[SAASINT-5127] DDS: CyberArk Endpoint Privilege Manager: Crawler Integration v1.0.0 #22120

tirthrajchaudhari-crest · 2025-12-15T13:45:31Z

What does this PR do?

This is a initial release PR of CyberArk Endpoint Privilege Manager integration including all the required assets.
Integration Logo Source: https://upload.wikimedia.org/wikipedia/commons/thumb/e/e8/Cyberark-logo-dark.svg/1024px-Cyberark-logo-dark.svg.png

Additional Notes

Crawler code for this integration has been committed in its respective repo
OOTB detection rules JSON would be shared separately with the required teams as a part of separate repository.
Since during the standard attribute remapping we are not preserving the source attributes as per suggested best practices, it would result in filters using these standard attributes populating the values of other integrations as well as per current Datadog behaviour.

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

drichards-87 · 2025-12-15T18:04:45Z

Created DOCS-12917 for Docs Team review.

…ttps://github.com/bhargavnariyanicrest/integrations-core into cyberark-endpoint-privilege-manager-assets-v1.0.0

evazorro · 2025-12-17T20:37:32Z

cyberark_endpoint_privilege_manager/README.md

+   - Password
+   - Confirm Password
+6. Select the **Account Administrator** checkbox and choose the **View Only** option.
+7. Select **Allow to manage Sets** checkbox.


Suggested change

7. Select **Allow to manage Sets** checkbox.

7. Select the **Allow to Manage Sets** checkbox.

evazorro · 2025-12-17T20:38:22Z

cyberark_endpoint_privilege_manager/README.md

+- **Set Admin Audit Events**: Provides detailed audit records for actions carried out by EPM administrators within sets.
+- **Account Admin Audit Events**: Provides detailed audit records for actions performed by account administrators.
+
+Integrate CyberArk Endpoint Privilege Manager with Datadog to gain insights into raw events, policy adit events, set admin audit events, and account admin audit events  using pre-built dashboard visualizations. Datadog uses its built-in log pipelines to parse and enrich these logs, facilitating easy search and detailed insights. Additionally, the integration can be used for Cloud SIEM detection rules for enhanced monitoring and security.


Suggested change

Integrate CyberArk Endpoint Privilege Manager with Datadog to gain insights into raw events, policy adit events, set admin audit events, and account admin audit events using pre-built dashboard visualizations. Datadog uses its built-in log pipelines to parse and enrich these logs, facilitating easy search and detailed insights. Additionally, the integration can be used for Cloud SIEM detection rules for enhanced monitoring and security.

Integrate CyberArk Endpoint Privilege Manager with Datadog to gain insights into raw events, policy audit events, set admin audit events, and account admin audit events using pre-built dashboard visualizations. Datadog uses its built-in log pipelines to parse and enrich these logs, facilitating easy search and detailed insights. Additionally, the integration can be used for Cloud SIEM detection rules for enhanced monitoring and security.

evazorro · 2025-12-17T20:39:20Z

cyberark_endpoint_privilege_manager/README.md

+
+This integration ingests the following logs:
+
+- **Raw Events**: Provides detailed records of endpoint activities captured by EPM agents, including threat detection events.


Suggested change

- **Raw Events**: Provides detailed records of endpoint activities captured by EPM agents, including threat detection events.

- **Raw Events**: Endpoint activities captured by EPM agents, including threat detection events.

I wanted to remove some of the repetitive language on these bullets. Feel free to reword further.

evazorro · 2025-12-17T20:39:39Z

cyberark_endpoint_privilege_manager/README.md

+This integration ingests the following logs:
+
+- **Raw Events**: Provides detailed records of endpoint activities captured by EPM agents, including threat detection events.
+- **Policy Audit Events**: Provides detailed audit records which gives immediate picture of policy usage on endpoints.


Suggested change

- **Policy Audit Events**: Provides detailed audit records which gives immediate picture of policy usage on endpoints.

- **Policy Audit Events**: Audit records of policy usage on endpoints.

evazorro · 2025-12-17T20:39:48Z

cyberark_endpoint_privilege_manager/README.md

+
+- **Raw Events**: Provides detailed records of endpoint activities captured by EPM agents, including threat detection events.
+- **Policy Audit Events**: Provides detailed audit records which gives immediate picture of policy usage on endpoints.
+- **Set Admin Audit Events**: Provides detailed audit records for actions carried out by EPM administrators within sets.


Suggested change

- **Set Admin Audit Events**: Provides detailed audit records for actions carried out by EPM administrators within sets.

