Skip to main content

​
Overview

The CyberArk integration enables ThreatAware to collect read-only data from your CyberArk Vault, providing visibility into privileged account usage and helping validate your privileged access management (PAM) security controls.
Connection Method: API Setup Time: 15 minutes Access Required: CyberArk Administrator account

​
Data collected

The CyberArk integration provides:
  • Privileged account usage
  • Session recordings metadata
  • Account access patterns
  • Security posture indicators

​
Use cases

Privileged Access Tracking

Monitor which devices have privileged accounts and track usage patterns

Compliance Validation

Verify privileged access controls are in place for critical systems

Security Monitoring

Detect anomalies in privileged account usage across your environment

Audit Support

Generate reports showing privileged access management coverage

​
Setup instructions

1

Log in to CyberArk Vault

Access your CyberArk Vault with an administrator account that has permissions to create API users.
2

Create API User for ThreatAware

Navigate to Users within the CyberArk administrative console.
  • Create a new user named ThreatAware (or another identifiable name)
  • Assign the user permissions to access relevant resources for integration
  • Ensure Read-only access unless otherwise required
Only grant the minimum permissions necessary. ThreatAware operates on a read-only basis and does not require write access to your CyberArk environment.
3

Enable API Access

Configure API access for the new user:
  • Go to Platform Management > API Access
  • Enable API access for the ThreatAware user
  • Configure necessary permissions:
    • Access to Credentials
    • Access to Accounts
  • Save the changes and securely note any credentials generated (API Key or Client Secret)
4

Configure in ThreatAware

Complete the integration setup in ThreatAware:
  • Open ThreatAware and navigate to Settings > Integrations
  • Search for and select CyberArk
  • Enter the required credentials:
    • Username: The API user created in step 2
    • Password: The password for the API user
    • Vault URL: Your CyberArk Vault URL (e.g., https://vault.example.com)
  • Click Connect to establish the integration
5

Verify Connection

After connecting, ThreatAware will begin polling data from CyberArk within 1 hour.
  • Check that the Integration Status shows as Active
  • Verify data is appearing in ThreatAware by viewing device X-Ray details

​
Required credentials

Field Name: CyberArk API Username Type: String Description: The username for the API user created in CyberArkExample: threataware-api or svc_threataware
Field Name: CyberArk API Password Type: Password (encrypted) Description: The password associated with the CyberArk API user
Store this credential securely in your organisation’s password manager for future reference.
Field Name: CyberArk Vault URL Type: String Description: The URL of your CyberArk Vault instanceFormat: https://your-cyberark-vault-url.com Example: https://vault.acme.com or https://cyberark.company.net

​
Verification and testing

After setup, verify the integration is working correctly:
  1. Check Integration Status
    • Navigate to Settings > Integrations in ThreatAware
    • Confirm the CyberArk integration shows Active status
    • Check the last sync timestamp
  2. Verify Data Collection
    • Wait 60 minutes for the initial data poll
    • Search for a known device in ThreatAware
    • Open Device X-Ray and look for CyberArk data
  3. Test Queries
    • Create a test query to filter devices with CyberArk data
    • Verify the data matches your expectations

​
Troubleshooting

Symptoms: Integration status shows authentication failureSolutions:
  • Verify the Username and Password are correct
  • Ensure API access is enabled for the user in CyberArk
  • Check that the user account is not locked or expired
  • Confirm the password was entered without extra spaces
Symptoms: Integration connects but no data appearsSolutions:
  • Verify the API user has read permissions to Credentials and Accounts
  • Review the CyberArk API Documentation for required permissions
  • Check if there are organisational units or safes the user cannot access
  • Ensure the user has permissions across all required vaults
Symptoms: Integration fails to connect or times outSolutions:
  • Verify the Vault URL is correct and accessible from ThreatAware
  • Check firewall rules allow outbound HTTPS (443) to your CyberArk Vault
  • Confirm your CyberArk Vault is accessible via the internet (or review network requirements)
  • Test the URL in a browser to ensure it’s reachable
Symptoms: Integration shows active but no privileged account data appearsSolutions:
  • Verify there is privileged account data in CyberArk to collect
  • Check the API user’s scope and vault access
  • Review ThreatAware integration logs (contact support if needed)
  • Confirm the devices with privileged accounts exist in ThreatAware from other integrations

​
Additional resources

CyberArk API Documentation

Official CyberArk API documentation for detailed permissions and configuration

ThreatAware Support

Contact ThreatAware support for integration assistance

​
Best practices

Credential Management
  • Create a dedicated service account specifically for ThreatAware
  • Document credentials in your organisation’s password manager
  • Rotate credentials annually or per your security policy
  • Monitor for authentication failures in ThreatAware regularly
Security Considerations
  • Only grant read-only permissions (never write access)
  • Limit API user scope to only necessary vaults and safes
  • Review audit logs in CyberArk periodically to monitor API usage
  • Follow your organisation’s least privilege principles