DEVICE INTEGRATION
      Back to home
      1. KNOWLEDGE BASE
      2. DEVICE INTEGRATION

      CyberArk PIM

      This article describes the steps to configure log forwarding for CyberArk Privileged Identity Management (CEF)

      1. On the PTA machine, open the default systemparm.properties file using the DEFAULTPARM command.
      2. Copy the line containing the syslog_outbound property, and exit the file.
      3. Open the local systemparm.properties file using the LOCALPARM command.
      4. Press i to edit the file.
      5. Paste the line you copied, uncomment the syslog_outbound property and edit the parameters. Use the following table as a guide.
      Parameter Description
      siem Enter the DNIF system
      format The format used to transfer the syslog records to the server where your SIEM solution is installed. Enter: CEF
      host The Host/IP address of the server where your SIEM solution is installed.
      port The port number through which the syslog records will be sent to the server where your SIEM solution is installed.
      protocol The protocol used to transfer the syslog records to the server where your SIEM solution is installed.

      Example:

      syslog_outbound=[{"siem": "DNIF", "format": "CEF", "host": "DNIF_IP_ADDRESS", "port": 514, "protocol": "TCP/UDP"}]

      1. Save the configuration file and close it.
      2. Restart PTA.

      Official Documentation