CyberArk Privilege Cloud Audit Logs

Realm Security integrates with CyberArk Privilege Cloud to collect audit events (logins, password retrievals, administrative actions, and other privileged-access activity) via CyberArk's SIEM Integration API, for security monitoring and compliance.

Realm connects using OAuth 2.0 client credentials to obtain a bearer token from your CyberArk Identity tenant, combined with a static API key that CyberArk's SIEM Integration API requires on every request. All three values (Client ID, Client Secret, API Key) are generated together when you create a SIEM integration in CyberArk, and are stored together as a single credential in Realm.

Prerequisites

• Administrative access to your CyberArk Identity Security Platform tenant, specifically to the Setup space (sometimes called the Administration portal), with permission to create a SIEM integration.
• Realm console access to configure a CyberArk Privilege Cloud source.

Overview

1. CyberArk: Create a SIEM integration
2. CyberArk: Collect your Client ID, Client Secret, API Key, Identity Tenant URL, and API URL
3. Realm Console: Configure the CyberArk Privilege Cloud Input Feed

1. CyberArk: Create a SIEM Integration

CyberArk's Audit Stream API (the API Realm polls for events) is only reachable once a SIEM integration has been created for your tenant. Creating one provisions everything Realm needs: OAuth client credentials for authenticating to your Identity tenant, plus a separate API key that must be sent alongside the OAuth token on every request.

1. Log in to your CyberArk Identity Administration console.
2. Navigate to the Setup space, then to SIEM Integration (this may also appear under Ecosystem Integration depending on your tenant's console version).
3. Create a new SIEM integration (CyberArk's own documentation refers to this as integrating Audit with a "third-party SIEM application").
4. Apply/save the integration. CyberArk generates and displays the credentials you'll need in the next step.

Note: CyberArk's own setup flow and menu labels can change between console versions and tenant types. If the steps above don't match what you see, refer to CyberArk's official SIEM integration documentation for the exact current navigation in your tenant.

2. CyberArk: Collect Your Credentials

From the SIEM integration you created, collect the following five values. You'll enter all of them when configuring the Input Feed in Realm:

Value	Where it comes from
Client ID	The OAuth client credentials CyberArk generates for your SIEM integration's Identity Administration service account.
Client Secret	Generated alongside the Client ID. Store it securely — CyberArk typically only displays it once.
API Key	Generated specifically for the SIEM integration. Required on every Audit Stream API call in addition to the OAuth token.
Identity Tenant URL	Your CyberArk Identity tenant's OAuth token endpoint (e.g. https://<tenant-id>.id.cyberark.cloud). Realm uses this directly to request an access token via the client credentials grant.
API URL	The base URL for your tenant's Audit Stream API (e.g. https://<tenant-id>.audit.cyberark.cloud). Realm appends CyberArk's audit query endpoints to this URL.

Important: Client ID, Client Secret, and API Key are stored together as a single credential in Realm. If any one of them is rotated in CyberArk, update all three in the Realm console together — a stale value for any one of them will cause authentication to fail.

3. Realm Console: Configure the CyberArk Privilege Cloud Input Feed

1. Log in to the Realm console.
2. Go to Sources > Add and add a new Source.

   Name: CyberArk Privilege Cloud
   Description: CyberArk Privilege Cloud audit logs
   Format: CyberArk Privilege Cloud

3. Provide the following values, gathered from Step 2 above:

Field	Display Name	Required	Description
client_id	Client ID	Yes	Your CyberArk OAuth client ID.
client_secret	Client Secret	Yes	Your CyberArk OAuth client secret.
api_key	API Key	Yes	Your CyberArk SIEM integration API key.
identity_tenant_url	Identity Tenant URL	Yes	Your CyberArk Identity tenant's OAuth token endpoint. Must be a full https:// URL.
api_url	API URL	Yes	Your tenant's Audit Stream API base URL. Must be a full https:// URL.

Once saved, Realm begins polling CyberArk's Audit Stream API on the configured interval.

Troubleshooting

• Authentication errors: Confirm the Client ID and Client Secret belong to the same SIEM integration, and that the API Key hasn't been regenerated separately without updating Realm. All three values must match the same, currently-active SIEM integration.
• 403 or "forbidden" errors on an otherwise valid token: The API Key is missing, incorrect, or doesn't correspond to the SIEM integration your OAuth client credentials belong to — CyberArk's Audit Stream API requires both the bearer token and the API Key together.
• No events returned: Confirm identity_tenant_url and api_url are both the full https:// URLs for your specific tenant, not a generic or example URL, and that the SIEM integration is still active in CyberArk (deleting or disabling it revokes the credentials immediately).

Support

For additional details, refer to CyberArk's official SIEM integration documentation.

If you encounter any issues or require assistance, contact Realm Security support.