privileged activity.
• Real-time detection of suspicious behavior.
• Automated alerting and incident response.
• Compliance with security and audit requirements.

---

Integration Workflow

Step 1: Prepare the Environment

• Assign a static IP to the Windows 11 CyberArk server.
• Deploy an Ubuntu server as a Syslog server (static IP required).
• Ensure rsyslog is installed and configured to accept logs on UDP/TCP port 514.

Step 2: Configure CyberArk to Send Syslog Logs

• Copy and modify CyberArk’s Syslog transformation file (Arcsight.sample.xsl).
• Update the DBPARM.ini configuration file to forward logs to the Ubuntu Syslog server.
• Restart the CyberArk Vault service to apply changes.

Step 3: Verify Syslog Traffic

• On Ubuntu, check /var/log/syslog or run tcpdump on port 514.
• Ensure CyberArk events are visible.

Step 4: Configure Splunk to Ingest Logs

• Add a UDP Syslog input in Splunk (Settings > Data Inputs > UDP).
• Alternatively, configure rsyslog on Ubuntu to forward logs directly to Splunk.
• Restart services and verify logs appear in Splunk search.

---

Validation

• Confirm CyberArk events are visible in Splunk.
• Troubleshoot firewall, network, or configuration issues if logs do not appear.
• Ensure DBPARM.ini points to the correct Syslog server IP and port.

---

Conclusion

This setup enables CyberArk → Ubuntu Syslog → Splunk integration.
It provides a centralized logging pipeline where privileged activity logs from CyberArk are collected and analyzed in Splunk, improving visibility, threat detection, and compliance reporting.

---

⭐ This repository is for educational and reference purposes only.