Skip to main content

CyberArk EPM

Visualize CyberArk EPM account, policies, devices, application groups and monitor changes through queries and alerts.

Installation​

The CyberArk EPM integration supports two authentication methods, which you choose when you create the instance in JupiterOne:

  • Session Token — a CyberArk EPM user that signs in directly to EPM.
  • CyberArk Identity Service User — an OAuth service user managed in CyberArk Identity, authenticating through your Identity tenant.

Both methods only read data, so the user you create should have read-only access. The EPM web services documentation recommends a dedicated user with read-only permissions for API integrations. For set-level data (sets, endpoints, and policies), read-only access is granted by assigning the user an EPM role that combines the predefined View only permission group with the relevant sets. Only an account administrator can create users and assign roles.

info

See the CyberArk documentation on EPM web services and role-based access control for more detail on users, roles, and permissions.

Create a Session Token user​

Use this method for a user defined directly in EPM. Users who sign in through CyberArk Identity or SAML SSO cannot be used here; create a user directly in EPM, or, if your EPM tenant is connected to ISPSS, use the CyberArk Identity Service User method instead.

  1. Log in to your CyberArk EPM console. Login
  2. Click the Administration tile. Administration
  3. Navigate to Users and add a user, completing the credential and permission details. Create User Permissions
  4. Assign the user a role that combines the View only permission group with the sets you want to ingest.

You will use this user's username and password, together with your regional dispatcher server, to configure the integration.

Create a CyberArk Identity Service User​

Use this method to authenticate through CyberArk Identity with an OAuth service user. It requires an EPM tenant connected to the Idira Identity Security Platform Shared Services (ISPSS), whose Identity tenant looks like abc1234.id.cyberark.cloud. Standalone Identity tenants (*.my.idaptive.app, or FedRAMP *.my.id.cyberarkgov.cloud) can't use it; use the Session Token method with a user defined directly in EPM instead, or ask CyberArk to connect your EPM tenant to ISPSS.

  1. In Identity Administration, navigate to Manage > Inventory > Users and add a user. Set a login in the form <user>@<tenant-domain> and a password, and select Is OAuth confidential client, Is Service User, and Password never expires.
  2. Add that service user as a member of the EPM role that carries the required view-only EPM permissions for the sets, policies, and endpoints you want to ingest.
  3. In Identity Administration, navigate to Manage > Inventory > Targets > Applications and add an application. Search for EPM, add the Idira EPM API Client web app. In its Settings tab, set an Application ID (the app alias used in the token URL) and save.
  4. In the web app, open the Tokens tab and set a token lifetime. Then open the Permissions tab and add the service user. Confirm the app status is Deployed.
  5. Find your Identity tenant ID in Identity Administration under your user name > About.
info

See Set up API authentication for EPM REST APIs using ISPSS for the full procedure.

Configuration in JupiterOne​

To install the CyberArk EPM integration in JupiterOne, navigate to the Integrations tab in JupiterOne and select CyberArk EPM. Click New Instance to begin configuring your integration, then choose the authentication method you set up above.

Session Token​

Creating an instance with the Session Token method requires the following:

  • CyberArk EPM Dispatcher Server URL — the dispatcher server for your region, for example login.epm.cyberark.com (US) or eu.epm.cyberark.com (Germany). You can paste the URL you use to open the EPM console and JupiterOne will use its host.
  • CyberArk EPM Username — the username of the EPM user you created.
  • CyberArk EPM Password — the password of that EPM user.

CyberArk Identity Service User​

Creating an instance with the CyberArk Identity Service User method requires the following:

  • CyberArk EPM Server — the EPM API regional subdomain for your region, for example api-na.epm.cyberark.cloud (US) or api-eu.epm.cyberark.cloud (Germany). See CyberArk's Service URLs for a specific region. The host of your EPM console URL (for example na101.epm.cyberark.com) is also accepted; Federal tenants use their naXX.epm.cyberarkgov.cloud server. This is not the regional dispatcher server (login.epm.cyberark.com).
  • CyberArk Identity Tenant URL — your CyberArk Identity tenant, for example abc1234.id.cyberark.cloud. Identity Administration shows the ID under your user name > About.
  • EPM API Client Application ID — the Application ID of the custom Idira EPM API Client web app you added in Identity Administration (Manage > Inventory > Targets > Applications).
  • Service User — the Identity service user's login, <user>@<tenant-domain>. It must be marked Is OAuth confidential client and Is Service User, be a member of an EPM role with view access to sets, policies, and endpoints, and be listed on the web app's Permissions tab.
  • Service User Password — the password of that service user.

Click Create once all values are provided to finalize the integration.

Advanced Configuration​

FieldDescriptionDefault
Disable TLS VerificationWhen enabled, skips TLS certificate verification when connecting to the EPM server. Not recommended; install valid TLS certificates instead.Disabled

Next steps​

Now that your integration instance has been configured, it will begin running on the polling interval you provided, populating data within JupiterOne. Continue on to our Instance management guide to learn more about working with and editing integration instances.