Events for the Splunk Add-on for Cyberark EPM

Here are some of the most relevant EPM events you can collect.

Admin Audit Logs

• Action carried out by EPM administrator.

Credential theft

• Browsers
• IT applications
• Remote Access Applications
• Windows OS

Privilege threats

Request to boot in Safe Mode Request to set "Always Install Elevated" Privilege deception Privilege Management events

High risk applications

• CMD
• PowerShell
• admin tasks (e.g. mmc, local groups, network settings, etc.)
• Unsigned applications that require elevation
• Blocked applications due to organization policy
• Creation of a JIT policy

You can identify these events using a combination of output fields (like EventName, EventType, PolicyName, Action etc.) as described in your CyberArk EPM documentation.