CyberArk

Support & Certification

Description

Automatic release of exclusive accounts

Overview

Utilize SIEM alerts for automatic release of exclusive accounts according to PSMDisconnect events.

This is achieved by establishing a dummy Syslog server (C#) that initiates a PACLI process which releases the accounts whose connection has ended and creating a least privileged PACLI user with the only ability to release objects.

Prerequisites

1. Ports
1. Source – Vault/DR
2. Destination - The server we will install the tool on
3. Communication - 514/UDP
2. ExclusiveAccountAutoRelease.7z – which contains:
1. Vault - Syslog XSL translator file.
2. ExAcAutoRls - compiled Syslog & PACLI utility.
3. Administrator account must have ownership on all safes

Installation

Vault server:

1. Copy ExclusiveAccountAutoRelease.7z to the Vault server
2. Configure Syslog translator file:

1. Copy ExAcAutoRls.xsl to PrivateArk \ Server \ Syslog folder
2. Configure ExAcAutoRls as a Syslog server in the dbparm.ini file by replacing the value <ExAcAutoRls_Server_IP> of SyslogServerIP  as following:

[SYSLOG]

SyslogTranslatorFile = Syslog\ExAcAutoRls.xsl

SyslogServerPort = 514

SyslogServerIP =  <ExAcAutoRls_Server_IP>

SyslogServerProtocol = UDP

SyslogMessageCodeFilter = 302-303

UseLegacySyslogFormat = no

ExAcAutoRls Server:

1. Copy the ExAcAutoRls folder to the server:
1. Edit the Vault.ini file and set the Vault IP address
2. Run the SetEnv.cmd script
3. Enter the administrator password
2. This will invoke PACLI script which does the following:
1. Create a least privilege local CyberArk user PSMExAcAutoRls_App in the vault
2. Add PSMExAcAutoRls_App as owner with "unlock file" permission only on all created safes excluding CyberArk safes such as System, PasswordManager etc.
3. Once the process is complete run the ExAcAutoRls.exe program (this can be scheduled by using Task Scheduler)