diff --git a/packages/cyberark_epm/_dev/build/docs/README.md b/packages/cyberark_epm/_dev/build/docs/README.md index 6f5cc2fd3ca..d951642fdf2 100644 --- a/packages/cyberark_epm/_dev/build/docs/README.md +++ b/packages/cyberark_epm/_dev/build/docs/README.md @@ -29,7 +29,11 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst ## Setup -### Collect data from the CyberArk EPM API +The integration supports two authentication methods against the CyberArk EPM REST API. Complete the CyberArk-side setup for the method you intend to use. + +### Option 1: EPM authentication + +This method uses the native EPM logon API with an EPM username and password. It is the default and remains supported for tenants that are not connected to the CyberArk Identity Security Platform Shared Services (ISPSS). 1. Navigate to **Administration > Account Management** and create a user. While creating the user, check the **Allow to manage Sets** option and provide **ViewOnlySetAdmin** for all the required sets. 2. Log in with the newly created user and navigate to **Administration > Account Configuration**. @@ -37,16 +41,30 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst NOTE: Set a high value for the **Timeout for inactive session** parameter to minimize multiple authentication calls. +### Option 2: CyberArk Identity authentication + +This method uses the OAuth2 client credentials flow with a CyberArk Identity service user. Use it when your EPM tenant is connected to ISPSS. For the full procedure, refer to [Set up API authentication for EPM REST APIs using Identity](https://docs.cyberark.com/epm/latest/en/content/webservices/authenticate-with-identity-administration.htm). + +1. In Identity Administration, create a service user with **Is service user** and **Is OAuth confidential client** enabled. Note its login name, for example `svc_elastic@cyberark.cloud.1234`, and its password. These are used as `[Identity] Client ID` and `[Identity] Client Secret`. +2. Add the service user as a member of an EPM role that grants the EPM API permissions required for the data streams you want to collect. +3. In Identity Administration, go to **Apps & Widgets > Web Apps**, click **Add Web Apps**, and add the **CyberArk EPM API Client** app. Configure the required fields under the **Settings** tab and note the Application ID, which is used as `[Identity] Application ID`. +4. On the **Tokens** tab of the web app, define the token expiration period. On the **Permissions** tab, add the service user. +5. Note your Identity ID: click your user name, select **About**, and copy the **ID** shown under **Identity**, for example `ACF4874`. This is used as `[Identity] Identity ID`. +6. Note your EPM server name, which is the subdomain of your EPM console URL. For example, if the console URL is `https://na101.epm.cyberark.com/management-options`, then `[Identity] EPM Server URL` is `https://na101.epm.cyberark.com`. + ### Enable the integration in Elastic 1. In Kibana navigate to **Management** > **Integrations**. 2. In the search bar, type **CyberArk EPM**. 3. Select the **CyberArk EPM** integration and add it. -4. Add all the required integration configuration parameters, including the URL, Username, Password, API Version, Session Timeout, Interval, and Initial Interval, to enable data collection. -5. Save the integration. +4. Select the **Authentication Method** and fill in the parameters prefixed with the matching label. Parameters prefixed with the other label can be left empty. + - **EPM**: `[EPM] URL`, `[EPM] Username`, `[EPM] Password` and `[EPM] Session Timeout`. + - **CyberArk Identity**: `[Identity] EPM Server URL`, `[Identity] Identity ID`, `[Identity] Application ID`, `[Identity] Client ID` and `[Identity] Client Secret`. +5. Add the remaining configuration parameters, including the Interval and Initial Interval, to enable data collection. +6. Save the integration. **Note**: - - The default URL is `https://login.epm.cyberark.com`, but this may vary depending on your region. Please refer to the [Documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm#EPMdispatcherservername) to find the correct URL for your region. + - The default `[EPM] URL` is `https://login.epm.cyberark.com`, but this may vary depending on your region. Please refer to the [Documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm#EPMdispatcherservername) to find the correct URL for your region. This URL is the EPM dispatcher server and is only used with the **EPM** authentication method; the **CyberArk Identity** method uses `[Identity] EPM Server URL` instead. - If you encounter an error indicating that the usage limit has been reached, consider lowering the "Resource Rate Limit" parameter in the advanced section. For more details, please refer to the [documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm#APIlimitations). ## Logs reference diff --git a/packages/cyberark_epm/_dev/deploy/docker/docker-compose.yml b/packages/cyberark_epm/_dev/deploy/docker/docker-compose.yml index 418a31f11bf..5d81a3f31f9 100644 --- a/packages/cyberark_epm/_dev/deploy/docker/docker-compose.yml +++ b/packages/cyberark_epm/_dev/deploy/docker/docker-compose.yml @@ -11,3 +11,25 @@ services: - http-server - --addr=:8090 - --config=/files/config.yml + cyberark_epm-oauth: + image: docker.elastic.co/observability/stream:v0.18.0 + hostname: elastic-test.id.cyberark.cloud + networks: + - elastic-package-stack_default + ports: + - 443 + volumes: + - ./files:/files:ro + environment: + PORT: '443' + command: + - http-server + - --addr=:443 + - --config=/files/config.yml + - --tls-cert=/files/shared-certificate.crt + - --tls-key=/files/shared-private.key +networks: + elastic-package-stack_default: + driver: bridge + name: elastic-package-stack_default + external: true diff --git a/packages/cyberark_epm/_dev/deploy/docker/files/config.yml b/packages/cyberark_epm/_dev/deploy/docker/files/config.yml index 827094ec2fa..78699043fd2 100644 --- a/packages/cyberark_epm/_dev/deploy/docker/files/config.yml +++ b/packages/cyberark_epm/_dev/deploy/docker/files/config.yml @@ -1,4 +1,30 @@ +# Request headers are matched as regular expressions, so the Authorization rules below +# accept either the EPM logon token or the CyberArk Identity bearer token, letting the +# same rule set serve the system tests for both authentication methods. rules: + # CyberArk Identity (ISPSS) OAuth2 client credentials token endpoint. + # + # The