What is CyberArk Identity Security Platform Shared Services (ISPSS)? #
CyberArk Identity Security Platform Shared Services (ISPSS) helps organizations solve identity and access management (IAM) security challenges with minimal setup and fast time to value. Focused on privilege, ISPSS helps secure access for any user across any type of application or system, from anywhere, using any device.
Why Should You Use the CyberArk Identity Security Platform Shared Services Connectors? #
The CyberArk Identity Security Platform Shared Services (ISPSS) connector provides visibility into the users in your environment. You can use this visibility to:
- ensure users are managed per your security policies
- derive relationships between assets, users, applications, and data
How Does This Connector Work? #
Lucidum executes read-only requests to the CyberArk REST API and ingests only meta-data about devices running CyberArk Identity Security Platform Shared Services (ISPSS). Lucidum does not retrieve any data stored on your assets.
Configuring the Connector in Lucidum #
| Field | Description | Example |
|---|---|---|
| URL | URL for the CyberArk Identity Security Platform Shared Services | https://<tenant-id>.id.cyberark.cloud/where:<tenant-id> is unique to your instance of CyberArk ISPSS. For details, see https://docs.cyberark.com/setup/latest/en/content/identity/getstarted/tenant-url-domains.htm?Highlight=find%20my%20url#ThefollowinginformationisforISPSS or |
| Privilege Cloud Subdomain | The unique subdomain for your organization in Privilege Cloud. | privilegecloud.yourcompany.idira.com |
| Safe Membership Threshold | Maximum number of members in each Safe in Privilege Cloud. | Default value is 10. |
| Safe Ownership Threshold | Maximum number of owners for each Safe in Privilege Cloud. | Default value is 5. |
| Shared Owners Threshold | Maximum number of shared owners for each Safe in Privilege Cloud. | Default value is 2. |
| PasswordVault Account Inactivity Threshold | Maximum number of days since a Password Vault user has logged in. After this threshold, CyberArk generates a security alert upon login. | Default value is 90 days. |
| PasswordVault Checkout Duration Threshold | The number of hours to wait from the last retrieval of the one-time password until it is replaced. This gives the user a minimum period to be able to use the password before it is replaced. | Default value is 8 hours. |
| PasswordVault Non-Compliant Access Count Thresholds | Number of non-compliant access attempts before CyberArk locks out the account and takes protective actions. | Default value is 1. |
| Activity Lookback Days | Maximum number of days of activity data to review. | Default value is 180 days. |
| Event Lookback Days | Maximum number of days of event data to review. | Default value is 7 days. |
| Username | Login name for a dedicated API Service User with least privilege access. For details, see: | JamonGordon |
| Password | Password for the dedicated API Service User. For details, see:
| BigLeap1! |
Source Documentation #
Creating Credentials #
For details on creating an API Service User see:
Required Permissions #
The API service user that allows Lucidum to ingest data should have the following settings:
- Is Service User
- Is OAuth confidential client
- Has access to the Secure Infrastructre Access APIs.
Contact your Lucidum Sales Representative for help with permissions.
For details, see:
API Documentation #
https://docs.cyberark.com/EPM/Latest/en/Content/WebServices/API%20Commands.htm
