---
url: https://docs.realmsec.info/integration/cyberark_privilege_cloud.md
---

# CyberArk Privilege Cloud Audit Logs

Realm Security integrates with CyberArk Privilege Cloud to collect audit events (logins,
password retrievals, administrative actions, and other privileged-access activity) via
CyberArk's SIEM Integration API, for security monitoring and compliance.

Realm connects using OAuth 2.0 client credentials to obtain a bearer token from your CyberArk
Identity tenant, combined with a static API key that CyberArk's SIEM Integration API requires
on every request. All three values (Client ID, Client Secret, API Key) are generated together
when you create a SIEM integration in CyberArk, and are stored together as a single credential
in Realm.

## Prerequisites

* Administrative access to your CyberArk Identity Security Platform tenant, specifically to
  the **Setup** space (sometimes called the Administration portal), with permission to create
  a SIEM integration.
* Realm console access to configure a CyberArk Privilege Cloud source.

## Overview

1. CyberArk: Create a SIEM integration
2. CyberArk: Collect your Client ID, Client Secret, API Key, Identity Tenant URL, and API URL
3. Realm Console: Configure the CyberArk Privilege Cloud Input Feed

## 1. CyberArk: Create a SIEM Integration

CyberArk's Audit Stream API (the API Realm polls for events) is only reachable once a SIEM
integration has been created for your tenant. Creating one provisions everything Realm needs:
OAuth client credentials for authenticating to your Identity tenant, plus a separate API key
that must be sent alongside the OAuth token on every request.

1. Log in to your CyberArk Identity Administration console.
2. Navigate to the **Setup** space, then to **SIEM Integration** (this may also appear under
   **Ecosystem Integration** depending on your tenant's console version).
3. Create a new SIEM integration (CyberArk's own documentation refers to this as integrating
   Audit with a "third-party SIEM application").
4. Apply/save the integration. CyberArk generates and displays the credentials you'll need in
   the next step.

> **Note:** CyberArk's own setup flow and menu labels can change between console versions and
> tenant types. If the steps above don't match what you see, refer to CyberArk's official
> [SIEM integration documentation](https://docs.cyberark.com/setup/latest/en/content/siem-integration/siem-export-3rd-party.htm)
> for the exact current navigation in your tenant.

## 2. CyberArk: Collect Your Credentials

From the SIEM integration you created, collect the following five values. You'll enter all of
them when configuring the Input Feed in Realm:

| Value | Where it comes from |
|---|---|
| **Client ID** | The OAuth client credentials CyberArk generates for your SIEM integration's Identity Administration service account. |
| **Client Secret** | Generated alongside the Client ID. Store it securely — CyberArk typically only displays it once. |
| **API Key** | Generated specifically for the SIEM integration. Required on every Audit Stream API call in addition to the OAuth token. |
| **Identity Tenant URL** | Your CyberArk Identity tenant's OAuth token endpoint (e.g. `https://<tenant-id>.id.cyberark.cloud`). Realm uses this directly to request an access token via the client credentials grant. |
| **API URL** | The base URL for your tenant's Audit Stream API (e.g. `https://<tenant-id>.audit.cyberark.cloud`). Realm appends CyberArk's audit query endpoints to this URL. |

> **Important:** Client ID, Client Secret, and API Key are stored together as a single
> credential in Realm. If any one of them is rotated in CyberArk, update all three in the
> Realm console together — a stale value for any one of them will cause authentication to
> fail.

## 3. Realm Console: Configure the CyberArk Privilege Cloud Input Feed

1. Log in to the Realm console.
2. Go to **Sources > Add** and add a new Source.
   > **Name:** `CyberArk Privilege Cloud`\
   > **Description:** `CyberArk Privilege Cloud audit logs`\
   > **Format:** `CyberArk Privilege Cloud`
3. Provide the following values, gathered from [Step 2](#2-cyberark-collect-your-credentials)
   above:

| Field | Display Name | Required | Description |
|---|---|---|---|
| `client_id` | Client ID | Yes | Your CyberArk OAuth client ID. |
| `client_secret` | Client Secret | Yes | Your CyberArk OAuth client secret. |
| `api_key` | API Key | Yes | Your CyberArk SIEM integration API key. |
| `identity_tenant_url` | Identity Tenant URL | Yes | Your CyberArk Identity tenant's OAuth token endpoint. Must be a full `https://` URL. |
| `api_url` | API URL | Yes | Your tenant's Audit Stream API base URL. Must be a full `https://` URL. |

Once saved, Realm begins polling CyberArk's Audit Stream API on the configured interval.

## Troubleshooting

* **Authentication errors:** Confirm the Client ID and Client Secret belong to the same SIEM
  integration, and that the API Key hasn't been regenerated separately without updating Realm.
  All three values must match the same, currently-active SIEM integration.
* **403 or "forbidden" errors on an otherwise valid token:** The API Key is missing, incorrect,
  or doesn't correspond to the SIEM integration your OAuth client credentials belong to —
  CyberArk's Audit Stream API requires both the bearer token and the API Key together.
* **No events returned:** Confirm `identity_tenant_url` and `api_url` are both the full
  `https://` URLs for your specific tenant, not a generic or example URL, and that the SIEM
  integration is still active in CyberArk (deleting or disabling it revokes the credentials
  immediately).

## Support

For additional details, refer to CyberArk's official
[SIEM integration documentation](https://docs.cyberark.com/setup/latest/en/content/siem-integration/siem-export-3rd-party.htm).

If you encounter any issues or require assistance, contact Realm Security support.