elastic · sharad-elastic · Aug 7, 2026 · Sep 2, 2026 · Sep 2, 2026
@@ -29,24 +29,42 @@
 
 ## Setup
 
-### Collect data from the CyberArk EPM API
+The integration supports two authentication methods against the CyberArk EPM REST API. Complete the CyberArk-side setup for the method you intend to use.
+
+### Option 1: EPM authentication
+
+This method uses the native EPM logon API with an EPM username and password. It is the default and remains supported for tenants that are not connected to the CyberArk Identity Security Platform Shared Services (ISPSS).
 
 1. Navigate to **Administration > Account Management** and create a user. While creating the user, check the **Allow to manage Sets** option and provide **ViewOnlySetAdmin** for all the required sets.
 2. Log in with the newly created user and navigate to **Administration > Account Configuration**. 
 3. Update the **Timeout for inactive session** parameter, which is a prerequisite for creating an integration in Elastic.
 
 NOTE: Set a high value for the **Timeout for inactive session** parameter to minimize multiple authentication calls.
 
+### Option 2: CyberArk Identity authentication
+
+This method uses the OAuth2 client credentials flow with a CyberArk Identity service user. Use it when your EPM tenant is connected to ISPSS. For the full procedure, refer to [Set up API authentication for EPM REST APIs using Identity](https://docs.cyberark.com/epm/latest/en/content/webservices/authenticate-with-identity-administration.htm).
+
+1. In Identity Administration, create a service user with **Is service user** and **Is OAuth confidential client** enabled. Note its login name, for example `svc_elastic@cyberark.cloud.1234`, and its password. These are used as `[Identity] Client ID` and `[Identity] Client Secret`.
+2. Add the service user as a member of an EPM role that grants the EPM API permissions required for the data streams you want to collect.
+3. In Identity Administration, go to **Apps & Widgets > Web Apps**, click **Add Web Apps**, and add the **CyberArk EPM API Client** app. Configure the required fields under the **Settings** tab and note the Application ID, which is used as `[Identity] Application ID`.
+4. On the **Tokens** tab of the web app, define the token expiration period. On the **Permissions** tab, add the service user.
+5. Note your Identity ID: click your user name, select **About**, and copy the **ID** shown under **Identity**, for example `ACF4874`. This is used as `[Identity] Identity ID`.
+6. Note your EPM server name, which is the subdomain of your EPM console URL. For example, if the console URL is `https://na101.epm.cyberark.com/management-options`, then `[Identity] EPM Server URL` is `https://na101.epm.cyberark.com`.
+
 ### Enable the integration in Elastic
 
 1. In Kibana navigate to **Management** > **Integrations**.
 2. In the search bar, type **CyberArk EPM**.
 3. Select the **CyberArk EPM** integration and add it.
-4. Add all the required integration configuration parameters, including the URL, Username, Password, API Version, Session Timeout, Interval, and Initial Interval, to enable data collection.
-5. Save the integration.
+4. Select the **Authentication Method** and fill in the parameters prefixed with the matching label. Parameters prefixed with the other label can be left empty.
+    - **EPM**: `[EPM] URL`, `[EPM] Username`, `[EPM] Password` and `[EPM] Session Timeout`.
+    - **CyberArk Identity**: `[Identity] EPM Server URL`, `[Identity] Identity ID`, `[Identity] Application ID`, `[Identity] Client ID` and `[Identity] Client Secret`.
+5. Add the remaining configuration parameters, including the Interval and Initial Interval, to enable data collection.
+6. Save the integration.
 
 **Note**:
-  - The default URL is `https://login.epm.cyberark.com`, but this may vary depending on your region. Please refer to the [Documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm#EPMdispatcherservername) to find the correct URL for your region.
+  - The default `[EPM] URL` is `https://login.epm.cyberark.com`, but this may vary depending on your region. Please refer to the [Documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm#EPMdispatcherservername) to find the correct URL for your region. This URL is the EPM dispatcher server and is only used with the **EPM** authentication method; the **CyberArk Identity** method uses `[Identity] EPM Server URL` instead.
   - If you encounter an error indicating that the usage limit has been reached, consider lowering the "Resource Rate Limit" parameter in the advanced section. For more details, please refer to the [documentation](https://docs.cyberark.com/epm/latest/en/content/webservices/webservicesintro.htm#APIlimitations).
 
