How can a PAM Admin check what policies were changed

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

[Use case]

Policies are updated regularly.

Some users get assigned access to certain devices and some will be removed.

 

[Goal]

To track what changes were made in the policy

 

Environment

Release : 3.4

Component : PRIVILEGED ACCESS MANAGEMENT

Resolution

Syslog and session logs (Sessions > Logs) will have records of policy updates (PAM-CMN-2192 messages), creations (PAM-CMN-2193) and deletions (PAM-CMN-1484).

Note that in a cluster environment, any primary site node can perform these changes, but each node will show changes made while logged on to that node only. You will have to review the session logs of each primary site cluster node. If you have Syslog or Splunk integration, and all primary site nodes point to the same Syslog or Splunk server, you should perform your searches on the Syslog or Splunk server.

Look for following keywords.

Created policy.User: X;Host: Y
Updated policy.User: X;Host: Y
Association between user X and device Y deleted

 

Syslog showing creation of policy for user "CN=PAM Admin1,OU=PAM-Admins,DC=kimlabs,DC=net"

Sessions log showing Policy creation.

 

 

Syslog showing Policy Update.

Sessions log showing Policy Update

 

Syslog showing Policy removal.

Sessions log showing policy removal