> For the complete documentation index, see [llms.txt](https://docs.onum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.onum.com/listeners/listener-integrations/pull-data-from-http-endpoints/pull-data-from-the-cyberark-api.md).

# Pull data from the CyberArk API

## Overview

Get a list of CyberArk events through the [CyberArk's REST API](https://docs.cyberark.com/pam-self-hosted/latest/en/content/webservices/implementing%20privileged%20account%20security%20web%20services%20.htm) using the **HTTP Pull** Listener.

## HTTP Pull Listener configuration

In Falcon Onum, go to the **Listeners** area and click **New Listener > HTTP Pull**. Give a name to your new Listener and enter the following data:

### Parameters

N/A

### Secrets

You must define these credentials in Onum:

* `auh_token` will reference your CyberArk authentication token.
* `api_key` will reference your CyberArk API Key.

To do it, click **Add element** and enter a **Name** for the secret (in this case, `auth_token`). Then, click the **Value** field and select **New secret** to create a new one:

* Give the secret a **Name**.
* Turn off the **Expiration date** option.
* Click **Add new value** and paste the secret corresponding to the value.
* Click **Save**.

You can now select the secret you just created in the **Value** field list. Repeat the process for the `api_key`.

{% hint style="info" %}
Learn more about secrets in Onum in [this article](/settings/organization-settings/secrets-management.md).
{% endhint %}

### Setup

After entering the required parameters and secrets, you can choose to manually enter the rest of configuration fields, or simply paste the given YAML:

{% tabs %}
{% tab title="Config as YAML" %}
Toggle **ON** the **Config as YAML** option to enable a free text field where you can paste the following YAML:

```yaml
withTemporalWindow: true
temporalWindow:
  duration: 1m
  offset: 1m
  tz: UTC
  format: RFC3339
withAuthentication: true
authentication:
  type: token
  token:
    request:
      method: POST
      url: https://abd4962.id.cyberark.cloud/OAuth2/Token/OnumCrowdStrike
      headers:
        - name: Accept
          value: application/json
        - name: Authorization
          value: Basic ${secrets.auth_token}
        - name: Content-Type
          value: application/x-www-form-urlencoded
      queryParams: []
      bodyType: urlEncoded
      bodyParams:
        - name: grant_type
          value: client_credentials
        - name: scope
          value: isp.audit.events:read
    tokenPath: ".access_token"
    authInjection:
      in: header
      name: Authorization
      prefix: 'Bearer '
      suffix: ''
withEnumerationPhase: true
enumerationPhase:
  paginationType: none
  request:
    responseType: json
    method: POST
    url: https://cmpc.audit.cyberark.cloud/api/audits/stream/createQuery
    headers:
      - name: Accept
        value: application/json
      - name: Accept-Encoding
        value: gzip, deflate
      - name: Content-Type
        value: application/json
      - name: x-api-key
        value: ${secrets.apikey}
    bodyType: raw
    bodyRaw: |
      {
        "query": {
          "pageSize": 500,
          "selectedFields": [
            "tenant_id",
            "custom_data",
            "arrival_timestamp",
            "checksum",
            "application_code",
            "audit_code",
            "timestamp",
            "user_id",
            "session_id",
            "source",
            "action_type",
            "audit_type",
            "component",
            "target",
            "command",
            "message",
            "username",
            "action",
            "uuid",
            "service_name",
            "cloud_roles",
            "cloud_workspaces",
            "cloud_workspaces_and_roles",
            "cloud_assets",
            "cloud_identities",
            "vaulted_accounts",
            "cloud_provider",
            "account_name",
            "target_platform",
            "safe",
            "target_account",
            "identity_type",
            "access_method",
            "account_id",
            "correlation_id"
          ],
          "filterModel": {
            "date": {
              "dateFrom": "${temporalWindow.from}",
              "dateTo": "${temporalWindow.to}"
            }
          }
        }
      }
  output:
    select: "."
    map: "."
    outputMode: element
collectionPhase:
  variables:
    - source: input
      name: cursorRef
      expression: ".cursorRef"
      format: ''
  paginationType: cursor
  cursorSelector: ".paging.cursor.cursorRef"
  initialRequest:
    method: POST
    url: https://cmpc.audit.cyberark.cloud/api/audits/stream/results
    headers:
      - name: Accept
        value: application/json
      - name: Accept-Encoding
        value: gzip, deflate
      - name: Content-Type
        value: application/json
      - name: x-api-key
        value: ${secrets.apikey}
    bodyType: raw
    bodyRaw: |
      {
        "cursorRef": "${inputs.cursorRef}"
      }
  nextRequest:
    method: POST
    url: https://cmpc.audit.cyberark.cloud/api/audits/stream/results
    headers:
      - name: Accept
        value: application/json
      - name: Accept-Encoding
        value: gzip, deflate
      - name: Content-Type
        value: application/json
      - name: x-api-key
        value: ${secrets.apikey}
    bodyType: raw
    bodyRaw: |
      {
        "cursorRef": "${pagination.cursor}"
      }
  output:
    select: ".data"
    filter: "."
    map: "."
    outputMode: element
```

{% endtab %}

{% tab title="Manually configure" %}
**Temporal Window**

Toggle **ON** to add a temporal window for events. This repeatedly shifts the time window over which data is collected.

