CyberArk PAM

Integration version: 3.0

Configure product permission

To configure CyberArk PAM to work with the integration you need to create a user for the integration and provide that user with the permissions to access needed CyberArk PAM vaults.

Create a user

Complete the following steps to create a user for the integration:

Log in to the PrivateArk Client as an administrator.
Go to Tools > Administrative Tools > Users and Groups.
In the Users and Groups dialog, select the Location where the user will be, and click New. Then select User.
In the different tabs of the New User dialog, fill in the information as needed. The General and the Authentication tabs are mandatory while the other tabs are optional.
- For this example, we select the User type as BasicUser on the General tab.
- Authentication method as Password on the Authentication tab.

For more information about creating a user, see Add a user to a Vault.

Grant permissions to the created user

Complete the following steps to add access to a vault to a newly created user:

Log in to the PrivateArk Client as an administrator.
Select the vault you want to provide access to and log in to it (double-click it).
From the top menu click Owners.
To add a new user click Add.
In the dialog, select the desired user and provide the following minimum permissions:

CyberArk PAM
permissions

Once the permissions are granted, the user should be able to operate with accounts stored in the vault.

Optional: Configure client certificate

It is possible to use existing or make a new client certificate for secure communications between the CyberArk PAM instance and Google SecOps SOAR. For more information about how to configure the client certificate, see Central Credential Provider web service configuration.

Configure the integration in Google SecOps SOAR

For more information about how to configure the integration in Google SecOps SOAR, see Configure integrations.

Integration configuration parameters

Use the following parameters to configure the integration:

Parameter Display Name	Type	Default Value	Is Mandatory	Description
API Root	String	https://x.x.x.x:port	Yes	Specify the API root URL.
Username	String	N/A	Yes	Specify the username to use to connect with.
Password	Password	N/A	Yes	Specify the password to use to connect with.
Verify SSL	Checkbox	Checked	Yes	If enabled, the certificate configured for the API root is validated.
CA Certificate	String	N/A	Yes	Specify the CA certificate to use to validate the secure connection to the API root. Parameter accepts the CA certificate in a form of the Base64 encoded string.
Client Certificate	String	N/A	Yes	Optional, if configured for CyberArk PAM, specify the CyberArk client certificate to use to establish connection to the API root. Certificate should be provided in the .p12 format. The parameter expects certificate as the Base64 encoded string.
Client Certificate Passphrase	Password	N/A	Yes	Optional, if the client certificate is requiring a passphrase, specify it for this parameter.

Actions

Get Account Password Value

Description

Get account password value from CyberArk PAM.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
API Root	String	https://x.x.x.x:port	Yes	Specify the API root URL.

Run on

This action doesn't run on entities.

Playbook use case example

Fetch an account password value from CyberArk PAM.

Action results

Script result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON result

{
"content": <password value>
}

Case wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: If data is available (is_success=true): "Successfully fetched password value for account id {0}".format(account_id) If data is not available (is_success=false): "Password value for account with id {account_id} and supplied version {version} was not found in the CyberArk PAM." The action should fail and stop a playbook execution: If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "{action name}". Reason: {0}''.format(error.Stacktrace)	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:

If data is available (is_success=true): "Successfully fetched password value for account id {0}".format(account_id)

If data is not available (is_success=false): "Password value for account with id {account_id} and supplied version {version} was not found in the CyberArk PAM."

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, other is reported: "Error executing action "{action name}". Reason: {0}''.format(error.Stacktrace)

General

List Accounts

Description

List accounts available in CyberArk PAM based on the provided criteria.

Parameters

Parameter Display Name	Type	Default Value	Is Mandatory	Description
Search Query	String	N/A	Yes	Specify the search query to use in the action.
Search operator	Drop-down list	contains Available values: contains startswith	Yes	Specify the search operator that the action should use to search based on the provided search query.
Max Records To Return	Integer	50	Yes	Specify the number of records to return. If nothing is provided, the action returns 50 records (API default).
Records Offset	Integer	0	Yes	Specify the offset that the action should use to return the values.
Filter Query	String	N/A	Yes	Specify the filter query that the action should use. Filter can be based on the safeName or modificationTime parameters.
Saved Filter	String	N/A	Yes	Specify the saved filter query that the action should use. This parameter takes priority over the Filter Query parameter.

