PAM Audit Log forwarding from Saviynt to Splunk

[UVP]

Hi Team,

Is it possible to send PAM audit logs for below activities :

1. Users login activity into Saviynt
2. Access Assignment to privilege accounts - information like user requested endpoint details , PAM request workflow and approver details .
3. Need information on different Users viewing the account credentials along with allotted time frame details

Let me know if we have any OOTB analytical report for the same.

Thanks,

Umesh

[NageshK]

@UVP Thanks for posting your question in the forums. Please find below the different out of the box analytics available for PAM. Review these and let us know if these are sufficient for your reporting requirements. 

Active SSH Keys
All Approved Requests
All Active Requests
Sessions terminated by Admins
All credential access sessions
Vaulted DB Secrets
Vaulted Windows Secrets
Secrets not rotated since 90 days
Privileged accounts not logged in since 90 days
Expired Privileged Accounts
Locked Privileged Accounts
All Privileged Accounts
Expired Password Privileged Accounts
Most used privileged accounts
Inactive users with active sessions
Unmanaged privileged accounts
Bootstrap failed endpoints
Pending FF Tasks
Discontinued FF Tasks
Completed FF Tasks
Errored out FF Tasks
Most accessed endpoints
Active privileged launched sessions
All Created Requests
Unmanaged Workloads
PAM controlled Endpoints
Users with more than 10 Active Privileged Sessions
All rejected requests
Active Privileged Accounts Checked-Out
Vaulted Service Account Keys
Vaulted IAM Accounts

Also here is the doc portal link that explains the integration between EIC and Splunk

https://docs.saviyntcloud.com/bundle/Splunk-Guide/page/Content/Understanding-the-Integration-between...

[UVP]

Thanks Nagesh.

Do we have any Saviynt document providing more information on these analytical report?