CyberArk Privilege Cloud Vault Integration

The CyberArk Privilege Cloud Vault integration enables Axonius to securely pull privileged credentials from CyberArk Privilege Cloud Vault. The integration helps to ensure that privileged credentials are secured in CyberArk Privilege Cloud Vault, rotated to meet company guidelines, and meet complexity requirements.

Description of Product Integration

Axonius uses the CyberArk Privilege Cloud API to fetch credentials from CyberArk Privilege Cloud Vault.

The credentials are only fetched by Axonius when:

• Creating a new adapter connection
• Updating an existing adapter connection
• Running an enforcement set
• Fetching asset information for adapters during discovery cycles

Axonius does not store the credentials anywhere and deletes any trace of credentials.

To enable fetching credentials from your CyberArk Privilege Cloud Vault, you need to:

1. Install and configure CyberArk Privilege Cloud Vault.
2. Configure login using CyberArk.
3. Have 'read' permissions for the passwords.
4. Enable and configure the External Password Managers - Enterprise Password Management Settings in Axonius.
5. Configure adapter connection credentials to fetch passwords from CyberArk Privilege Cloud Vault.

Enable CyberArk Privilege Cloud Vault Integration

You can add multiple domains (tenants) of the CyberArk Privilege Cloud to the external password manager. When setting up an Adapter, you can choose which domain you want to use.

1. Toggle on CyberArk Privilege Cloud Vault.

2. Specify the following parameters:

   • CyberArk Privilege Cloud domain (required) - The base URL of the Central Credential Provider (CCP).
   • Authentication Method (required; default: CyberArk) - The authentication method used for the connection. The following authentication methods are supported: CyberArk, Windows, LDAP, Radius, SAML, and OAuth2.

     📘

     Note

     • The recommended authentication method for users of the Cyberark cloud version is OAuth2 authentication.
     • OAuth2 only works with the cloud version.

   • Username and Password (required; optional for SAML authentication) - The credentials for a CyberArk Privilege Cloud user account that has the Required Permissions to fetch assets.
   • Tenant ID - Cloud Only (optional; required for OAuth2 authentication) - Enter your Cyberark Identity ID.
   • SAML Response (optional) - Required for the SAML authentication method.
   • Gateway Name (optional) - Select the gateway through which to connect to the CyberArk Privilege Cloud Vault if required.

3. If you want to add a domain (tenant), click + Add New CyberArk Privilege Cloud domain. Configure the CyberArk Privilege Cloud fields that open for the new domain as described in step 2.

APIs

Axonius uses the CyberArk REST API.

To use the SAML authentication method you need to enable the SAML IdP initiated SSO flow. Follow instructions in Configure the IdP to implement this. This returns the SAML Response.

Required Permissions

• The value supplied in User Name must have the built-in Privilege Cloud Users role as the minimum permissions.
• The following Safe-level permissions are required for the Axonius service account (added as a Safe member) to call the GET /PasswordVault/API/Accounts API endpoint:
  • List accounts - to see what accounts exist in the Safe
  • Retrieve accounts - to fetch the actual secret/password value

Additional Permissions:

• audit users - This permission is required only if you want to fetch Users from the adapter by calling the GET /PasswordVault/API/Users API endpoint.
• The Client ID/Secret permissions must be updated to match the Create a Service user for API requests section.
• If you are authenticating using OAuth2, you must update the domain to be .privilegecloud.cyberark.cloud. Example: https://ihg.privilegecloud.cyberark.cloud

Working with CyberArk Privilege Cloud Vault

Once the CyberArk Privilege Cloud Vault integration is enabled in Axonius, a new CyberArk Privilege Cloud Vault icon will appear in all password fields when configuring adapters or configuring Enforcement sets, allowing you to enter a password manually or to fetch the secret from CyberArk Privilege Cloud Vault. If you have configured more than one domain (tenant) for this vault, a vault icon will appear in the password field (same as when you configure more than one password manager).

To fetch the password from CyberArk Privilege Cloud Vault:

1. In a password field, click the CyberArk Privilege Cloud Vault icon. If you have configured more than one password manager (including more than one domain of the CyberArk Privilege Cloud), click the vault icon and select the required CyberArk Privilege Cloud Vault from the drop-down.

A CyberArk Privilege Cloud Vault dialog opens for the selected vault.

2. In the dialog, specify the following parameters:

   1. Account ID (required) - The account the password belongs to. It uses the endpoints login and get password. This is the backend ID for the account.

3. Click Fetch.

   • If the fetch is successful, a green indication is displayed next to the CyberArk Privilege Cloud Vault icon. Hovering over the CyberArk Privilege Cloud Vault icon shows the credentials that you input.

   • If the fetch is unsuccessful, a red indication is displayed next to the CyberArk Privilege Cloud Vault icon. Hovering over the Click CyberArk Privilege Cloud Vault icon shows the error.