Skip to main content

CyberArk Privileged Threat Analytics

CyberArk Privileged Threat Analytics (PTA) leverages the analytic capabilities of PTA and assigns a risk score to privileged sessions.

CyberArk Privileged Threat Analytics

This pack includes Cortex XSIAM content.

This pack contains a beta Modeling Rule, which lets you process CyberArk PTA log fields to XDM fields.
Since the Modeling Rule is considered as beta, it might not contain some of the fields that are available from the logs.
We appreciate your feedback on the quality and usability of the Modeling Rule to help us identify issues, fix them, and continually improve.

Configuration on Server Side

You need to configure CyberArk Privileged Threat Analytics (PTA) to forward Syslog messages in CEF format.

Access your Cyberark PTA machine and follow these instructions Product Documentation:

  1. On the PTA machine, open the default file using the DEFAULTPARM command.
  2. Copy the line containing the syslog_outbound property, and exit the file.
  3. Open the local file using the LOCALPARM command.
  4. Press i to edit the file.
  5. Paste the line you copied, uncomment the syslog_outbound property and edit the parameters. Use the following as a guide.
    • format - CEF.
    • protocol - UDP.
    • siem - Assign a name to your configuration.
    • host - Write the dedicated hostname or IP address.
    • port - Write the dedicated port number.
    • syslogType - RFC5424.

Collect Events from Vendor

In order to use the collector, use the Broker VM option.

Broker VM

To create or configure the Broker VM, use the information described here.

You can configure the specific vendor and product for this instance.

  1. Navigate to SettingsConfigurationData BrokerBroker VMs.
  2. Go to the Apps column under the Brokers tab and add the Syslog Collector app for the relevant broker instance. If the app already exists, hover over it and click Configure.
  3. Click Add New for adding a new syslog data source.
  4. When configuring the new syslog data source, set the following values:
    | Parameter | Value
    | :--- | :---
    | Vendor | Enter cyberark.
    | Product | Enter pta.




Cortex XSIAM


CertificationRead more
Supported ByCortex
CreatedOctober 23, 2023
Last ReleaseOctober 23, 2023

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.