Skip to main content

CyberArk EPM

Visualize CyberArk EPM account, policies, devices, application groups and monitor changes through queries and alerts.

Installation​

The CyberArk EPM integration supports two authentication methods, which you choose when you create the instance in JupiterOne:

  • Session Token — a CyberArk EPM user that signs in directly to EPM.
  • CyberArk Identity Service User — an OAuth service user managed in CyberArk Identity, authenticating through your Identity tenant.

Both methods only read data, so the user you create should have read-only access. The EPM web services documentation recommends a dedicated user with read-only permissions for API integrations. For set-level data (sets, endpoints, and policies), read-only access is granted by assigning the user an EPM role that combines the predefined View only permission group with the relevant sets. Only an account administrator can create users and assign roles.

info

See the CyberArk documentation on EPM web services and role-based access control for more detail on users, roles, and permissions.

Create a Session Token user​

Use this method for a user defined directly in EPM. Users who sign in through CyberArk Identity or SAML SSO cannot use this method; use the CyberArk Identity Service User method instead.

  1. Log in to your CyberArk EPM console. Login
  2. Click the Administration tile. Administration
  3. Navigate to Users and add a user, completing the credential and permission details. Create User Permissions
  4. Assign the user a role that combines the View only permission group with the sets you want to ingest.

You will use this user's username and password, together with your regional dispatcher server, to configure the integration.

Create a CyberArk Identity Service User​

Use this method to authenticate through CyberArk Identity with an OAuth service user.

  1. In Identity Administration, navigate to Manage > Inventory > Users and add a user. Set a login in the form <user>@<tenant-domain> and a password, and select Is OAuth confidential client, Is Service User, and Password never expires.
  2. Add that service user as a member of the EPM role that carries the required view-only EPM permissions for the sets, policies, and endpoints you want to ingest.
  3. In Identity Administration, navigate to Manage > Inventory > Targets > Applications and add an application. Search for EPM, add the EPM API Client web app, and save its settings.
  4. In the web app, open the Tokens tab and set a token lifetime. Then open the Permissions tab and add the service user. Confirm the app status is Deployed.
  5. Find your tenant sub-domain and the app alias (Application ID) in Identity Administration under your user name > About.
info

See Set up API authentication for EPM REST APIs using ISPSS for the full procedure.

Configuration in JupiterOne​

To install the CyberArk EPM integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select CyberArk EPM. Click New Instance to begin configuring your integration, then choose the authentication method you set up above.

Session Token​

Creating an instance with the Session Token method requires the following:

  • CyberArk EPM Dispatcher Server URL — the dispatcher server for your region, for example login.epm.cyberark.com (US) or eu.epm.cyberark.com (Germany). You can paste the URL you use to open the EPM console and JupiterOne will use its host.
  • CyberArk EPM Username — the username of the EPM user you created.
  • CyberArk EPM Password — the password of that EPM user.

CyberArk Identity Service User​

Creating an instance with the CyberArk Identity Service User method requires the following:

  • CyberArk EPM Server — your EPM server: the host of the URL you use to open the EPM console, for example na101.epm.cyberark.com. This is not the regional dispatcher server (login.epm.cyberark.com).
  • CyberArk Identity Tenant URL — your CyberArk Identity tenant, for example abc1234.id.cyberark.cloud. Identity Administration shows it under your user name

    About.

  • EPM API Client Application ID — the Application ID of the custom EPM API Client web app you added in Identity Administration (Manage > Inventory > Targets > Applications).
  • Service User — the Identity service user's login, <user>@<tenant-domain>. It must be marked Is OAuth confidential client and Is Service User, be a member of an EPM role with view access to sets, policies, and endpoints, and be listed on the web app's Permissions tab.
  • Service User Password — the password of that service user.

Click Create once all values are provided to finalize the integration.

Advanced Configuration​

FieldDescriptionDefault
Disable TLS VerificationWhen enabled, skips TLS certificate verification when connecting to the EPM server. Not recommended; install valid TLS certificates instead.Disabled

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.