CyberArk Telemetry Tool Repurposed for CyberArk On-Prem to your SIEM

June 3, 2023

Don’t want to send CyberArk your Telemetry data?

This blog is a walkthrough on installing, configuring, and deploying CyberArk Telemetry tool and script to send the data to your SIEM for your CyberArk On-Prem environment. This is building upon what James Creamer from CyberArk has previously blogged about.

Purpose:

To use CyberArk’s Telemetry tool for On-Prem CyberArk environments only (don’t send data to CyberArk), and instead send the data to your SIEM. This then allows you to create your own related dashboards.

Prerequisites —

On-Prem CyberArk environment, NOT CyberArk P-Cloud
Utility Server to run the Telemetry Tool, and related scheduled tasks
CyberArk Telemetry Tool, downloaded from the CyberArk Marketplace — https://cyberark-customers.force.com/mplace/s/#a352J000000lB1MQAU-a392J000001eKbDQAU
My forked TelemetryTool2SIEM Powershell script — https://github.com/aglerj/TelemetryTool2SIEM .
Your SIEM configured to ingest the syslog data we’re sending. For example, listen on port 9997, and send those events into index=cyberark. It depends on how your SIEM environment is configured. Check with your SIEM team on what the correct information is.

Step 1: CyberArk Telemetry tool setup

Download, extract and run Install the CyberArk Telemetry Tool to the default path on your utility server. When installing, do not provide a CyberArk key, etc. related to the Telemetry install.

Edit the InstallCyberArkTelemetry.json file

Update the InstallCyberArkTelemetry.json file to include your correct Vault IP and/or Vault VIP IP.

Run Powershell as admin within the extracted Telemetry tool folder — .\InstallCyberArkTelemetry.ps1 …follow along above on the prompts. Don’t choose to utilize the CyberArk dashboard or related keys, etc.

Enter in the vault administrator account password when prompted. Skip creating the SalesForce hash.

Step 2: Update the config.json file under ConfigFiles

Adjust the config.json file’s outputAdapters section to only have the jsonfileoutputadapter like shown below. Or, download the config.json file from my github repo (https://github.com/aglerj/TelemetryTool2SIEM/blob/main/config.json), and replace the existing one the Telemetry tool creates.

“outputAdapters”: [ { “name”: “JsonFileOutputAdapter”, “type”: “CyberArk.Telemetry.Output.File.JsonFileOutputAdapter, CyberArk.Telemetry.Output.File”, “enabled”: true, “adapterSettings”: {“outputFilePath”: “Output\telemetryData_#date#.json”} } ]

Open the ConfigFiles folder, then edit the config.json file. You can replace this with the json file on my github instead if of editing if you like.

Remove the section related to the SalesForceOutputAdapter at the bottom of hte config.json file.

Enable the JsonFileOutputAdapter piece. This makes the Telemetry tool only create a local Json file with the extracted data.

Step 3: Download and update the Script

Download the PowerShell script — https://github.com/aglerj/TelemetryTool2SIEM/blob/main/TelemetryToolETL.ps1 . Update the script to utilize your correct SIEM IP and Port. Note that this script utilizes UDP.

#Update to use your Syslog VIP IP here $Syslogserver=”192.168.65.200"

#Update to use your syslog port $port = “9997”

Update the downloaded TelemetryToolETL.ps1 script for your syslog server IP (or VIP IP), and port. This script uses UDP.

Step 4: Staging the Script

Stage the updated PowerShell script on the utility server that runs your CyberArk Telemetry Tool scheduled task. On that machine, navigate to the default CyberArk Telemetry folder (C:/Program Files/CyberArk/CyberArk Telemetry). Paste the updated PowerShell script within the ETL folder.

Step 5: Modify the Scheduled Task

Launch task scheduler and edit the CyberArk Telemetry task by right clicking on it and selecting properties. Under the Actions tab, add a new action to launch the PowerShell script. Program/script: powershell Add arguments (optional): -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -File “C:\Program Files\CyberArk\CyberArk Telemetry\ETL\TelemetryToolETL.ps1” Press OK.

CyberArk Telemetry scheduled task is created.

Edit the CyberArk Telemetry scheduled task. Create a new action item to run.

Update to start powershell, and for add arguments field, populate: -NoProfile -NoLogo -NonInteractive -ExecutionPolicy Bypass -File “C:\Program Files\CyberArk\CyberArk Telemetry\ETL\TelemetryToolETL.ps1”

This is how the updated schedule task will look.

Step 6: Run the Scheduled Task on-demand

Right click on the scheduled task and run on-demand. Wait for the scheduled task to finish.

Here’s an example json file that is created after the scheduled task items have successfully ran

Step 7: Checking the output

Log into your SIEM. Wait a few minutes for the events to be indexed. Search your related SIEM index, such as index=cyberark | search “CyberArk Telemetry”.