CyberArk PIM
  • 1 Minute to read
  • Contributors
  • Dark
    Light
  • PDF

CyberArk PIM

  • Dark
    Light
  • PDF

This article describes the steps to configure log forwarding for CyberArk Privileged Identity Management (CEF)

  1. On the PTA machine, open the default systemparm.properties file using the DEFAULTPARM command.
  2. Copy the line containing the syslog_outbound property, and exit the file.
  3. Open the local systemparm.properties file using the LOCALPARM command.
  4. Press i to edit the file.
  5. Paste the line you copied, uncomment the syslog_outbound property and edit the parameters. Use the following table as a guide.
Parameter Description
siem Enter the DNIF system
format The format used to transfer the syslog records to the server where your SIEM solution is installed. Enter: CEF
host The Host/IP address of the server where your SIEM solution is installed.
port The port number through which the syslog records will be sent to the server where your SIEM solution is installed.
protocol The protocol used to transfer the syslog records to the server where your SIEM solution is installed.

Example:

syslog_outbound=[{"siem": "DNIF", "format": "CEF", "host": "DNIF_IP_ADDRESS", "port": 514, "protocol": "TCP/UDP"}]

  1. Save the configuration file and close it.
  2. Restart PTA.

Official Documentation: Click here


Was this article helpful?