credentials below are percent-encoded because the oauth2 client in the CEL input + # encodes them per RFC 6749 2.3.1 before building the Basic authorization header. The + # unencoded values are 'svc_elastic@cyberark.cloud.1234' and 'p@ss"w/ord\test'. + - path: /oauth2/token/elastic_epm_api + methods: ['POST'] + user: 'svc_elastic%40cyberark.cloud.1234' + password: 'p%40ss%22w%2Ford%5Ctest' + query_params: + grant_type: client_credentials + responses: + - status_code: 200 + headers: + Content-Type: + - 'application/json' + body: |- + { + "access_token": "identity-token", + "token_type": "Bearer", + "expires_in": 900, + "scope": "epm" + } - path: /EPM/API/24.12.0.4372/Auth/EPM/Logon methods: ['POST'] request_headers: @@ -23,7 +49,7 @@ rules: Offset: 0 request_headers: Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -58,7 +84,7 @@ rules: Offset: 2 request_headers: Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -80,7 +106,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -253,7 +279,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -352,7 +378,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -376,7 +402,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -400,7 +426,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -533,7 +559,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -612,7 +638,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -636,7 +662,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -715,7 +741,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -739,7 +765,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -855,7 +881,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -879,7 +905,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -903,7 +929,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -973,7 +999,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -997,7 +1023,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -1077,7 +1103,7 @@ rules: Content-Type: - "application/json" Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -1101,7 +1127,7 @@ rules: Offset: 0 request_headers: Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -1148,7 +1174,7 @@ rules: Offset: 2 request_headers: Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -1183,7 +1209,7 @@ rules: Offset: 3 request_headers: Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: @@ -1205,7 +1231,7 @@ rules: Offset: 0 request_headers: Authorization: - - "basic token" + - '^(?:basic token|Bearer identity-token)$' responses: - status_code: 200 headers: diff --git a/packages/cyberark_epm/_dev/deploy/docker/files/shared-certificate.crt b/packages/cyberark_epm/_dev/deploy/docker/files/shared-certificate.crt new file mode 100644 index 00000000000..d7b8bb68433 --- /dev/null +++ b/packages/cyberark_epm/_dev/deploy/docker/files/shared-certificate.crt @@ -0,0 +1,21 @@ +-----BEGIN CERTIFICATE----- +MIIDXjCCAkagAwIBAgIUcW0OaLtoq+zHmATDz14hhDevv9UwDQYJKoZIhvcNAQEL +BQAwKTEnMCUGA1UEAwweZWxhc3RpYy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMB4X +DTI2MDgyMDA5MTM0OFoXDTM2MDgxNzA5MTM0OFowKTEnMCUGA1UEAwweZWxhc3Rp +Yy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A +MIIBCgKCAQEAoW2VUELB7SNGQDzS83r1DPucuKdzUbFhBA7NN3mzF7GtJ9L2dwzo +RdieV0Z0jxPi6vVcMlz8qckgQ+eZ3nX2kF5bEBU8gKhLx5BJgFAhdSwmnehJX8KT +7rkDUT/GK9I1oYyr3/w65o+VKASKcbe0/eXQo8SDQnU4/AsoHaLG91G8KAn/YarB +0j6O0XtEq3u7mUq7Vgk5jQio/akXmu07m+ILuwlAJI16zlVSefgR0dZUwWM4IjXl +/hDoZ+l8UCus7pYJiPZkuEkFdlqA+4VKsbNigSJ+Hn9v/ZGZxWD4HlJxYcX1Ndci +2Cdzy6b+SaWVp5zRblQy1wrskZ1ja53DgQIDAQABo34wfDAdBgNVHQ4EFgQUJLJ1 +RmDKq0bGvXhrNXdzJAmwCswwHwYDVR0jBBgwFoAUJLJ1RmDKq0bGvXhrNXdzJAmw +CswwDwYDVR0TAQH/BAUwAwEB/zApBgNVHREEIjAggh5lbGFzdGljLXRlc3QuaWQu +Y3liZXJhcmsuY2xvdWQwDQYJKoZIhvcNAQELBQADggEBAFAy8L239V/TsW7Hn55j +Oi44LLuv/+DgNYekciuImPy1dZWvDO7R2HBZ3uLIBP4qUE0p3MiRG1DSHxIJA516 +yOvRKPNCPr64p1lAxYka2G1AQ8fDjCQjMuoDKjXaUd0vgHxH+NJY5Z5P0huL8jgm +FeSbFuKjJTg1EeeEcr+yeQEeDwZO+Ou3dxyDe3EzdppzFedrGT2HW8It8wiroFH9 +tLvXJBG/CjEsaw0aYCP+4KBesvv6wPgnNAFX8htVsk9pomlVrh1dvMwzyZ/Z+3Gg +DhS/JdNF4gvgvF1BJyyVIldUIws5BtMWzxMtAjh5dTXx2PxJ0PO3FMTGh2TNyAam +1eM= +-----END CERTIFICATE----- diff --git a/packages/cyberark_epm/_dev/deploy/docker/files/shared-private.key b/packages/cyberark_epm/_dev/deploy/docker/files/shared-private.key new file mode 100644 index 00000000000..f0099510812 --- /dev/null +++ b/packages/cyberark_epm/_dev/deploy/docker/files/shared-private.key @@ -0,0 +1,28 @@ +-----BEGIN PRIVATE KEY----- +MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQChbZVQQsHtI0ZA +PNLzevUM+5y4p3NRsWEEDs03ebMXsa0n0vZ3DOhF2J5XRnSPE+Lq9VwyXPypySBD +55nedfaQXlsQFTyAqEvHkEmAUCF1LCad6ElfwpPuuQNRP8Yr0jWhjKvf/Drmj5Uo +BIpxt7T95dCjxINCdTj8Cygdosb3UbwoCf9hqsHSPo7Re0Sre7uZSrtWCTmNCKj9 +qRea7Tub4gu7CUAkjXrOVVJ5+BHR1lTBYzgiNeX+EOhn6XxQK6zulgmI9mS4SQV2 +WoD7hUqxs2KBIn4ef2/9kZnFYPgeUnFhxfU11yLYJ3PLpv5JpZWnnNFuVDLXCuyR +nWNrncOBAgMBAAECggEAUJ916OGGkGTDM9cM9pzM4cCSu+ip4D2qegfYd6H5D9bl +59Nl0/ymzyeKoYUnNsRUW0vS0bZ+XF/+lNuJjkE1NVJiwawRjSJAwrlt9D9RDn/Q +A6Kdbs2z65EMtpoW5BD3RymGN/Z2Bmvkr1lhOb1qEDqk0v4VHm6EWOFLlk2TeLZW +CutnIgIoedUjPVuwBZOc/BuTROY2bLtbGVwy1Eq9ie+kLRM7WfIx03NmV4ucJLqi +FOpINY5ulhwuOQGM0a+f0+Z98AqPTVCR9Y0MUy96enUj26kVLrZTU+28KOcbzK9V +Lg9sGPGU74dzR/rZI18C81MkwkH2G3EH10Bj8r7OzwKBgQC3HujZw4ADhPDGlpWT +EwvcZlh0FOU7bTSt4uOf+V96k/zpChUTYtLiovGulKYt0Pc1zDH2Wcr8NYrpXnrB +J2GiVWJHzpHd/49eLnwbxxI3z1NlkvVMcw4r59VPWMCTiFZDW3GAlJ4eH+8V6E9e +diZCc2oQFREPSTPIR96PDq2yZwKBgQDhrIjaFc5G90sHTOP4WBVAPCzKL4cBtfY7 +NZ6HJf9hxWDOu5RjlwJSFByNCelr1e1SYsLGB3Oa+fePwVOfx4JqJWYYaAsMhSEy +QkHHyxhstR3YcCthd3tu52/2e2oSsQuhs4ej6PkevWsTulWsCIompdH3lOy2Ldh+ +G8tDglw51wKBgQCduYHWDw2z+k1ov0sV4tHUhFKrqVPIW8eD/mkQ4Tnb2pt8HbMJ +f5UkoDSKqn53+AT10Ws3RSARHA0J9NbGh6UQrXp5XvNEw1o5RNChHFYUu/6Y/ntJ +3c/XAVg5f7hfWo7ydVDN7zRBvj+wHug99IX/tmkkcQDAqcxwNXb8wSfbAQKBgEVy +mwrB+yDLqUMt3lnmgWOrIP13csyL+qJt9cMRZm3oF8qG3ztmlUg8+CxPCI4u30Gj +Mt1OHb1rf0u16s4Yz4Fq0Ohh3ESWE4kr6qJZVcLeWbjpi/AKnOmcP1BS2mm2IiY4 +4V0HrOJQ2ErR5Nt0JU+PZ/YQ1meZ5C2qz/qOe2MxAoGAEddAFvuBFXP3/USMXU4S +eM+Bwi5Qu6I758ny1XiHO1+J6jXi0/hJI6KdUJkX5M3EiwgEWkhkT4gWHtF0uJeQ +VpOXEfGMIwOfvrrSeTy4hW4Gj1Jh1qjD9yrPPbRLYHtV4dqjR7aL801J7eUFVWEh +Mv5p8A0XNym6SFv6OgFcGoY= +-----END PRIVATE KEY----- diff --git a/packages/cyberark_epm/changelog.yml b/packages/cyberark_epm/changelog.yml index 93d0394f260..54d21f3e871 100644 --- a/packages/cyberark_epm/changelog.yml +++ b/packages/cyberark_epm/changelog.yml @@ -1,4 +1,9 @@ # newer versions go on top +- version: "1.7.0" + changes: + - description: Add CyberArk