- **Set Admin Audit Events**: Actions carried out by EPM administrators within sets.

evazorro · 2025-12-17T20:39:55Z

cyberark_endpoint_privilege_manager/README.md

+- **Raw Events**: Provides detailed records of endpoint activities captured by EPM agents, including threat detection events.
+- **Policy Audit Events**: Provides detailed audit records which gives immediate picture of policy usage on endpoints.
+- **Set Admin Audit Events**: Provides detailed audit records for actions carried out by EPM administrators within sets.
+- **Account Admin Audit Events**: Provides detailed audit records for actions performed by account administrators.


Suggested change

- **Account Admin Audit Events**: Provides detailed audit records for actions performed by account administrators.

- **Account Admin Audit Events**: Actions performed by account administrators.

…-v1.0.0

Add assets for CyberArk EPM integration

186be87

temporal-github-worker-1 bot added docs/review-requested ecosystems/review-requested product/review-requested labels Dec 15, 2025

datadog-agent-integrations-bot bot added documentation dev/testing dev/tooling qa/skip-qa Automatically skip this PR for the next QA labels Dec 15, 2025

tirthrajchaudhari-crest added 2 commits December 15, 2025 19:25

Update pipeline yaml file

52c6444

Resolve validate-logs CI check

fcb5a74

tirthrajchaudhari-crest marked this pull request as ready for review December 15, 2025 14:10

tirthrajchaudhari-crest requested review from a team as code owners December 15, 2025 14:10

datadog-agent-integrations-bot bot added team/agent-integrations team/documentation team/logs-integrations-reviewers team/saas-integrations labels Dec 15, 2025

drichards-87 self-assigned this Dec 15, 2025

drichards-87 added the editorial review Waiting on a more in-depth review from a docs team editor label Dec 15, 2025

drichards-87 removed their assignment Dec 15, 2025

akaila-crest and others added 3 commits December 16, 2025 17:33

minor README update

72fd560

Minor dashboard updates

7c1f07a

Merge branch 'cyberark-endpoint-privilege-manager-assets-v1.0.0' of h…

21de026

…ttps://github.com/bhargavnariyanicrest/integrations-core into cyberark-endpoint-privilege-manager-assets-v1.0.0

evazorro requested changes Dec 17, 2025

View reviewed changes

temporal-github-worker-1 bot added docs/requested-changes and removed docs/review-requested labels Dec 17, 2025

update README as per review comments

b5f6042

Update README.md

11a927e

tirthrajchaudhari-crest requested a review from evazorro December 18, 2025 09:19

Resolve validate-dashboards CI check

dd40bec

evazorro approved these changes Dec 18, 2025

View reviewed changes

temporal-github-worker-1 bot added docs/approved and removed docs/requested-changes labels Dec 18, 2025

Merge branch 'master' into cyberark-endpoint-privilege-manager-assets…

3441c02

…-v1.0.0

tirthrajchaudhari-crest changed the title ~~DDS: CyberArk Endpoint Privilege Manager: Crawler Integration v1.0.0~~ [SAASINT-5127] DDS: CyberArk Endpoint Privilege Manager: Crawler Integration v1.0.0 Jan 23, 2026

Resolve merge conflicts

86335a0

	7. Select Allow to manage Sets checkbox.
	7. Select the Allow to Manage Sets checkbox.


		This integration ingests the following logs:

		- Raw Events: Provides detailed records of endpoint activities captured by EPM agents, including threat detection events.

	- Raw Events: Provides detailed records of endpoint activities captured by EPM agents, including threat detection events.
	- Raw Events: Endpoint activities captured by EPM agents, including threat detection events.

	- Policy Audit Events: Provides detailed audit records which gives immediate picture of policy usage on endpoints.
	- Policy Audit Events: Audit records of policy usage on endpoints.

	- Set Admin Audit Events: Provides detailed audit records for actions carried out by EPM administrators within sets.
	- Set Admin Audit Events: Actions carried out by EPM administrators within sets.

	- Account Admin Audit Events: Provides detailed audit records for actions performed by account administrators.
	- Account Admin Audit Events: Actions performed by account administrators.

[SAASINT-5127] DDS: CyberArk Endpoint Privilege Manager: Crawler Integration v1.0.0 #22120

Are you sure you want to change the base?

[SAASINT-5127] DDS: CyberArk Endpoint Privilege Manager: Crawler Integration v1.0.0 #22120

Uh oh!

Conversation

tirthrajchaudhari-crest commented Dec 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Additional Notes

Review checklist (to be filled by reviewers)

Uh oh!

drichards-87 commented Dec 15, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

tirthrajchaudhari-crest commented Dec 15, 2025 •

edited

Loading