> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# CyberArk

> Connect ThreatAware to CyberArk Vault to track privileged account usage and security posture

## Overview

The CyberArk integration enables ThreatAware to collect read-only data from your CyberArk Vault, providing visibility into privileged account usage and helping validate your privileged access management (PAM) security controls.

<Info>
  **Connection Method**: API
  **Setup Time**: 15 minutes
  **Access Required**: CyberArk Administrator account
</Info>

## Data collected

The CyberArk integration provides:

* Privileged account usage
* Session recordings metadata
* Account access patterns
* Security posture indicators

## Use cases

<CardGroup cols={2}>
  <Card title="Privileged Access Tracking" icon="shield-halved">
    Monitor which devices have privileged accounts and track usage patterns
  </Card>

  <Card title="Compliance Validation" icon="clipboard-check">
    Verify privileged access controls are in place for critical systems
  </Card>

  <Card title="Security Monitoring" icon="eye">
    Detect anomalies in privileged account usage across your environment
  </Card>

  <Card title="Audit Support" icon="file-contract">
    Generate reports showing privileged access management coverage
  </Card>
</CardGroup>

## Setup instructions

<Steps>
  <Step title="Log in to CyberArk Vault">
    Access your [CyberArk Vault](https://your-cyberark-vault-url.com) with an administrator account that has permissions to create API users.
  </Step>

  <Step title="Create API User for ThreatAware">
    Navigate to **Users** within the CyberArk administrative console.

    * Create a new user named **ThreatAware** (or another identifiable name)
    * Assign the user permissions to access relevant resources for integration
    * Ensure **Read-only** access unless otherwise required

    <Warning>
      Only grant the minimum permissions necessary. ThreatAware operates on a read-only basis and does not require write access to your CyberArk environment.
    </Warning>
  </Step>

  <Step title="Enable API Access">
    Configure API access for the new user:

    * Go to **Platform Management** > **API Access**
    * Enable API access for the ThreatAware user
    * Configure necessary permissions:
      * Access to **Credentials**
      * Access to **Accounts**
    * Save the changes and securely note any credentials generated (API Key or Client Secret)
  </Step>

  <Step title="Configure in ThreatAware">
    Complete the integration setup in ThreatAware:

    * Open ThreatAware and navigate to **Settings** > **Integrations**
    * Search for and select **CyberArk**
    * Enter the required credentials:
      * **Username**: The API user created in step 2
      * **Password**: The password for the API user
      * **Vault URL**: Your CyberArk Vault URL (e.g., `https://vault.example.com`)
    * Click **Connect** to establish the integration
  </Step>

  <Step title="Verify Connection">
    After connecting, ThreatAware will begin polling data from CyberArk within 1 hour.

    * Check that the **Integration Status** shows as **Active**
    * Verify data is appearing in ThreatAware by viewing device X-Ray details
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Username" icon="user">
    **Field Name**: CyberArk API Username
    **Type**: String
    **Description**: The username for the API user created in CyberArk

    Example: `threataware-api` or `svc_threataware`
  </Accordion>

  <Accordion title="Password" icon="lock">
    **Field Name**: CyberArk API Password
    **Type**: Password (encrypted)
    **Description**: The password associated with the CyberArk API user

    <Tip>
      Store this credential securely in your organisation's password manager for future reference.
    </Tip>
  </Accordion>

  <Accordion title="Vault URL" icon="server">
    **Field Name**: CyberArk Vault URL
    **Type**: String
    **Description**: The URL of your CyberArk Vault instance

    **Format**: `https://your-cyberark-vault-url.com`
    **Example**: `https://vault.acme.com` or `https://cyberark.company.net`
  </Accordion>
</AccordionGroup>

## Verification and testing

After setup, verify the integration is working correctly:

1. **Check Integration Status**
   * Navigate to **Settings** > **Integrations** in ThreatAware
   * Confirm the CyberArk integration shows **Active** status
   * Check the last sync timestamp

2. **Verify Data Collection**
   * Wait 60 minutes for the initial data poll
   * Search for a known device in ThreatAware
   * Open **Device X-Ray** and look for CyberArk data

3. **Test Queries**
   * Create a test query to filter devices with CyberArk data
   * Verify the data matches your expectations

## Troubleshooting

<AccordionGroup>
  <Accordion title="Invalid Credentials Error" icon="triangle-exclamation">
    **Symptoms**: Integration status shows authentication failure

    **Solutions**:

    * Verify the **Username** and **Password** are correct
    * Ensure API access is enabled for the user in CyberArk
    * Check that the user account is not locked or expired
    * Confirm the password was entered without extra spaces
  </Accordion>

  <Accordion title="Permission Issues" icon="ban">
    **Symptoms**: Integration connects but no data appears

    **Solutions**:

    * Verify the API user has read permissions to Credentials and Accounts
    * Review the [CyberArk API Documentation](https://docs.cyberark.com/) for required permissions
    * Check if there are organisational units or safes the user cannot access
    * Ensure the user has permissions across all required vaults
  </Accordion>

  <Accordion title="Connection Timeout" icon="clock">
    **Symptoms**: Integration fails to connect or times out

    **Solutions**:

    * Verify the Vault URL is correct and accessible from ThreatAware
    * Check firewall rules allow outbound HTTPS (443) to your CyberArk Vault
    * Confirm your CyberArk Vault is accessible via the internet (or review network requirements)
    * Test the URL in a browser to ensure it's reachable
  </Accordion>

  <Accordion title="No Data After 1 Hour" icon="database">
    **Symptoms**: Integration shows active but no privileged account data appears

    **Solutions**:

    * Verify there is privileged account data in CyberArk to collect
    * Check the API user's scope and vault access
    * Review ThreatAware integration logs (contact support if needed)
    * Confirm the devices with privileged accounts exist in ThreatAware from other integrations
  </Accordion>
</AccordionGroup>

## Additional resources

<CardGroup cols={2}>
  <Card title="CyberArk API Documentation" icon="book" href="https://docs.cyberark.com/">
    Official CyberArk API documentation for detailed permissions and configuration
  </Card>

  <Card title="ThreatAware Support" icon="life-ring" href="mailto:help@threataware.com">
    Contact ThreatAware support for integration assistance
  </Card>
</CardGroup>

## Best practices

<Tip>
  **Credential Management**

  * Create a dedicated service account specifically for ThreatAware
  * Document credentials in your organisation's password manager
  * Rotate credentials annually or per your security policy
  * Monitor for authentication failures in ThreatAware regularly
</Tip>

<Tip>
  **Security Considerations**

  * Only grant read-only permissions (never write access)
  * Limit API user scope to only necessary vaults and safes
  * Review audit logs in CyberArk periodically to monitor API usage
  * Follow your organisation's least privilege principles
</Tip>