Audit Logs for Privileged Access Management

[mansoorahmed1]

HI,

We have done our Saviynt to Sentinel Intgeration to export the audit logs to SIEM application, we are planning to do the same for PAM in Saviynt . We have the below requirements , I want to know how this can be extracted from Saviynt through analytics via Saviynt API .

1. Audit Trail of Password operations ie. Creation , rotation , Timestamp, mode of operation (automatic or manual).

2. Audit Trail for Privileged Sessions  ie who , accessed what endpoint through which account and what time  (User, Endpoint and / or Accounts used , Timestamp , Ip address(Source) , Activities etcs. -  For this I have identified Session_launch_Detail table and probably have to join other tables to extract missing details for this details.

if any one has implemeted or created analytics to capture the audit related data for PAM in Saviynt kindly guide me on this since Saviynt Documentation is very poor with respect to PAM for this kind of use case.

Regards,

Mansoor Ahmed  

[NageshK · Accepted solution]

@mansoorahmed1 Thanks for posting your question. We are in the process of creating an article for this. Meanwhile please find below the details:

There are 31 out of the box analytic controls for PAM and you can find the list by navigating to Admin -> Sav Roles -> ROLE_SAV_PAMOWNER and select "Analytics" tab. If you search here with name "session", you will be able to see 5 analytic controls (screenshot below). You can use these analytic controls as reference to create any other custom controls.

Also, for your SIEM integration are you using an SFTP connector to perform the export?

  Thanks

Nagesh K

[mansoorahmed1]

Thank you for the response. 

To Answer your question , no we are using Azure Function (Pythonapp to call the Saviynt API and to post the JSON data to Sentienel LAW.

Regards,

Mansoor Ahmed