Identity (OAuth2) as an authentication method alongside the existing EPM logon. + type: enhancement + link: https://github.com/elastic/integrations/pull/21014 - version: "1.6.0" changes: - description: Add tags to ingest pipeline processors. diff --git a/packages/cyberark_epm/data_stream/admin_audit/_dev/test/system/test-identity-config.yml b/packages/cyberark_epm/data_stream/admin_audit/_dev/test/system/test-identity-config.yml new file mode 100644 index 00000000000..3d996fb5ae7 --- /dev/null +++ b/packages/cyberark_epm/data_stream/admin_audit/_dev/test/system/test-identity-config.yml @@ -0,0 +1,42 @@ +input: cel +service: cyberark_epm +vars: + auth_type: identity + epm_server_url: http://{{Hostname}}:{{Port}} + identity_id: elastic-test + identity_application_id: elastic_epm_api + client_id: 'svc_elastic@cyberark.cloud.1234' + client_secret: 'p@ss"w/ord\test' + ssl: | + certificate_authorities: + - | + -----BEGIN CERTIFICATE----- + MIIDXjCCAkagAwIBAgIUcW0OaLtoq+zHmATDz14hhDevv9UwDQYJKoZIhvcNAQEL + BQAwKTEnMCUGA1UEAwweZWxhc3RpYy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMB4X + DTI2MDgyMDA5MTM0OFoXDTM2MDgxNzA5MTM0OFowKTEnMCUGA1UEAwweZWxhc3Rp + Yy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAoW2VUELB7SNGQDzS83r1DPucuKdzUbFhBA7NN3mzF7GtJ9L2dwzo + RdieV0Z0jxPi6vVcMlz8qckgQ+eZ3nX2kF5bEBU8gKhLx5BJgFAhdSwmnehJX8KT + 7rkDUT/GK9I1oYyr3/w65o+VKASKcbe0/eXQo8SDQnU4/AsoHaLG91G8KAn/YarB + 0j6O0XtEq3u7mUq7Vgk5jQio/akXmu07m+ILuwlAJI16zlVSefgR0dZUwWM4IjXl + /hDoZ+l8UCus7pYJiPZkuEkFdlqA+4VKsbNigSJ+Hn9v/ZGZxWD4HlJxYcX1Ndci + 2Cdzy6b+SaWVp5zRblQy1wrskZ1ja53DgQIDAQABo34wfDAdBgNVHQ4EFgQUJLJ1 + RmDKq0bGvXhrNXdzJAmwCswwHwYDVR0jBBgwFoAUJLJ1RmDKq0bGvXhrNXdzJAmw + CswwDwYDVR0TAQH/BAUwAwEB/zApBgNVHREEIjAggh5lbGFzdGljLXRlc3QuaWQu + Y3liZXJhcmsuY2xvdWQwDQYJKoZIhvcNAQELBQADggEBAFAy8L239V/TsW7Hn55j + Oi44LLuv/+DgNYekciuImPy1dZWvDO7R2HBZ3uLIBP4qUE0p3MiRG1DSHxIJA516 + yOvRKPNCPr64p1lAxYka2G1AQ8fDjCQjMuoDKjXaUd0vgHxH+NJY5Z5P0huL8jgm + FeSbFuKjJTg1EeeEcr+yeQEeDwZO+Ou3dxyDe3EzdppzFedrGT2HW8It8wiroFH9 + tLvXJBG/CjEsaw0aYCP+4KBesvv6wPgnNAFX8htVsk9pomlVrh1dvMwzyZ/Z+3Gg + DhS/JdNF4gvgvF1BJyyVIldUIws5BtMWzxMtAjh5dTXx2PxJ0PO3FMTGh2TNyAam + 1eM= + -----END CERTIFICATE----- +data_stream: + vars: + interval: 5m + initial_interval: 24h + page_size: 2 + preserve_original_event: true + preserve_duplicate_custom_fields: true +assert: + hit_count: 3 diff --git a/packages/cyberark_epm/data_stream/admin_audit/agent/stream/cel.yml.hbs b/packages/cyberark_epm/data_stream/admin_audit/agent/stream/cel.yml.hbs index 470569b2975..068e6d9ab37 100644 --- a/packages/cyberark_epm/data_stream/admin_audit/agent/stream/cel.yml.hbs +++ b/packages/cyberark_epm/data_stream/admin_audit/agent/stream/cel.yml.hbs @@ -14,9 +14,21 @@ resource.ssl: {{ssl}} resource.timeout: {{http_client_timeout}} {{/if}} resource.url: {{url}} +{{#contains "identity" auth_type}} +auth.oauth2: + client.id: {{escape_string client_id}} + client.secret: {{escape_string client_secret}} + token_url: https://{{identity_id}}.id.cyberark.cloud/oauth2/token/{{identity_application_id}} +{{/contains}} state: +{{#contains "identity" auth_type}} + auth_type: identity + epm_server_url: {{epm_server_url}} +{{/contains}} +{{#contains "epm" auth_type}} username: {{escape_string username}} password: {{escape_string password}} +{{/contains}} initial_interval: {{initial_interval}} session_timeout: {{session_timeout}} limit: {{page_size}} @@ -36,6 +48,14 @@ program: | "expiry": state.expiry, "manager_url": state.manager_url } + : state.?auth_type.orValue("epm") == "identity" ? + // The oauth2 client attaches the bearer token to every request, so there is no + // token to fetch here and only the EPM host has to be resolved. + { + "access_token": "", + "expiry": (now() + duration(state.session_timeout)).format(time_layout.RFC3339), + "manager_url": state.epm_server_url + } : post_request( state.url.trim_right("/") + "/EPM/API/" + state.version + "/Auth/EPM/Logon", "application/json", { @@ -83,9 +103,12 @@ program: | "Limit": ["1000"] }.format_query() ).with({ - "Header":{ - "Authorization": ["basic " + string(token.access_token)], - } + "Header": state.?auth_type.orValue("epm") == "identity" ? + {} + : + { + "Authorization": ["basic " + string(token.access_token)], + } }).do_request().as(resp, resp.StatusCode == 200 ? resp.Body.decode_json().as(body, { "worklist": body.Sets.map(e, e.Id), @@ -124,9 +147,12 @@ program: | "DateTo": [token.current_time] }.format_query() ).with({ - "Header":{ - "Authorization": ["basic " + string(token.access_token)] - } + "Header": state.?auth_type.orValue("epm") == "identity" ? + {} + : + { + "Authorization": ["basic " + string(token.access_token)] + } }).do_request().as(resp, resp.StatusCode == 200 ? resp.Body.decode_json().as(body, { "events": ( diff --git a/packages/cyberark_epm/data_stream/admin_audit/manifest.yml b/packages/cyberark_epm/data_stream/admin_audit/manifest.yml index 1c6247a6972..1896e86e7ac 100644 --- a/packages/cyberark_epm/data_stream/admin_audit/manifest.yml +++ b/packages/cyberark_epm/data_stream/admin_audit/manifest.yml @@ -62,11 +62,7 @@ streams: required: false show_user: false description: >- - The request tracer logs requests and responses to the agent's local file-system for debugging configurations. - Enabling this request tracing compromises security and should only be used for debugging. Disabling the request - tracer will delete any stored traces. - See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) - for details. + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details. - name: tags type: text title: Tags diff --git a/packages/cyberark_epm/data_stream/aggregated_event/_dev/test/system/test-identity-config.yml b/packages/cyberark_epm/data_stream/aggregated_event/_dev/test/system/test-identity-config.yml new file mode 100644 index 00000000000..6a732f4c196 --- /dev/null +++ b/packages/cyberark_epm/data_stream/aggregated_event/_dev/test/system/test-identity-config.yml @@ -0,0 +1,42 @@ +input: cel +service: cyberark_epm +vars: + auth_type: identity + epm_server_url: http://{{Hostname}}:{{Port}} + identity_id: elastic-test + identity_application_id: elastic_epm_api + client_id: 'svc_elastic@cyberark.cloud.1234' + client_secret: 'p@ss"w/ord\test' + ssl: | + certificate_authorities: + - | + -----BEGIN CERTIFICATE----- + MIIDXjCCAkagAwIBAgIUcW0OaLtoq+zHmATDz14hhDevv9UwDQYJKoZIhvcNAQEL + BQAwKTEnMCUGA1UEAwweZWxhc3RpYy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMB4X + DTI2MDgyMDA5MTM0OFoXDTM2MDgxNzA5MTM0OFowKTEnMCUGA1UEAwweZWxhc3Rp + Yy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAoW2VUELB7SNGQDzS83r1DPucuKdzUbFhBA7NN3mzF7GtJ9L2dwzo + RdieV0Z0jxPi6vVcMlz8qckgQ+eZ3nX2kF5bEBU8gKhLx5BJgFAhdSwmnehJX8KT + 7rkDUT/GK9I1oYyr3/w65o+VKASKcbe0/eXQo8SDQnU4/AsoHaLG91G8KAn/YarB + 0j6O0XtEq3u7mUq7Vgk5jQio/akXmu07m+ILuwlAJI16zlVSefgR0dZUwWM4IjXl + /hDoZ+l8UCus7pYJiPZkuEkFdlqA+4VKsbNigSJ+Hn9v/ZGZxWD4HlJxYcX1Ndci + 2Cdzy6b+SaWVp5zRblQy1wrskZ1ja53DgQIDAQABo34wfDAdBgNVHQ4EFgQUJLJ1 + RmDKq0bGvXhrNXdzJAmwCswwHwYDVR0jBBgwFoAUJLJ1RmDKq0bGvXhrNXdzJAmw + CswwDwYDVR0TAQH/BAUwAwEB/zApBgNVHREEIjAggh5lbGFzdGljLXRlc3QuaWQu + Y3liZXJhcmsuY2xvdWQwDQYJKoZIhvcNAQELBQADggEBAFAy8L239V/TsW7Hn55j + Oi44LLuv/+DgNYekciuImPy1dZWvDO7R2HBZ3uLIBP4qUE0p3MiRG1DSHxIJA516 + yOvRKPNCPr64p1lAxYka2G1AQ8fDjCQjMuoDKjXaUd0vgHxH+NJY5Z5P0huL8jgm + FeSbFuKjJTg1EeeEcr+yeQEeDwZO+Ou3dxyDe3EzdppzFedrGT2HW8It8wiroFH9 + tLvXJBG/CjEsaw0aYCP+4KBesvv6wPgnNAFX8htVsk9pomlVrh1dvMwzyZ/Z+3Gg + DhS/JdNF4gvgvF1BJyyVIldUIws5BtMWzxMtAjh5dTXx2PxJ0PO3FMTGh2TNyAam + 1eM= + -----END CERTIFICATE----- +data_stream: + vars: + interval: 5m + initial_interval: 24h + page_size: 2 + preserve_original_event: true + preserve_duplicate_custom_fields: true +assert: + hit_count: 2 diff --git a/packages/cyberark_epm/data_stream/aggregated_event/agent/stream/cel.yml.hbs b/packages/cyberark_epm/data_stream/aggregated_event/agent/stream/cel.yml.hbs index 035abae23b5..02b39304cfe 100644 --- a/packages/cyberark_epm/data_stream/aggregated_event/agent/stream/cel.yml.hbs +++ b/packages/cyberark_epm/data_stream/aggregated_event/agent/stream/cel.yml.hbs @@ -14,9 +14,21 @@ resource.ssl: {{ssl}} resource.timeout: {{http_client_timeout}} {{/if}} resource.url: {{url}} +{{#contains "identity" auth_type}} +auth.oauth2: + client.id: {{escape_string client_id}} + client.secret: {{escape_string client_secret}} + token_url: https://{{identity_id}}.id.cyberark.cloud/oauth2/token/{{identity_application_id}} +{{/contains}} state: +{{#contains "identity" auth_type}} + auth_type: identity + epm_server_url: {{epm_server_url}} +{{/contains}} +{{#contains "epm" auth_type}} username: {{escape_string username}} password: {{escape_string password}} +{{/contains}} initial_interval: {{initial_interval}} session_timeout: {{session_timeout}} limit: {{page_size}} @@ -36,6 +48,14 @@ program: | "expiry": state.expiry, "manager_url": state.manager_url } + : state.?auth_type.orValue("epm") == "identity" ? + // The oauth2 client attaches the bearer token to every request, so there is no + // token to fetch here and only the EPM host has to be resolved. + { + "access_token": "", + "expiry": (now() + duration(state.session_timeout)).format(time_layout.RFC3339), + "manager_url": state.epm_server_url + } : post_request( state.url.trim_right("/") + "/EPM/API/" + state.version + "/Auth/EPM/Logon", "application/json", { @@ -83,9 +103,12 @@ program: | "Limit": ["1000"] }.format_query() ).with({ - "Header":{ - "Authorization": ["basic " + string(token.access_token)], - } + "Header": state.?auth_type.orValue("epm") == "identity" ? + {} + : + { + "Authorization": ["basic " + string(token.access_token)], + } }).do_request().as(resp, resp.StatusCode == 200 ? resp.Body.decode_json().as(body, { "worklist": body.Sets.map(e, e.Id), @@ -128,10 +151,15 @@ program: | "filter": "eventDate GE " + filter.start_time + " AND eventDate LE " + filter.end_time }.encode_json()) ).with({ - "Header":{ - "Authorization": ["basic " + string(token.access_token)], + "Header": (state.?auth_type.orValue("epm") == "identity" ? + {} + : + { + "Authorization": ["basic " + string(token.access_token)], + } + ).with({ "Content-Type": ["application/json"], - } + }) }).do_request().as(resp, resp.StatusCode == 200 ? resp.Body.decode_json().as(body, { "events": ( diff --git a/packages/cyberark_epm/data_stream/aggregated_event/manifest.yml b/packages/cyberark_epm/data_stream/aggregated_event/manifest.yml index ca3e56de7b4..26304af2516 100644 --- a/packages/cyberark_epm/data_stream/aggregated_event/manifest.yml +++ b/packages/cyberark_epm/data_stream/aggregated_event/manifest.yml @@ -62,11 +62,7 @@ streams: required: false show_user: false description: >- - The request tracer logs requests and responses to the agent's local file-system for debugging configurations. - Enabling this request tracing compromises security and should only be used for debugging. Disabling the request - tracer will delete any stored traces. - See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) - for details. + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details. - name: tags type: text title: Tags diff --git a/packages/cyberark_epm/data_stream/policyaudit_aggregated_event/_dev/test/system/test-identity-config.yml b/packages/cyberark_epm/data_stream/policyaudit_aggregated_event/_dev/test/system/test-identity-config.yml new file mode 100644 index 00000000000..6a732f4c196 --- /dev/null +++ b/packages/cyberark_epm/data_stream/policyaudit_aggregated_event/_dev/test/system/test-identity-config.yml @@ -0,0 +1,42 @@ +input: cel +service: cyberark_epm +vars: + auth_type: identity + epm_server_url: http://{{Hostname}}:{{Port}} + identity_id: elastic-test + identity_application_id: elastic_epm_api + client_id: 'svc_elastic@cyberark.cloud.1234' + client_secret: 'p@ss"w/ord\test' + ssl: | + certificate_authorities: + - | + -----BEGIN CERTIFICATE----- + MIIDXjCCAkagAwIBAgIUcW0OaLtoq+zHmATDz14hhDevv9UwDQYJKoZIhvcNAQEL + BQAwKTEnMCUGA1UEAwweZWxhc3RpYy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMB4X + DTI2MDgyMDA5MTM0OFoXDTM2MDgxNzA5MTM0OFowKTEnMCUGA1UEAwweZWxhc3Rp + Yy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAoW2VUELB7SNGQDzS83r1DPucuKdzUbFhBA7NN3mzF7GtJ9L2dwzo + RdieV0Z0jxPi6vVcMlz8qckgQ+eZ3nX2kF5bEBU8gKhLx5BJgFAhdSwmnehJX8KT + 7rkDUT/GK9I1oYyr3/w65o+VKASKcbe0/eXQo8SDQnU4/AsoHaLG91G8KAn/YarB + 0j6O0XtEq3u7mUq7Vgk5jQio/akXmu07m+ILuwlAJI16zlVSefgR0dZUwWM4IjXl + /hDoZ+l8UCus7pYJiPZkuEkFdlqA+4VKsbNigSJ+Hn9v/ZGZxWD4HlJxYcX1Ndci + 2Cdzy6b+SaWVp5zRblQy1wrskZ1ja53DgQIDAQABo34wfDAdBgNVHQ4EFgQUJLJ1 + RmDKq0bGvXhrNXdzJAmwCswwHwYDVR0jBBgwFoAUJLJ1RmDKq0bGvXhrNXdzJAmw + CswwDwYDVR0TAQH/BAUwAwEB/zApBgNVHREEIjAggh5lbGFzdGljLXRlc3QuaWQu + Y3liZXJhcmsuY2xvdWQwDQYJKoZIhvcNAQELBQADggEBAFAy8L239V/TsW7Hn55j + Oi44LLuv/+DgNYekciuImPy1dZWvDO7R2HBZ3uLIBP4qUE0p3MiRG1DSHxIJA516 + yOvRKPNCPr64p1lAxYka2G1AQ8fDjCQjMuoDKjXaUd0vgHxH+NJY5Z5P0huL8jgm + FeSbFuKjJTg1EeeEcr+yeQEeDwZO+Ou3dxyDe3EzdppzFedrGT2HW8It8wiroFH9 + tLvXJBG/CjEsaw0aYCP+4KBesvv6wPgnNAFX8htVsk9pomlVrh1dvMwzyZ/Z+3Gg + DhS/JdNF4gvgvF1BJyyVIldUIws5BtMWzxMtAjh5dTXx2PxJ0PO3FMTGh2TNyAam + 1eM= + -----END CERTIFICATE----- +data_stream: + vars: + interval: 5m + initial_interval: 24h + page_size: 2 + preserve_original_event: true + preserve_duplicate_custom_fields: true +assert: + hit_count: 2 diff --git a/packages/cyberark_epm/data_stream/policyaudit_aggregated_event/agent/stream/cel.yml.hbs b/packages/cyberark_epm/data_stream/policyaudit_aggregated_event/agent/stream/cel.yml.hbs index 7bc358f01a3..079ad4cfa2b 100644 --- a/packages/cyberark_epm/data_stream/policyaudit_aggregated_event/agent/stream/cel.yml.hbs +++ b/packages/cyberark_epm/data_stream/policyaudit_aggregated_event/agent/stream/cel.yml.hbs @@ -14,9 +14,21 @@ resource.ssl: {{ssl}} resource.timeout: {{http_client_timeout}} {{/if}} resource.url: {{url}} +{{#contains "identity" auth_type}} +auth.oauth2: + client.id: {{escape_string client_id}} + client.secret: {{escape_string client_secret}} + token_url: https://{{identity_id}}.id.cyberark.cloud/oauth2/token/{{identity_application_id}} +{{/contains}} state: +{{#contains "identity" auth_type}} + auth_type: identity + epm_server_url: {{epm_server_url}} +{{/contains}} +{{#contains "epm" auth_type}} username: {{escape_string username}} password: {{escape_string password}} +{{/contains}} initial_interval: {{initial_interval}} session_timeout: {{session_timeout}} limit: {{page_size}} @@ -36,6 +48,14 @@ program: | "expiry": state.expiry, "manager_url": state.manager_url } + : state.?auth_type.orValue("epm") == "identity" ? + // The oauth2 client attaches the bearer token to every request, so there is no + // token to fetch here and only the EPM host has to be resolved. + { + "access_token": "", + "expiry": (now() + duration(state.session_timeout)).format(time_layout.RFC3339), + "manager_url": state.epm_server_url + } : post_request( state.url.trim_right("/") + "/EPM/API/" + state.version + "/Auth/EPM/Logon", "application/json", { @@ -83,9 +103,12 @@ program: | "Limit": ["1000"] }.format_query() ).with({ - "Header":{ - "Authorization": ["basic " + string(token.access_token)], - } + "Header": state.?auth_type.orValue("epm") == "identity" ? + {} + : + { + "Authorization": ["basic " + string(token.access_token)], + } }).do_request().as(resp, resp.StatusCode == 200 ? resp.Body.decode_json().as(body, { "worklist": body.Sets.map(e, e.Id), @@ -128,10 +151,15 @@ program: | "filter": "eventDate GE " + filter.start_time + " AND eventDate LE " + filter.end_time }.encode_json()) ).with({ - "Header":{ - "Authorization": ["basic " + string(token.access_token)], + "Header": (state.?auth_type.orValue("epm") == "identity" ? + {} + : + { + "Authorization": ["basic " + string(token.access_token)], + } + ).with({ "Content-Type": ["application/json"], - } + }) }).do_request().as(resp, resp.StatusCode == 200 ? resp.Body.decode_json().as(body, { "events": ( diff --git a/packages/cyberark_epm/data_stream/policyaudit_aggregated_event/manifest.yml b/packages/cyberark_epm/data_stream/policyaudit_aggregated_event/manifest.yml index e0e0a0687e0..da9b293a9b0 100644 --- a/packages/cyberark_epm/data_stream/policyaudit_aggregated_event/manifest.yml +++ b/packages/cyberark_epm/data_stream/policyaudit_aggregated_event/manifest.yml @@ -62,11 +62,7 @@ streams: required: false show_user: false description: >- - The request tracer logs requests and responses to the agent's local file-system for debugging configurations. - Enabling this request tracing compromises security and should only be used for debugging. Disabling the request - tracer will delete any stored traces. - See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) - for details. + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details. - name: tags type: text title: Tags diff --git a/packages/cyberark_epm/data_stream/policyaudit_raw_event/_dev/test/system/test-identity-config.yml b/packages/cyberark_epm/data_stream/policyaudit_raw_event/_dev/test/system/test-identity-config.yml new file mode 100644 index 00000000000..d524aa4df02 --- /dev/null +++ b/packages/cyberark_epm/data_stream/policyaudit_raw_event/_dev/test/system/test-identity-config.yml @@ -0,0 +1,42 @@ +input: cel +service: cyberark_epm +vars: + auth_type: identity + epm_server_url: http://{{Hostname}}:{{Port}} + identity_id: elastic-test + identity_application_id: elastic_epm_api + client_id: 'svc_elastic@cyberark.cloud.1234' + client_secret: 'p@ss"w/ord\test' + ssl: | + certificate_authorities: + - | + -----BEGIN CERTIFICATE----- + MIIDXjCCAkagAwIBAgIUcW0OaLtoq+zHmATDz14hhDevv9UwDQYJKoZIhvcNAQEL + BQAwKTEnMCUGA1UEAwweZWxhc3RpYy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMB4X + DTI2MDgyMDA5MTM0OFoXDTM2MDgxNzA5MTM0OFowKTEnMCUGA1UEAwweZWxhc3Rp + Yy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAoW2VUELB7SNGQDzS83r1DPucuKdzUbFhBA7NN3mzF7GtJ9L2dwzo + RdieV0Z0jxPi6vVcMlz8qckgQ+eZ3nX2kF5bEBU8gKhLx5BJgFAhdSwmnehJX8KT + 7rkDUT/GK9I1oYyr3/w65o+VKASKcbe0/eXQo8SDQnU4/AsoHaLG91G8KAn/YarB + 0j6O0XtEq3u7mUq7Vgk5jQio/akXmu07m+ILuwlAJI16zlVSefgR0dZUwWM4IjXl + /hDoZ+l8UCus7pYJiPZkuEkFdlqA+4VKsbNigSJ+Hn9v/ZGZxWD4HlJxYcX1Ndci + 2Cdzy6b+SaWVp5zRblQy1wrskZ1ja53DgQIDAQABo34wfDAdBgNVHQ4EFgQUJLJ1 + RmDKq0bGvXhrNXdzJAmwCswwHwYDVR0jBBgwFoAUJLJ1RmDKq0bGvXhrNXdzJAmw + CswwDwYDVR0TAQH/BAUwAwEB/zApBgNVHREEIjAggh5lbGFzdGljLXRlc3QuaWQu + Y3liZXJhcmsuY2xvdWQwDQYJKoZIhvcNAQELBQADggEBAFAy8L239V/TsW7Hn55j + Oi44LLuv/+DgNYekciuImPy1dZWvDO7R2HBZ3uLIBP4qUE0p3MiRG1DSHxIJA516 + yOvRKPNCPr64p1lAxYka2G1AQ8fDjCQjMuoDKjXaUd0vgHxH+NJY5Z5P0huL8jgm + FeSbFuKjJTg1EeeEcr+yeQEeDwZO+Ou3dxyDe3EzdppzFedrGT2HW8It8wiroFH9 + tLvXJBG/CjEsaw0aYCP+4KBesvv6wPgnNAFX8htVsk9pomlVrh1dvMwzyZ/Z+3Gg + DhS/JdNF4gvgvF1BJyyVIldUIws5BtMWzxMtAjh5dTXx2PxJ0PO3FMTGh2TNyAam + 1eM= + -----END CERTIFICATE----- +data_stream: + vars: + interval: 5m + initial_interval: 24h + page_size: 2 + preserve_original_event: true + preserve_duplicate_custom_fields: true +assert: + hit_count: 4 diff --git a/packages/cyberark_epm/data_stream/policyaudit_raw_event/agent/stream/cel.yml.hbs b/packages/cyberark_epm/data_stream/policyaudit_raw_event/agent/stream/cel.yml.hbs index 132573b6d99..6b79bbf79ed 100644 --- a/packages/cyberark_epm/data_stream/policyaudit_raw_event/agent/stream/cel.yml.hbs +++ b/packages/cyberark_epm/data_stream/policyaudit_raw_event/agent/stream/cel.yml.hbs @@ -14,9 +14,21 @@ resource.ssl: {{ssl}} resource.timeout: {{http_client_timeout}} {{/if}} resource.url: {{url}} +{{#contains "identity" auth_type}} +auth.oauth2: + client.id: {{escape_string client_id}} + client.secret: {{escape_string client_secret}} + token_url: https://{{identity_id}}.id.cyberark.cloud/oauth2/token/{{identity_application_id}} +{{/contains}} state: +{{#contains "identity" auth_type}} + auth_type: identity + epm_server_url: {{epm_server_url}} +{{/contains}} +{{#contains "epm" auth_type}} username: {{escape_string username}} password: {{escape_string password}} +{{/contains}} initial_interval: {{initial_interval}} session_timeout: {{session_timeout}} limit: {{page_size}} @@ -36,6 +48,14 @@ program: | "expiry": state.expiry, "manager_url": state.manager_url } + : state.?auth_type.orValue("epm") == "identity" ? + // The oauth2 client attaches the bearer token to every request, so there is no + // token to fetch here and only the EPM host has to be resolved. + { + "access_token": "", + "expiry": (now() + duration(state.session_timeout)).format(time_layout.RFC3339), + "manager_url": state.epm_server_url + } : post_request( state.url.trim_right("/") + "/EPM/API/" + state.version + "/Auth/EPM/Logon", "application/json", { @@ -83,9 +103,12 @@ program: | "Limit": ["1000"] }.format_query() ).with({ - "Header":{ - "Authorization": ["basic " + string(token.access_token)], - } + "Header": state.?auth_type.orValue("epm") == "identity" ? + {} + : + { + "Authorization": ["basic " + string(token.access_token)], + } }).do_request().as(resp, resp.StatusCode == 200 ? resp.Body.decode_json().as(body, { "worklist": body.Sets.map(e, e.Id), @@ -128,10 +151,15 @@ program: | "filter": "eventDate GE " + filter.start_time + " AND eventDate LE " + filter.end_time }.encode_json()) ).with({ - "Header":{ - "Authorization": ["basic " + string(token.access_token)], + "Header": (state.?auth_type.orValue("epm") == "identity" ? + {} + : + { + "Authorization": ["basic " + string(token.access_token)], + } + ).with({ "Content-Type": ["application/json"], - } + }) }).do_request().as(resp, resp.StatusCode == 200 ? resp.Body.decode_json().as(body, { "events": ( diff --git a/packages/cyberark_epm/data_stream/policyaudit_raw_event/manifest.yml b/packages/cyberark_epm/data_stream/policyaudit_raw_event/manifest.yml index 37a92fcf811..e4f7b8c6a2a 100644 --- a/packages/cyberark_epm/data_stream/policyaudit_raw_event/manifest.yml +++ b/packages/cyberark_epm/data_stream/policyaudit_raw_event/manifest.yml @@ -62,11 +62,7 @@ streams: required: false show_user: false description: >- - The request tracer logs requests and responses to the agent's local file-system for debugging configurations. - Enabling this request tracing compromises security and should only be used for debugging. Disabling the request - tracer will delete any stored traces. - See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) - for details. + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details. - name: tags type: text title: Tags diff --git a/packages/cyberark_epm/data_stream/raw_event/_dev/test/system/test-identity-config.yml b/packages/cyberark_epm/data_stream/raw_event/_dev/test/system/test-identity-config.yml new file mode 100644 index 00000000000..3d996fb5ae7 --- /dev/null +++ b/packages/cyberark_epm/data_stream/raw_event/_dev/test/system/test-identity-config.yml @@ -0,0 +1,42 @@ +input: cel +service: cyberark_epm +vars: + auth_type: identity + epm_server_url: http://{{Hostname}}:{{Port}} + identity_id: elastic-test + identity_application_id: elastic_epm_api + client_id: 'svc_elastic@cyberark.cloud.1234' + client_secret: 'p@ss"w/ord\test' + ssl: | + certificate_authorities: + - | + -----BEGIN CERTIFICATE----- + MIIDXjCCAkagAwIBAgIUcW0OaLtoq+zHmATDz14hhDevv9UwDQYJKoZIhvcNAQEL + BQAwKTEnMCUGA1UEAwweZWxhc3RpYy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMB4X + DTI2MDgyMDA5MTM0OFoXDTM2MDgxNzA5MTM0OFowKTEnMCUGA1UEAwweZWxhc3Rp + Yy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A + MIIBCgKCAQEAoW2VUELB7SNGQDzS83r1DPucuKdzUbFhBA7NN3mzF7GtJ9L2dwzo + RdieV0Z0jxPi6vVcMlz8qckgQ+eZ3nX2kF5bEBU8gKhLx5BJgFAhdSwmnehJX8KT + 7rkDUT/GK9I1oYyr3/w65o+VKASKcbe0/eXQo8SDQnU4/AsoHaLG91G8KAn/YarB + 0j6O0XtEq3u7mUq7Vgk5jQio/akXmu07m+ILuwlAJI16zlVSefgR0dZUwWM4IjXl + /hDoZ+l8UCus7pYJiPZkuEkFdlqA+4VKsbNigSJ+Hn9v/ZGZxWD4HlJxYcX1Ndci + 2Cdzy6b+SaWVp5zRblQy1wrskZ1ja53DgQIDAQABo34wfDAdBgNVHQ4EFgQUJLJ1 + RmDKq0bGvXhrNXdzJAmwCswwHwYDVR0jBBgwFoAUJLJ1RmDKq0bGvXhrNXdzJAmw + CswwDwYDVR0TAQH/BAUwAwEB/zApBgNVHREEIjAggh5lbGFzdGljLXRlc3QuaWQu + Y3liZXJhcmsuY2xvdWQwDQYJKoZIhvcNAQELBQADggEBAFAy8L239V/TsW7Hn55j + Oi44LLuv/+DgNYekciuImPy1dZWvDO7R2HBZ3uLIBP4qUE0p3MiRG1DSHxIJA516 + yOvRKPNCPr64p1lAxYka2G1AQ8fDjCQjMuoDKjXaUd0vgHxH+NJY5Z5P0huL8jgm + FeSbFuKjJTg1EeeEcr+yeQEeDwZO+Ou3dxyDe3EzdppzFedrGT2HW8It8wiroFH9 + tLvXJBG/CjEsaw0aYCP+4KBesvv6wPgnNAFX8htVsk9pomlVrh1dvMwzyZ/Z+3Gg + DhS/JdNF4gvgvF1BJyyVIldUIws5BtMWzxMtAjh5dTXx2PxJ0PO3FMTGh2TNyAam + 1eM= + -----END CERTIFICATE----- +data_stream: + vars: + interval: 5m + initial_interval: 24h + page_size: 2 + preserve_original_event: true + preserve_duplicate_custom_fields: true +assert: + hit_count: 3 diff --git a/packages/cyberark_epm/data_stream/raw_event/agent/stream/cel.yml.hbs b/packages/cyberark_epm/data_stream/raw_event/agent/stream/cel.yml.hbs index dcacc20fbc2..0d36ab0eb3a 100644 --- a/packages/cyberark_epm/data_stream/raw_event/agent/stream/cel.yml.hbs +++ b/packages/cyberark_epm/data_stream/raw_event/agent/stream/cel.yml.hbs @@ -14,9 +14,21 @@ resource.ssl: {{ssl}} resource.timeout: {{http_client_timeout}} {{/if}} resource.url: {{url}} +{{#contains "identity" auth_type}} +auth.oauth2: + client.id: {{escape_string client_id}} + client.secret: {{escape_string client_secret}} + token_url: https://{{identity_id}}.id.cyberark.cloud/oauth2/token/{{identity_application_id}} +{{/contains}} state: +{{#contains "identity" auth_type}} + auth_type: identity + epm_server_url: {{epm_server_url}} +{{/contains}} +{{#contains "epm" auth_type}} username: {{escape_string username}} password: {{escape_string password}} +{{/contains}} initial_interval: {{initial_interval}} session_timeout: {{session_timeout}} limit: {{page_size}} @@ -36,6 +48,14 @@ program: | "expiry": state.expiry, "manager_url": state.manager_url } + : state.?auth_type.orValue("epm") == "identity" ? + // The oauth2 client attaches the bearer token to every request, so there is no + // token to fetch here and only the EPM host