Run on

This action doesn't run on entities.

Action results

Script result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

JSON result

{
   "value": [
       {
           "categoryModificationTime": 1672051160,
           "platformId": "WinDomain",
           "safeName": "UserTestSafe",
           "id": "33_3",
           "name": "Operating System-WinDomain-user@example.com-user",
           "address": "user@example.com",
           "userName": "user",
           "secretType": "password",
           "platformAccountProperties": {},
           "secretManagement": {
               "automaticManagementEnabled": true,
               "lastModifiedTime": 1672051160
           },
           "createdTime": 1672051160
       }
   ],
   "count": 1
}

Case wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: If data is available (is_success=true): "Successfully found accounts for the provided criteria in CyberArk PAM". If data is not available (is_success=false): "No accounts were found for the provided criteria in CyberArk PAM". If both the Filter Query and Saved Filter parameters are provided: "Both the Filter Query and Saved Filter parameters are provided, Saved Filter takes priority" The action should fail and stop a playbook execution: If an invalid value is provided for the Max Records to Return parameter: Error executing action "{action name}". Reason: "Invalid value was provided for "Max Records to Return": . Positive number should be provided". If an invalid value is provided for the Records Offset to Return parameter: Error executing action "{action name}". Reason: "Invalid value was provided for "Records Offset to Return": . Non-negative number should be provided". If a fatal error, like wrong credentials, no connection to the server, or other is reported: "Error executing action "{action name}". Reason: {0}''.format(error.Stacktrace)	General
Case Wall Table	Table Name: Available PAM Accounts Table Column: Id Safe Name User Name Secret Type	Entity

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:

If data is available (is_success=true): "Successfully found accounts for the provided criteria in CyberArk PAM".

If data is not available (is_success=false): "No accounts were found for the provided criteria in CyberArk PAM".

If both the Filter Query and Saved Filter parameters are provided: "Both the Filter Query and Saved Filter parameters are provided, Saved Filter takes priority"

The action should fail and stop a playbook execution:

If an invalid value is provided for the Max Records to Return parameter: Error executing action "{action name}". Reason: "Invalid value was provided for "Max Records to Return": . Positive number should be provided".

If an invalid value is provided for the Records Offset to Return parameter: Error executing action "{action name}". Reason: "Invalid value was provided for "Records Offset to Return": . Non-negative number should be provided".

If a fatal error, like wrong credentials, no connection to the server, or other is reported: "Error executing action "{action name}". Reason: {0}''.format(error.Stacktrace)

General

Case Wall Table

Table Name: Available PAM Accounts

Table Column:

Id
Safe Name
User Name
Secret Type

Entity

Ping

Description

Test connectivity to the CyberArk PAM installation with parameters provided at the integration configuration page in the Google Security Operations Marketplace tab.

Parameters

N/A

Run on

This action doesn't run on entities.

Action results

Script result

Script Result Name	Value Options	Example
is_success	True/False	is_success:False

Case wall

Result Type	Value / Description	Type
Output message*	The action should not fail nor stop a playbook execution: If successful: "Successfully connected to the CyberArk PAM installation with the provided connection parameters!" The action should fail and stop a playbook execution: If a critical error, like wrong credentials or lost connectivity is reported: "Failed to connect to the CyberArk PAM installation! Error is {0}".format(exception.stacktrace)	General

Result Type

Value / Description

Type

Output message*

The action should not fail nor stop a playbook execution:

If successful: "Successfully connected to the CyberArk PAM installation with the provided connection parameters!"

The action should fail and stop a playbook execution:

If a critical error, like wrong credentials or lost connectivity is reported: "Failed to connect to the CyberArk PAM installation! Error is {0}".format(exception.stacktrace)

General