Pull data from the CyberArk API

Overview

Get a list of CyberArk events through the CyberArk's REST API using the HTTP Pull Listener.

HTTP Pull Listener configuration

In Falcon Onum, go to the Listeners area and click New Listener > HTTP Pull. Give a name to your new Listener and enter the following data:

Parameters

N/A

Secrets

You must define these credentials in Onum:

• auh_token will reference your CyberArk authentication token.

• api_key will reference your CyberArk API Key.

To do it, click Add element and enter a Name for the secret (in this case, auth_token). Then, click the Value field and select New secret to create a new one:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

You can now select the secret you just created in the Value field list. Repeat the process for the api_key.

Learn more about secrets in Onum in this article.

Setup

After entering the required parameters and secrets, you can choose to manually enter the rest of configuration fields, or simply paste the given YAML:

Config as YAML

Toggle ON the Config as YAML option to enable a free text field where you can paste the following YAML:

withTemporalWindow: true
temporalWindow:
  duration: 1m
  offset: 1m
  tz: UTC
  format: RFC3339
withAuthentication: true
authentication:
  type: token
  token:
    request:
      method: POST
      url: https://abd4962.id.cyberark.cloud/OAuth2/Token/OnumCrowdStrike
      headers:
        - name: Accept
          value: application/json
        - name: Authorization
          value: Basic ${secrets.auth_token}
        - name: Content-Type
          value: application/x-www-form-urlencoded
      queryParams: []
      bodyType: urlEncoded
      bodyParams:
        - name: grant_type
          value: client_credentials
        - name: scope
          value: isp.audit.events:read
    tokenPath: ".access_token"
    authInjection:
      in: header
      name: Authorization
      prefix: 'Bearer '
      suffix: ''
withEnumerationPhase: true
enumerationPhase:
  paginationType: none
  request:
    responseType: json
    method: POST
    url: https://cmpc.audit.cyberark.cloud/api/audits/stream/createQuery
    headers:
      - name: Accept
        value: application/json
      - name: Accept-Encoding
        value: gzip, deflate
      - name: Content-Type
        value: application/json
      - name: x-api-key
        value: ${secrets.apikey}
    bodyType: raw
    bodyRaw: |
      {
        "query": {
          "pageSize": 500,
          "selectedFields": [
            "tenant_id",
            "custom_data",
            "arrival_timestamp",
            "checksum",
            "application_code",
            "audit_code",
            "timestamp",
            "user_id",
            "session_id",
            "source",
            "action_type",
            "audit_type",
            "component",
            "target",
            "command",
            "message",
            "username",
            "action",
            "uuid",
            "service_name",
            "cloud_roles",
            "cloud_workspaces",
            "cloud_workspaces_and_roles",
            "cloud_assets",
            "cloud_identities",
            "vaulted_accounts",
            "cloud_provider",
            "account_name",
            "target_platform",
            "safe",
            "target_account",
            "identity_type",
            "access_method",
            "account_id",
            "correlation_id"
          ],
          "filterModel": {
            "date": {
              "dateFrom": "${temporalWindow.from}",
              "dateTo": "${temporalWindow.to}"
            }
          }
        }
      }
  output:
    select: "."
    map: "."
    outputMode: element
collectionPhase:
  variables:
    - source: input
      name: cursorRef
      expression: ".cursorRef"
      format: ''
  paginationType: cursor
  cursorSelector: ".paging.cursor.cursorRef"
  initialRequest:
    method: POST
    url: https://cmpc.audit.cyberark.cloud/api/audits/stream/results
    headers:
      - name: Accept
        value: application/json
      - name: Accept-Encoding
        value: gzip, deflate
      - name: Content-Type
        value: application/json
      - name: x-api-key
        value: ${secrets.apikey}
    bodyType: raw
    bodyRaw: |
      {
        "cursorRef": "${inputs.cursorRef}"
      }
  nextRequest:
    method: POST
    url: https://cmpc.audit.cyberark.cloud/api/audits/stream/results
    headers:
      - name: Accept
        value: application/json
      - name: Accept-Encoding
        value: gzip, deflate
      - name: Content-Type
        value: application/json
      - name: x-api-key
        value: ${secrets.apikey}
    bodyType: raw
    bodyRaw: |
      {
        "cursorRef": "${pagination.cursor}"
      }
  output:
    select: ".data"
    filter: "."
    map: "."
    outputMode: element

Manually configure

When you're done, click Create labels to move on to the next step and define the required Labels if needed.