CyberArk

Documentation Index

Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt

Use this file to discover all available pages before exploring further.

​

Overview

Wirespeed connects to CyberArk Identity Security Platform Shared Services (ISPSS) to:

• Sync users from both CyberArk Privilege Cloud (vault accounts) and CyberArk Identity (federated directory users).
• Ingest audit events from PAM (Privilege Cloud), IDP (Identity), and ADM (Admin) services as logs, with high-signal events (auth failures, unauthorized access, MFA risk checks) also ingested as detections.
• Contain users via Privilege Cloud (disable / enable / terminate PSM sessions) and Identity Administration (lock / unlock / terminate SSO sessions), automatically routed based on which population the user came from.

​

Prerequisites

You will need:

• A CyberArk Identity Security Platform Shared Services (ISPSS) tenant with Privilege Cloud, Identity, and/or Admin services enabled.
• Permission to create OAuth2 web apps and service users in Identity Administration.
• Permission to create a SIEM integration entry in the Privilege Cloud Administration space.

​

Setup

The setup involves four pieces in your CyberArk tenant:

1. A service user to authenticate as.
2. Two role assignments for that service user (one for Privilege Cloud, one for Identity Administration).
3. One OAuth2 Server web app (used only for the audit/SIEM stream).
4. A SIEM integration entry to mint an API key.

Follow the steps below in order.

​

Step 1 — Create the service user

1. Sign in to Identity Administration as an administrator.
2. Go to Core Services → Users and click Add User.
3. Fill in the user’s details. Set the username to something memorable, e.g. wirespeed-svc@<your-tenant>. The @<your-tenant> suffix is appended automatically.
4. Under Status, check:
   • Is Service User
   • Is OAuth confidential client
   • Password never expires
5. Click Create User. Note the username and password — you will need them later.

​

Step 2 — Assign roles to the service user

The service user needs two role assignments — one to manage Identity directory operations and one to access Privilege Cloud APIs.

​

2a. Identity Administration role

1. Go to Core Services → Roles and click Add Role.
2. Name it (e.g. Wirespeed Integration).
3. On the Administrative Rights tab, add:
   • User Management — required for syncing and locking Identity directory users.
   • Report Management — required for the Redrock query that pulls federated directory users (DsUsers).
4. On the Members tab, add the service user.
5. Click Save.

​

2b. Privilege Cloud admin role

1. In Identity Administration, find the built-in Privilege Cloud Administrators role (or any role that grants the equivalent rights — see CyberArk’s Privilege Cloud roles documentation).
2. On the Members tab, add the service user.
3. Click Save.

​

Step 3 — Create the audit OAuth2 web app (Server template)

This app is used only for the SIEM Audit API. All other Wirespeed API calls use a generic platform token, which doesn’t require a custom web app.

1. Go to Apps & Widgets → Web Apps and click Add Web Apps.
2. On the Custom tab, find OAuth2 Server, click Add, and confirm.
3. On the Settings tab, set:
   • Application ID: WirespeedAudit (or any URL-safe identifier — note it for later).
   • Application Name: Wirespeed Audit.
4. On the General Usage tab, set Client ID Type to Confidential.
5. On the Tokens tab, set:
   • Token Type: JwtRS256.
   • Auth Methods: enable Client Creds.
   • Token Lifetime: at least 15 minutes.
6. On the Scope tab, click Add and create one scope:
   • Name: isp.audit.events:read
7. On the Advanced tab, paste this script and Save:
   setClaim('tenant_id', TenantData.Get("CybrTenantID"));
   setClaim('aud', 'cyberark.isp.audit');
   
8. On the Permissions tab, add the service user from Step 1 with Run, View, Grant, and Automatically Deploy permissions.
9. Click Save at the top.

​

Step 4 — Create the SIEM integration entry

1. Switch to the Administration space (the tenant-level admin portal).
2. Go to My environment → Integrations → Export to SIEM.
3. Click Create → Create SIEM integration.
4. Give it a name (e.g. Wirespeed) and click Apply.
5. Note the API key that’s generated — it’s only shown once. The page also displays an API base URL; you generally don’t need to copy it (Wirespeed derives it from the platform token), but keep it handy in case auto-derivation doesn’t work for your tenant.

​

Step 5 — Connect Wirespeed

1. In Wirespeed, go to Integrations → Add Integration → CyberArk.
2. Acknowledge the Beta notice.
3. Provide:

   Field	Value
   Identity URL	Your Identity Admin URL, e.g. https://aab1234.id.cyberark.cloud (copy from the address bar of the Identity Admin portal).
   Audit OAuth2 Server App ID	The Application ID from Step 3 (e.g. WirespeedAudit).
   Service User Login	The full login from Step 1, including the tenant suffix (e.g. wirespeed-svc@aab1234).
   Service User Password	The password from Step 1.
   SIEM API Key	The API key from Step 4.

4. Click Add. Wirespeed mints a platform token, derives your Privilege Cloud subdomain from it, and kicks off the first audit + user sync.

​

What gets ingested

​

Users (daily at 14:00 UTC, plus immediately on connect)

Wirespeed syncs from both CyberArk user populations because they’re distinct sets with different containment paths: Each user’s directoryId is prefixed with the source (pcloud:17, ds:a41ca4c8-…) so the containment actions know which API to call. A single human may appear once under each prefix if they exist in both populations. Component users (CPM, PSM, ENE, etc.) are filtered out of the PCloud sync — only real human and service accounts are surfaced.

​

Audit logs (every minute)

Wirespeed polls the SIEM Audit API for events under three application codes:

• PAM — Privilege Cloud (vault auth, credential access, privileged sessions, credential rotation, safe management).
• IDP — Identity (auth, MFA, logout, SAML, risk checks).
• ADM — Admin (access control, user management, configuration changes).

On first connection, Wirespeed backfills the last 7 days of events (the audit stream’s retention window). After that, polling resumes from a cursor.

​

Detections

A subset of high-signal events are also ingested as detections and routed through Wirespeed’s verdict / monitor pipeline: All other events flow as logs only.

​

Containment

While the integration is in Beta, all containment actions return an error indicating containment is not yet enabled. Once promoted to GA, the following actions become available:

​

Limits and caveats

• Audit stream retention: 7 days. If Wirespeed can’t poll for longer than that (e.g. extended outage), the gap is unrecoverable.
• Audit stream rate limit: 1 API call per minute per integration. Wirespeed polls on a 1-minute cron and respects this.
• PasswordVault user list: capped at 6,000 users in a single response. Larger vault tenants would currently be truncated.
• SIEM integrations per tenant: 2. Wirespeed consumes one.
• Service user credentials: rotate the service user’s password in Identity Administration, then update it in the Wirespeed integration settings.
• PSM live-session termination requires AllowPSMNotifications=Yes in PVWA and the service user to be in the Terminating Live Sessions Users and Groups vault config group. Without that, only SSO-side session termination works (still effective for blocking new privileged sessions).

​

Troubleshooting

If you see authentication errors after setup, the most common causes are: