Delinea Secret Server (Thycotic)

Delinea Secret Server (formerly Thycotic) is a Privileged Access Management (PAM) solution for protecting your privileged accounts, available both on premise or in the cloud.

The Delinea Secret Server adapter enables Axonius to fetch and catalog privileged account assets, including devices, users, groups, and secrets, ensuring comprehensive visibility into privileged access management and security compliance.

Asset Types Fetched

• Devices, Users, Roles, Groups, Secrets, Application Resources

Before You Begin

Required Ports

• TCP port 443

Authentication Methods

• User Name and Password

Required Permissions

The value supplied in User Name must be a local Delinea user with the following role permissions:

• View Folders
• View Groups
• View Roles
• View Secret
• View Users
• View Devices
• View Discovery

For more information, see the Secret Server Role Permissions List.

APIs

• Axonius uses the Secret Server REST API to retrieve asset data.
• Vaults use Secret Server REST API permissions.
• Rules use Get SDK Client Rule.
• Permissions use Secret Server REST API Get Roles for user and Secret Server REST API Get Role Permissions.
• Users use Folder Permissions API.
• Devices use Secret Server REST API Get Server Nodes.
• Devices can also use Discovery Network Items API

Axonius calls the following endpoints:

Connection Parameters

To connect the adapter in Axonius, provide the following parameters.

Required Parameters

1. Delinea Secret Server URL - Enter the full URL of the Delinea Secret Server:
   • For on-premises Delinea Secret Server, needs to be in the following format: https://<hostname>/SecretServer (for example: https://demo-server/SecretServer)
   • For cloud-based Delinea Secret Server, needs to be in the following format: https://<tenant>.secretservercloud.com (for example: https://mycompany.secretservercloud.com)
2. User Name and Password - Enter the credentials of a local Delinea user that has the Required Permissions to fetch assets.
3. Port - Enter the port number that is used for the connection.

Optional Parameters

1. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

2. HTTPS Proxy - Enter an HTTPS proxy address to connect the adapter to a proxy instead of directly connecting it to the domain.

3. HTTPS Proxy User Name - Enter the user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

4. HTTPS Proxy Password - Enter the password to use when connecting to the server using the HTTPS Proxy.

To learn about additional optional/common adapter connection parameters, see Adding a New Adapter Connection.

Advanced Settings

• Ignore disabled users - Select to not fetch disabled users.
• Fetch Vaults - Select this option to fetch the secrets the user has access to.
• Fetch Rules - Select this option to fetch the SDK rules affecting the user.
• Fetch Users Roles and Permissions - Select this option to fetch the users roles and permissions the user has.
• Fetch Groups - Select this option to fetch groups.
• Fetch Devices - Select this option to fetch devices.
• Fetch Folder Permissions - Select this option to fetch permissions associated with folders.
• Parse secrets (with username values) as Users - Select this option so that secrets containing a Username extended field will be surfaced as User entities in Axonius. This allows you to track managed service accounts stored in Delinea Secret Server alongside regular user accounts.
• Fetch Secret Details (Username and Notes) - Select this option to fetch the details of each secret in order to parse its Username and Notes fields. This setting requires Fetch Vaults and sends one additional API request for each secret. Secrets that require check-out or approval are skipped.
• Fetch Discovered Computers - Select this option to fetch computers from the Discovery Network Items endpoint. Required for Delinea Cloud Secret Server instances.
• Enable Fetch Lists Items - Select this option to fetch list items from Delinea Secret Server. If selected, the following sub-options are relevant:
  • Filter lists by listID - Enter a comma-separated list of List IDs to fetch only specific lists.
  • Filter by Category - Enter a category name to filter the fetched lists.
  • Filter by Active Lists - Select this option to fetch only active lists.

Related Enforcement Actions

• Thycotic - Enable User
• Thycotic - Suspend User

Version Matrix

This adapter has only been tested with the versions marked as supported, but may work with other versions. Please contact Axonius Support if you have a version that is not listed and it is not functioning as expected.