Axonius Documentation
  1. Connecting Adapters
  2. Adapters C

CyberArk Endpoint Privilege Manager

CyberArk Endpoint Privilege Manager enforces least privilege, providing credential theft protection and application control at scale.

Use Cases the Adapter Solves

  • Endpoint Privilege Visibility: Maintain an inventory of all managed endpoints, including connection status, agent version, and assigned policy sets, to support least-privilege enforcement and audit readiness.
  • Software and Application Control Auditing: Surface installed programs and application events across endpoints to identify unauthorized software and validate application control policies.

Types of Assets Fetched

This adapter fetches the following types of assets:

  • Devices, Software, SaaS Applications

Data Retrieved through the Adapter

Devices - fields such as: Hostname, IP Addresses, OS, Last Seen, Logged-in User

Software - fields such as: Application Name, Version, Publisher, Installation Date (when Fetch Installed Programs is enabled)

Before You Begin

Required Ports


  • TCP port 443 (HTTPS) — to the CyberArk EPM server
  • TCP port 443 (HTTPS) — to *.id.cyberark.cloud (required only when using the ISPSS authentication method)

Authentication Methods

The adapter supports the following authentication methods:

  • EPM — Authenticates using a CyberArk EPM local account username and password.
  • Windows — Authenticates using Windows (NTLM) credentials.
  • ISPSS — Authenticates via OAuth 2.0 Client Credentials against CyberArk Identity Administration (for customers migrated to the centralized ISPSS platform). Requires a service account configured as an OAuth confidential client in Identity Administration, an EPM API web app alias, and the Identity Administration sub-domain.
  • SAML / SSO — Authenticates via a SAML 2.0 Identity Provider using the Use SSO Authentication toggle.

Setting Up CyberArk Endpoint Privilege Manager to Work with Axonius


  1. In CyberArk EPM, create or identify a user account with read-only access and the Allow to manage sets permission enabled.
  2. Note the Application ID — this is a unique value registered in CyberArk EPM to identify the Axonius integration.

Connecting the Adapter in Axonius

  1. Navigate to the Adapter Catalog, search for CyberArk Endpoint Privilege Manager, and select the adapter.
  2. Click Add Connection.
  3. Provide the following parameters.

Required Parameters

  1. Host Name or IP Address - The hostname or IP address of the CyberArk Endpoint Privilege Manager server.
  2. Authentication Method - The authentication method used for the connection. The following methods are supported: EPM, Windows, or ISPSS. To use SAML, select Use SSO Authentication.

Application ID - The Application ID which is a unique value to identify the "Axonius" application. This is a unique value that has not been used in CyberArk EPM.

User Name and Password - The credentials for a user account that has the Required Permissions to fetch assets.


CyberArkEnpintPrivilegeManager

Optional Parameters

  1. Verify SSL (default: False) - Choose whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.
  2. HTTPS Proxy - Connect the adapter to a proxy instead of directly connecting it to the domain.
  3. HTTPS Proxy User Name - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.
  4. HTTPS Proxy Password - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

Advanced Settings

📘

Note

Advanced settings can either apply to all connections for this adapter, or to a specific connection. Refer to ​Advanced Configuration for Adapters.

  1. Fetch events - Select this option to fetch event info, file info, source, pre-history and reputation information from CyberArk
  2. Fetch policies - Select this option to fetch policies and enrich the computers (devices) with matching policies under the field "Policies".
📘

Note

Fetching policies might increase the fetch time significantly.

  1. Fetch OS info - Select this option to fetch more OS information data (such as the OS build).

  2. Fetch installed programs - Select this option to fetch installed software information from endpoints. When enabled, the adapter fetches software inventory data including application names, versions, publishers, and installation dates.

  3. Customize rate limits - Toggle on this option to customize rate limits. Use the options below to limit the number of requests the adapter sends per unit of time.

    • Number of requests per second (default: 5) - Set the number of requests per second. Set the number of seconds to send the request in 'Number of seconds'.

    • Number of seconds - Set the number of seconds during which the requests will be sent.

📘

Note

To learn more about Adapter Configuration tab advanced settings, see Adapter Advanced Settings.

APIs

Axonius uses the CyberArk EPM Web Services REST API to retrieve asset data. The following endpoints are called:

  • POST EPM/API/Auth/{auth_method}/Logon - Authenticate using EPM or Windows credentials
  • POST EPM/API/SAML/Logon - Authenticate using SAML/SSO
  • POST https://{sub_domain}.id.cyberark.cloud/oauth2/token/{app_alias} - Obtain OAuth 2.0 access token (ISPSS authentication only)
  • GET EPM/API/Sets - Fetch device sets (groups)
  • POST EPM/API/Endpoints/search - Search and fetch endpoints (devices)
  • GET EPM/API/Computers - Fetch computers (legacy API)
  • POST EPM/API/Policies/Server/Search - Search policies (when Fetch Policies is enabled)
  • GET EPM/API/Policies/Server/{policy_id} - Fetch policy details (when Fetch Policies is enabled)
  • POST EPM/API/Events/Search - Fetch events (when Fetch Events is enabled)
  • GET EPM/API/endpoints/inventory/OsInfo - Fetch OS inventory (when Fetch OS Info is enabled)
  • GET EPM/API/endpoints/inventory/installedPrograms - Fetch installed programs (when Fetch Installed Programs is enabled)

Required Permissions

The value supplied in User Name must include enabled "Allow to manage sets" for the user profile and set to read only.

Updated 3 days ago

Did this page help you?