* **Duration** - `1m`
* **Offset** - `1m`
* **Format** - `RFC3339`

**Authentication**

Toggle **ON** and configure these parameters:

* **Type**<mark style="color:$primary;">**\***</mark> - `Token`
* **Token Retrieve Based Authentication**
  * **Request**
    * **Method**<mark style="color:$primary;">**\***</mark> - `POST`
    * **URL**<mark style="color:$primary;">**\***</mark> - `https://abd4962.id.cyberark.cloud/OAuth2/Token/OnumCrowdStrike`
  * **Headers**
    * **Name** - `Accept`
    * **Value** - `application/json`
    * **Name** - `Authorization`
    * **Value** - `Basic ${secrets.auth_token}`
    * **Name** - `Content-Type`
    * **Value** - `application/x-www-form-urlencoded`
  * **Body Type**<mark style="color:$primary;">**\***</mark>**&#x20;-** `URLEncoded`
  * **Body Params**
    * **Name** - `grant_type`
    * **Value** - `client_credentials`
    * **Name** - `scope`
    * **Value** - `isp.audit.events:read`
  * **Token path**<mark style="color:$primary;">**\***</mark> - `.access_token`
  * **Auth Injection**
    * **In**<mark style="color:$primary;">**\***</mark> - `Header`
    * **Name**<mark style="color:$primary;">**\***</mark> - `Authorization`
    * **Prefix** - `'Bearer '`
    * **Suffix** - `''`

**Enumeration Phase**

Toggle **ON** and configure these parameters:

* **Pagination Type**<mark style="color:$primary;">**\***</mark> - `None`
* **Request**
  * **Response Type**<mark style="color:$primary;">**\***</mark> - `JSON`
  * **Method**<mark style="color:$primary;">**\***</mark> - `POST`
  * **URL**<mark style="color:$primary;">**\***</mark> - `https://cmpc.audit.cyberark.cloud/api/audits/stream/createQuery`
  * **Headers**
    * **Name** - `Accept`
    * **Value** - `application/json`
    * **Name** - `Accept-Encoding`
    * **Value** - `gzip, deflate`
    * **Name** - `Content-Type`
    * **Value** - `aplication/json`
    * **Name** - `x-api-key`
    * **Value** - `${secrets.apikey}`
  * **Body Type**<mark style="color:$primary;">**\***</mark> - `Raw`
  * **Body Content** -

```
{
  "query": {
    "pageSize": 500,
    "selectedFields": [
      "tenant_id",
      "custom_data",
      "arrival_timestamp",
      "checksum",
      "application_code",
      "audit_code",
      "timestamp",
      "user_id",
      "session_id",
      "source",
      "action_type",
      "audit_type",
      "component",
      "target",
      "command",
      "message",
      "username",
      "action",
      "uuid",
      "service_name",
      "cloud_roles",
      "cloud_workspaces",
      "cloud_workspaces_and_roles",
      "cloud_assets",
      "cloud_identities",
      "vaulted_accounts",
      "cloud_provider",
      "account_name",
      "target_platform",
      "safe",
      "target_account",
      "identity_type",
      "access_method",
      "account_id",
      "correlation_id"
    ],
    "filterModel": {
      "date": {
        "dateFrom": "${temporalWindow.from}",
        "dateTo": "${temporalWindow.to}"
      }
    }
  }
}
```

* **Output**
  * **Select**<mark style="color:$primary;">**\***</mark> - `.`
  * **Map** - `.`
  * **Output Mode**<mark style="color:$primary;">**\***</mark> - `element`

**Collection Phase**

* **Name** - `cursorRef`
* **Expression** - `.cursorRef`
* **Format** - `''`
* **Pagination Type**<mark style="color:$primary;">**\***</mark> - `Cursor`
* **Cursor Selector**<mark style="color:$primary;">**\***</mark> - `.paging.cursor.cursorRef`
* **Initial Request**
  * **Response Type**<mark style="color:$primary;">**\***</mark> - `JSON`
  * **Method**<mark style="color:$primary;">**\***</mark> - `POST`
  * **URL**<mark style="color:$primary;">**\***</mark> - `https://cmpc.audit.cyberark.cloud/api/audits/stream/results`
  * **Headers**
    * **Name** - `Accept`
    * **Value** - `application/json`
    * **Name** - `Accept-Encoding`
    * **Value** - `gzip, deflate`
    * **Name** - `Content-Type`
    * **Value** - `application/json`
    * **Name** - `x-api-key`
    * **Value** - `${secrets.apikey}`
  * **Body Type**<mark style="color:$primary;">**\***</mark> - `Raw`
  * **Body Content**<mark style="color:$primary;">**\***</mark> -

```
{
  "cursorRef": "${pagination.cursor}"
}
```

* **Next Request**
  * **Response Type**<mark style="color:$primary;">**\***</mark> - `JSON`
  * **Method**<mark style="color:$primary;">**\***</mark> - `POST`
  * **URL**<mark style="color:$primary;">**\***</mark> - `https://cmpc.audit.cyberark.cloud/api/audits/stream/results`
  * **Headers**
    * **Name** - `Accept`
    * **Value** - `application/json`
    * **Name** - `Accept-Encoding`
    * **Value** - `gzip, deflate`
    * **Name** - `Content-Type`
    * **Value** - `application/json`
    * **Name** - `x-api-key`
    * **Value** - `${secrets.apikey}`
  * **Body Type**<mark style="color:$primary;">**\***</mark> - `Raw`
  * **Body Content**<mark style="color:$primary;">**\***</mark> -

```
{
  "cursorRef": "${pagination.cursor}"
}
```

* **Output**
  * **Select**<mark style="color:$primary;">**\***</mark> - `.data`
  * **Filter** - `.`
  * **Map** - `.`
  * **Output Mode**<mark style="color:$primary;">**\***</mark> - `element`
    {% endtab %}
    {% endtabs %}

When you're done, click **Create labels** to move on to the next step and define the required [Labels](/listeners/labels.md) if needed.