PAM's View Password Report in Splunk

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

PAM (Privileged Access Manager) Admin is trying to run a similar report as our View Password Requests Report directly in Splunk.  

They are trying to understand what they need to filter on.

Resolution

Here is an example of splunk search, that key's on the type of "viewAccountPassword"

index=main source="<source> " sourcetype="<sourcetype>" host="<pamserver>" "type=viewAccountPassword" "metric DETAIL"
| rex field=_raw "adminUserID=(?<admin_user>[^\]]+)"
| rex field=_raw "TargetAccount.userName=(?<target_user>[^\]]+)"
| rex field=_raw "reasonDetails=(?<reason_details>[^\]]+)"
| rex field=_raw "TargetApplication.name=(?<target_application>[^\]]+)"
| rex field=_raw "TargetServer.hostName=(?<target_host>[^\]]+)"
| rex field=_raw "success=(?<success>true|false)"
| table _time, admin_user, target_user, target_application, reason_details, target_host, success
| sort -_time

This will generate a report similar to our "View Passwords Requests".

Note:  You will have to update: your index, your source, sourcetype and host to how Splunk is setup in your enviroment