BeyondTrust Password Safe

BeyondTrust Password Safe provides discovery, management, auditing, and monitoring for any privileged credential.

Asset Types Fetched

• Devices, Users, Roles, Groups, Activities, Application Resources

Before You Begin

Ports

• TCP port 80/443

Authentication Method

Use either of the following credentials to authenticate with the adapter:

• API Token
• OAuth 2.0 Client Credentials

APIs

Axonius uses the BeyondInsight and Password Safe API.

Permissions

The following permissions are required to fetch different asset types:

• Permissions AssetManagement.Read or ScanManagement.ReadWrite - Devices
• User Accounts Management (Read) - Users
• Secrets-Safe (Read) - Secrets
• Password Safe Account Management (Read) - Secrets
• Read access to the Smart Rule referenced by ID - Rules
• User Audit Management (Read) - Audit Activities

Initial Setup Instructions

Part 1 - Creating an API Registration

When authenticating with an API Token:

1. Log in to BeyondInsight BeyondTrust.
2. Navigate to Configuration> General> API Registrations.
3. In the API Registrations pane, click Create API Registration.
4. From the dropdown, select API Key Policy. The Details pane is displayed.
5. Under Name, type axonius.
6. Under Authentication Rules, click Add Authentication Rule.
7. In the Create New Authentication Rule pane that opens, select IP Rule, and under Type, select the type of the IP rule: Single IP Address, IP range, or CIDR per line.
8. Provide a valid source IP Address (IPv4 or IPv6), IP Range, or CIDR from which requests can be sent for this API key.
9. Click Create Rule.
10. Click Create Registration. BeyondInsight generates a unique identifier (API key) in the Key field. The API key is masked. Click the Show Key icon to show the key value.

When authenticating with OAuth 2.0 Client Credentials:

1. Log in to BeyondInsight BeyondTrust.
2. Navigate to Configuration> General> API Registrations.
3. In the API Registrations pane, click Create API Registration.
4. From the dropdown, select API Access Policy.
5. Set the Access Token Duration (how long OAuth tokens stay active).
6. Save the registration.
7. Navigate back to the Configuration screen.
8. Under Role Based Access, select User Management > Users.
9. Click Create New User, then select Add an Application User.
10. Under API Access Policy, select the API Registration you created earlier.
11. The Client ID and Client Secret are displayed. Copy and paste them into the corresponding Axonius fields (note the secret is only shown once).

The default Client Secret lifetime is 365 days. This is configurable in the Authentication Options.

Part 2 - Creating an Axonius Group

1. Navigate to Configuration > Role Based Access> User Management.
2. From the Groups tab, click + Create New Group.
3. Select Create a New Group.
4. Under Group Name, type 'Axonius', then click Create Group.
5. Add the API Registration created in Part 1 to the new group.

6. Create an ‘Axonius’ user and add it to the group.

Part 3 - Editing the Group Features

1. Navigate to the Axonius Group’s Features section.
2. Add the following permissions:
   • Asset Management - Read only
   • User Account Management - Read only

3. Navigate to the group’s Smart Groups section.
4. Add the following permissions:
   • All Assets in Password Safe - Read only. After adding this permission, click the Edit option next to it. Check the Information security administrator box and select Save Roles.
   • All Managed Accounts - Read only
   • All Managed Systems - Read only

Connecting the Adapter in Axonius

To connect the adapter in Axonius, provide the following parameters:

Required Parameters

1. Host Name or IP Address - The hostname or IP address of the BeyondTrust Password Safe server.
2. Authentication Methods - Select between the following options:

Optional Parameters

1. Verify SSL - Select whether to verify the SSL certificate offered by the value supplied in Host Name or IP Address. For more details, see SSL Trust & CA Settings.

2. HTTPS Proxy - A proxy to use when connecting to the value supplied in Host Name or IP Address.

3. HTTPS Proxy User Name - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

4. HTTPS Proxy Password - The password to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

1. Get auto managed information for accounts - Select this option to fetch the field 'Auto Managed'.
2. Do not fetch devices without an Asset ID - By default Axonius fetches all Managed Devices. Select this option to not fetch Managed Devices with an empty Asset ID.
3. Fetch platforms - Select this option to fetch device platforms.
4. Additional assets to fetch - From the dropdown, select one or more additional asset types to fetch.
5. Assets to fetch from Managed Systems - From the dropdown, select one or more additional assets to fetch from managed system devices.

Related Enforcement Actions

• BeyondTrust Password Safe - Manage Assets

Version Matrix

This adapter has only been tested with the versions marked as supported, but may work with other versions. Contact Axonius Support if you have a version that is not listed, and it is not functioning as expected.