 ## Logs reference

@@ -11,3 +11,25 @@ services:
       - http-server
       - --addr=:8090
       - --config=/files/config.yml
+  cyberark_epm-oauth:
+    image: docker.elastic.co/observability/stream:v0.18.0
+    hostname: elastic-test.id.cyberark.cloud
+    networks:
+      - elastic-package-stack_default
+    ports:
+      - 443
+    volumes:
+      - ./files:/files:ro
+    environment:
+      PORT: '443'
+    command:
+      - http-server
+      - --addr=:443
+      - --config=/files/config.yml
+      - --tls-cert=/files/shared-certificate.crt
+      - --tls-key=/files/shared-private.key
+networks:
+  elastic-package-stack_default:
+    driver: bridge
+    name: elastic-package-stack_default
+    external: true
@@ -1,4 +1,30 @@
+# Request headers are matched as regular expressions, so the Authorization rules below
+# accept either the EPM logon token or the CyberArk Identity bearer token, letting the
+# same rule set serve the system tests for both authentication methods.
 rules:
+  # CyberArk Identity (ISPSS) OAuth2 client credentials token endpoint.
+  #
+  # The credentials below are percent-encoded because the oauth2 client in the CEL input
+  # encodes them per RFC 6749 2.3.1 before building the Basic authorization header. The
+  # unencoded values are 'svc_elastic@cyberark.cloud.1234' and 'p@ss"w/ord\test'.
+  - path: /oauth2/token/elastic_epm_api
+    methods: ['POST']
+    user: 'svc_elastic%40cyberark.cloud.1234'
+    password: 'p%40ss%22w%2Ford%5Ctest'
+    query_params:
+      grant_type: client_credentials
+    responses:
+      - status_code: 200
+        headers:
+          Content-Type:
+            - 'application/json'
+        body: |-
+          {
+            "access_token": "identity-token",
+            "token_type": "Bearer",
+            "expires_in": 900,
+            "scope": "epm"
+          }
   - path: /EPM/API/24.12.0.4372/Auth/EPM/Logon
     methods: ['POST']
     request_headers:
@@ -23,7 +49,7 @@ rules:
       Offset: 0
     request_headers:
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -58,7 +84,7 @@ rules:
       Offset: 2
     request_headers:
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -80,7 +106,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -253,7 +279,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -352,7 +378,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -376,7 +402,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -400,7 +426,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -533,7 +559,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -612,7 +638,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -636,7 +662,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -715,7 +741,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -739,7 +765,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -855,7 +881,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -879,7 +905,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -903,7 +929,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -973,7 +999,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -997,7 +1023,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -1077,7 +1103,7 @@ rules:
       Content-Type:
         - "application/json"
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -1101,7 +1127,7 @@ rules:
       Offset: 0
     request_headers:
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -1148,7 +1174,7 @@ rules:
       Offset: 2
     request_headers:
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -1183,7 +1209,7 @@ rules:
       Offset: 3
     request_headers:
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:
@@ -1205,7 +1231,7 @@ rules:
       Offset: 0
     request_headers:
       Authorization:
-        - "basic token"
+        - '^(?:basic token|Bearer identity-token)$'
     responses:
       - status_code: 200
         headers:

@@ -0,0 +1,21 @@
+-----BEGIN CERTIFICATE-----
+MIIDXjCCAkagAwIBAgIUcW0OaLtoq+zHmATDz14hhDevv9UwDQYJKoZIhvcNAQEL
+BQAwKTEnMCUGA1UEAwweZWxhc3RpYy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMB4X
+DTI2MDgyMDA5MTM0OFoXDTM2MDgxNzA5MTM0OFowKTEnMCUGA1UEAwweZWxhc3Rp
+Yy10ZXN0LmlkLmN5YmVyYXJrLmNsb3VkMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAoW2VUELB7SNGQDzS83r1DPucuKdzUbFhBA7NN3mzF7GtJ9L2dwzo
+RdieV0Z0jxPi6vVcMlz8qckgQ+eZ3nX2kF5bEBU8gKhLx5BJgFAhdSwmnehJX8KT
+7rkDUT/GK9I1oYyr3/w65o+VKASKcbe0/eXQo8SDQnU4/AsoHaLG91G8KAn/YarB
+0j6O0XtEq3u7mUq7Vgk5jQio/akXmu07m+ILuwlAJI16zlVSefgR0dZUwWM4IjXl
+/hDoZ+l8UCus7pYJiPZkuEkFdlqA+4VKsbNigSJ+Hn9v/ZGZxWD4HlJxYcX1Ndci
+2Cdzy6b+SaWVp5zRblQy1wrskZ1ja53DgQIDAQABo34wfDAdBgNVHQ4EFgQUJLJ1
+RmDKq0bGvXhrNXdzJAmwCswwHwYDVR0jBBgwFoAUJLJ1RmDKq0bGvXhrNXdzJAmw
+CswwDwYDVR0TAQH/BAUwAwEB/zApBgNVHREEIjAggh5lbGFzdGljLXRlc3QuaWQu
+Y3liZXJhcmsuY2xvdWQwDQYJKoZIhvcNAQELBQADggEBAFAy8L239V/TsW7Hn55j
+Oi44LLuv/+DgNYekciuImPy1dZWvDO7R2HBZ3uLIBP4qUE0p3MiRG1DSHxIJA516
+yOvRKPNCPr64p1lAxYka2G1AQ8fDjCQjMuoDKjXaUd0vgHxH+NJY5Z5P0huL8jgm
+FeSbFuKjJTg1EeeEcr+yeQEeDwZO+Ou3dxyDe3EzdppzFedrGT2HW8It8wiroFH9
+tLvXJBG/CjEsaw0aYCP+4KBesvv6wPgnNAFX8htVsk9pomlVrh1dvMwzyZ/Z+3Gg
+DhS/JdNF4gvgvF1BJyyVIldUIws5BtMWzxMtAjh5dTXx2PxJ0PO3FMTGh2TNyAam
+1eM=
+-----END CERTIFICATE-----
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQChbZVQQsHtI0ZA
+PNLzevUM+5y4p3NRsWEEDs03ebMXsa0n0vZ3DOhF2J5XRnSPE+Lq9VwyXPypySBD
+55nedfaQXlsQFTyAqEvHkEmAUCF1LCad6ElfwpPuuQNRP8Yr0jWhjKvf/Drmj5Uo
+BIpxt7T95dCjxINCdTj8Cygdosb3UbwoCf9hqsHSPo7Re0Sre7uZSrtWCTmNCKj9
+qRea7Tub4gu7CUAkjXrOVVJ5+BHR1lTBYzgiNeX+EOhn6XxQK6zulgmI9mS4SQV2
+WoD7hUqxs2KBIn4ef2/9kZnFYPgeUnFhxfU11yLYJ3PLpv5JpZWnnNFuVDLXCuyR
+nWNrncOBAgMBAAECggEAUJ916OGGkGTDM9cM9pzM4cCSu+ip4D2qegfYd6H5D9bl
+59Nl0/ymzyeKoYUnNsRUW0vS0bZ+XF/+lNuJjkE1NVJiwawRjSJAwrlt9D9RDn/Q
+A6Kdbs2z65EMtpoW5BD3RymGN/Z2Bmvkr1lhOb1qEDqk0v4VHm6EWOFLlk2TeLZW
+CutnIgIoedUjPVuwBZOc/BuTROY2bLtbGVwy1Eq9ie+kLRM7WfIx03NmV4ucJLqi
+FOpINY5ulhwuOQGM0a+f0+Z98AqPTVCR9Y0MUy96enUj26kVLrZTU+28KOcbzK9V
+Lg9sGPGU74dzR/rZI18C81MkwkH2G3EH10Bj8r7OzwKBgQC3HujZw4ADhPDGlpWT
+EwvcZlh0FOU7bTSt4uOf+V96k/zpChUTYtLiovGulKYt0Pc1zDH2Wcr8NYrpXnrB
+J2GiVWJHzpHd/49eLnwbxxI3z1NlkvVMcw4r59VPWMCTiFZDW3GAlJ4eH+8V6E9e
+diZCc2oQFREPSTPIR96PDq2yZwKBgQDhrIjaFc5G90sHTOP4WBVAPCzKL4cBtfY7
+NZ6HJf9hxWDOu5RjlwJSFByNCelr1e1SYsLGB3Oa+fePwVOfx4JqJWYYaAsMhSEy
+QkHHyxhstR3YcCthd3tu52/2e2oSsQuhs4ej6PkevWsTulWsCIompdH3lOy2Ldh+
+G8tDglw51wKBgQCduYHWDw2z+k1ov0sV4tHUhFKrqVPIW8eD/mkQ4Tnb2pt8HbMJ
+f5UkoDSKqn53+AT10Ws3RSARHA0J9NbGh6UQrXp5XvNEw1o5RNChHFYUu/6Y/ntJ
+3c/XAVg5f7hfWo7ydVDN7zRBvj+wHug99IX/tmkkcQDAqcxwNXb8wSfbAQKBgEVy
+mwrB+yDLqUMt3lnmgWOrIP13csyL+qJt9cMRZm3oF8qG3ztmlUg8+CxPCI4u30Gj
+Mt1OHb1rf0u16s4Yz4Fq0Ohh3ESWE4kr6qJZVcLeWbjpi/AKnOmcP1BS2mm2IiY4
+4V0HrOJQ2ErR5Nt0JU+PZ/YQ1meZ5C2qz/qOe2MxAoGAEddAFvuBFXP3/USMXU4S
+eM+Bwi5Qu6I758ny1XiHO1+J6jXi0/hJI6KdUJkX5M3EiwgEWkhkT4gWHtF0uJeQ
+VpOXEfGMIwOfvrrSeTy4hW4Gj1Jh1qjD9yrPPbRLYHtV4dqjR7aL801J7eUFVWEh
+Mv5p8A0XNym6SFv6OgFcGoY=
+-----END PRIVATE KEY-----
@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.7.0"
+  changes:
+    - description: Add CyberArk Identity (OAuth2) as an authentication method alongside the existing EPM logon.
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/21014
 - version: "1.6.0"
   changes:
     - description: Add tags to ingest pipeline processors.