has to be resolved. + { + "access_token": "", + "expiry": (now() + duration(state.session_timeout)).format(time_layout.RFC3339), + "manager_url": state.epm_server_url + } : post_request( state.url.trim_right("/") + "/EPM/API/" + state.version + "/Auth/EPM/Logon", "application/json", { @@ -83,9 +103,12 @@ program: | "Limit": ["1000"] }.format_query() ).with({ - "Header":{ - "Authorization": ["basic " + string(token.access_token)], - } + "Header": state.?auth_type.orValue("epm") == "identity" ? + {} + : + { + "Authorization": ["basic " + string(token.access_token)], + } }).do_request().as(resp, resp.StatusCode == 200 ? resp.Body.decode_json().as(body, { "worklist": body.Sets.map(e, e.Id), @@ -128,10 +151,15 @@ program: | "filter": "eventDate GE " + filter.start_time + " AND eventDate LE " + filter.end_time }.encode_json()) ).with({ - "Header":{ - "Authorization": ["basic " + string(token.access_token)], + "Header": (state.?auth_type.orValue("epm") == "identity" ? + {} + : + { + "Authorization": ["basic " + string(token.access_token)], + } + ).with({ "Content-Type": ["application/json"], - } + }) }).do_request().as(resp, resp.StatusCode == 200 ? resp.Body.decode_json().as(body, { "events": ( diff --git a/packages/cyberark_epm/data_stream/raw_event/manifest.yml b/packages/cyberark_epm/data_stream/raw_event/manifest.yml index f5a0050d827..84a9049f868 100644 --- a/packages/cyberark_epm/data_stream/raw_event/manifest.yml +++ b/packages/cyberark_epm/data_stream/raw_event/manifest.yml @@ -62,11 +62,7 @@ streams: required: false show_user: false description: >- - The request tracer logs requests and responses to the agent's local file-system for debugging configurations. - Enabling this request tracing compromises security and should only be used for debugging. Disabling the request - tracer will delete any stored traces. - See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) - for details. + The request tracer logs requests and responses to the agent's local file-system for debugging configurations. Enabling this request tracing compromises security and should only be used for debugging. Disabling the request tracer will delete any stored traces. See [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-cel.html#_resource_tracer_enable) for details. - name: tags type: text title: Tags diff --git a/packages/cyberark_epm/docs/README.md b/packages/cyberark_epm/docs/README.md index c6fe95543dd..f990a569bdd 100644 --- a/packages/cyberark_epm/docs/README.md +++ b/packages/cyberark_epm/docs/README.md @@ -29,7 +29,11 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst ## Setup -### Collect data from the CyberArk EPM API +The integration supports two authentication methods against the CyberArk EPM REST API. Complete the CyberArk-side setup for the method you intend to use. + +### Option 1: EPM authentication + +This method uses the native EPM logon API with an EPM username and password. It is the default and remains supported for tenants that are not connected to the CyberArk Identity Security Platform Shared Services (ISPSS). 1. Navigate to **Administration > Account Management** and create a user. While creating the user, check the **Allow to manage Sets** option and provide **ViewOnlySetAdmin** for all the required sets. 2. Log in with the newly created user and navigate to **Administration > Account Configuration**. @@ -37,16 +41,30 @@ Elastic Agent must be installed. For more details, check the Elastic Agent [inst NOTE: Set a high value for the **Timeout for inactive session** parameter to minimize multiple authentication calls. +### Option 2: CyberArk Identity authentication + +This method uses the OAuth2 client credentials flow with a CyberArk Identity service user. Use it when your EPM tenant is connected to ISPSS. For the full procedure, refer to [Set up API authentication for EPM REST APIs using Identity](https://docs.cyberark.com/epm/latest/en/content/webservices/authenticate-with-identity-administration.htm). + +1. In Identity Administration, create a service user with **Is service user** and **Is OAuth confidential client** enabled. Note its login name, for example `svc_elastic@cyberark.cloud.1234`, and its password. These are used as `[Identity] Client ID` and `[Identity] Client Secret`. +2. Add the service user as a member of an EPM role that grants the EPM API permissions required for the data streams you want to collect. +3. In Identity Administration, go to **Apps & Widgets > Web Apps**, click **Add Web Apps**, and add the **CyberArk EPM API Client** app. Configure the required fields under the **Settings** tab and note the Application ID, which is used as `[Identity] Application ID`. +4. On the **Tokens** tab of the web app, define the token expiration period. On the **Permissions** tab, add the service user. +5. Note your Identity ID: click your user name, select **About**, and copy the **ID** shown under **Identity**, for example `ACF4874`. This is used as `[Identity] Identity ID`. +6. Note your EPM server name, which is the subdomain of your EPM console URL. For example, if the console URL is `https://na101.epm.cyberark.com/management-options`, then `[Identity] EPM Server URL` is `https://na101.epm.cyberark.com`. + ### Enable the integration in Elastic 1. In Kibana navigate to **Management** > **Integrations**. 2. In the search bar, type **CyberArk EPM**. 3. Select the **CyberArk EPM** integration and add it. -4. Add all the required integration configuration parameters, including the URL, Username, Password, API Version, Session Timeout, Interval, and Initial Interval, to enable data collection. -5. Save the integration. +4. Select the **Authentication Method** and fill in the parameters prefixed with the matching label. Parameters prefixed with the other label can be left empty. + - **EPM**: `[EPM] URL`, `[EPM] Username`, `[EPM] Password` and `[EPM] Session Timeout`. + - **CyberArk Identity**: `[Identity] EPM Server URL`, `[Identity] Identity ID`, `[Identity] Application ID`, `[Identity] Client ID` and `[Identity] Client Secret`. +5. Add the remaining configuration parameters, including the Interval and Initial Interval, to enable data collection. +6. Save the integration. **Note**: - - The default URL is `https://login.epm.cyberark.com`, but this may vary depending on your region. Please refer to the [Documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm#EPMdispatcherservername) to find the correct