What is CyberArk PAM? #
CyberArk’s Privileged Access Manager is a full life-cycle solution for managing the most privileged accounts and SSH Keys in the enterprise. It enables organizations to secure, provision, manage, control and monitor all activities associated with all types of privileged identities.
Why Should You Use the CyberArk PAM Connector? #
The CyberArk PAM connector provides visibility into the user in your environment. You can use this visibility to:
- ensure user are managed per your security policies
- derive relationships between assets, users, applications, and data
How Does This Connector Work? #
Lucidum executes read-only requests to the CyberArk PAM REST API and ingests only meta-data about CyberArk PAM users.
Configuring the Connector in Lucidum #
| Field | Description | Example |
|---|---|---|
| Profile Name | Name of this profile for the connector | production servers |
| URL | The URL for the CyberArk PAM API. | https://<PVWA_Server_address>/PasswordVault/API/ |
| Username | A user account for Meridian to use to connect to the Vault. The account requires the following permissions:
| meridian_api |
| Password | Password for the user account for the Vault | Purple@Elephant#Dances$92 |
Source Documentation #
Creating Credentials #
For details on creating an account in CyberArk PAM:
For Authentication source, select CyberArk.
Required Permissions #
The CyberArk PAM user must have the following permissions:
- Interface Authorization: PVWA must not be included in entries for unAuthorizedInterfaces.
- Vault Authorization: Audit Users
- Safe Authorization: View Safe Members
- Safe Authorization: List Accounts
For details on defining permissions for a user, see:
- Interface Authorization: PVWA. https://docs.cyberark.com/pam-self-hosted/latest/en/content/pasimp/users-groups-managing-overview.htm?Highlight=user%20permissions#UniqueinterfaceIDs
- Vault Authorization: Audit Users. https://docs.cyberark.com/pam-self-hosted/latest/en/content/pasimp/users-groups-add-users-pa.htm?Highlight=%22Audit%20Users%22#AddausertotheVault
- Safe Authorization: View Safe Members and Safe Authorization: List Accounts. https://docs.cyberark.com/pam-self-hosted/latest/en/content/pasimp/safes-manage-safe-members.htm?Highlight=manage%20safe%20members#EditSafememberpermissionsinmodernandclassicinterfaces
API Documentation #
API v2
