PAM logs for Saviynt SIEM integration

[Diwakar]

We have followed this below document to integrate the Saviynt to Sentinel to fetch all audit logs for Saviynt however analytics query mentioned the document is not fetching the PAM related audit data.

Saviynt SIEM Integration (saviyntcloud.com)

Can you please help to suggest single analytics that will fetch both Saviynt as well as PAM related logging data. From PAM side we need to capture complete details about privilege sessions, privilege requests and servers which were onboarded as endpoints.

[sudeshjaiswal]

Hello @Diwakar,

We are checking it internally, if it possible or not, we will confirm you shortly.

Thanks.

[sk]

@Diwakar : For PAM related analytics please refer doc: CPAM-SIEM-Integration.htm 

[Diwakar]

@sk I gone through the links however it didnt provided the query to how to fetch the audit data for PAM session requested, we need the audit data for PAM session requested by individual users like how we are getting for IGA for Saviynt SIEM integration Saviynt SIEM Integration (saviyntcloud.com)

Could you please help me with the similar analytics control to get all PAM sessions audit data?

Thanks,

Diwakar.

[Diwakar]

Hi Team,

Can you please provide an update on above query?

Thanks,

Diwakar

[sudeshjaiswal]

Hello @Diwakar,

There are 31 out of the box analytic controls for PAM and you can find the list by navigating to Admin -> Sav Roles -> ROLE_SAV_PAMOWNER and select "Analytics" tab. If you search here with name "session", you will be able to see 5 analytic controls (screenshot below). You can use these analytic controls as reference to create any other custom controls.

Thanks