URL for your region. + - The default `[EPM] URL` is `https://login.epm.cyberark.com`, but this may vary depending on your region. Please refer to the [Documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm#EPMdispatcherservername) to find the correct URL for your region. This URL is the EPM dispatcher server and is only used with the **EPM** authentication method; the **CyberArk Identity** method uses `[Identity] EPM Server URL` instead. - If you encounter an error indicating that the usage limit has been reached, consider lowering the "Resource Rate Limit" parameter in the advanced section. For more details, please refer to the [documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm#APIlimitations). ## Logs reference diff --git a/packages/cyberark_epm/manifest.yml b/packages/cyberark_epm/manifest.yml index 5332118ca6f..40301de53eb 100644 --- a/packages/cyberark_epm/manifest.yml +++ b/packages/cyberark_epm/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.3.2 name: cyberark_epm title: CyberArk EPM -version: "1.6.0" +version: "1.7.0" description: Collect logs from CyberArk EPM with Elastic Agent. type: integration categories: @@ -47,27 +47,77 @@ policy_templates: title: Collect CyberArk EPM logs via API description: Collecting CyberArk EPM logs via API. vars: + - name: auth_type + type: select + title: Authentication Method + multi: false + required: true + show_user: true + default: epm + options: + - text: EPM + value: epm + - text: CyberArk Identity + value: identity + description: >- + How Elastic Agent authenticates to the CyberArk EPM REST API. **EPM** uses the native EPM logon API and only the `[EPM]` parameters apply. **CyberArk Identity** uses the OAuth2 client credentials flow on the CyberArk Identity Security Platform Shared Services (ISPSS) and only the `[Identity]` parameters apply. See [Set up API authentication for EPM REST APIs using Identity](https://docs.cyberark.com/epm/latest/en/content/webservices/authenticate-with-identity-administration.htm) for the CyberArk-side setup. - name: url type: url - title: URL + title: "[EPM] URL" default: https://login.epm.cyberark.com - description: CyberArk EPM dispatcher server URL varies by region. To determine the correct URL for your region, refer to the [documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm#dispatc). + description: CyberArk EPM dispatcher server URL varies by region. To determine the correct URL for your region, refer to the [documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm#dispatc). It is only used when collecting logs with the EPM authentication method. multi: false required: true show_user: false - name: username type: text - title: Username - description: The username to authenticate into EPM. + title: "[EPM] Username" + description: The username to authenticate into EPM. It is a required parameter when collecting logs with the EPM authentication method. multi: false - required: true + required: false show_user: true - name: password type: password - title: Password - description: The password to authenticate into EPM. + title: "[EPM] Password" + description: The password to authenticate into EPM. It is a required parameter when collecting logs with the EPM authentication method. multi: false - required: true + required: false + show_user: true + secret: true + - name: epm_server_url + type: url + title: "[Identity] EPM Server URL" + description: The URL of the EPM server that serves the REST API, for example `https://na101.epm.cyberark.com`. The server name is the subdomain of your EPM console URL, not the dispatcher server name. See [documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/authenticate-with-identity-administration.htm) for details. It is a required parameter when collecting logs with the CyberArk Identity authentication method. + multi: false + required: false + show_user: true + - name: identity_id + type: text + title: "[Identity] Identity ID" + description: The Identity ID of your CyberArk Identity tenant, for example `ACF4874`. To find it, open Identity Administration and click your user name and select **About**, then copy the **ID** shown under **Identity**. It is a required parameter when collecting logs with the CyberArk Identity authentication method. + multi: false + required: false + show_user: true + - name: identity_application_id + type: text + title: "[Identity] Application ID" + description: The **Application ID** on the **Settings** tab of the EPM API Client web app in Identity Administration, for example `elastic_epm_api`. Your administrator chooses this value when creating the app, and it must match exactly because it forms the last part of the token URL. It is a required parameter when collecting logs with the CyberArk Identity authentication method. + multi: false + required: false + show_user: true + - name: client_id + type: text + title: "[Identity] Client ID" + description: The full login name of the CyberArk Identity service user, including the tenant suffix, for example `svc_elastic@cyberark.cloud.1234`. The suffix is required, and is a different identifier from the ID in **[Identity] Identity ID**. It is a required parameter when collecting logs with the CyberArk Identity authentication method. + multi: false + required: false + show_user: true + - name: client_secret + type: password + title: "[Identity] Client Secret" + description: The password of the CyberArk Identity service user. It is a required parameter when collecting logs with the CyberArk Identity authentication method. + multi: false + required: false show_user: true secret: true - name: api_version @@ -80,12 +130,12 @@ policy_templates: default: 24.12.0.4372 - name: session_timeout type: text - title: Session Timeout + title: "[EPM] Session Timeout" multi: false required: true show_user: true default: 30m - description: The session timeout for APIs. It is defined by the `Timeout for inactive session` parameter in `Administration > Account Configuration`. Supported units for this parameter are h/m/s. + description: The session timeout for APIs. It is defined by the `Timeout for inactive session` parameter in `Administration > Account Configuration`. Supported units for this parameter are h/m/s. It is only used when collecting logs with the EPM authentication method; the CyberArk Identity method uses the token lifetime configured on the web app instead. - name: proxy_url type: text title: Proxy URL