Centrify Add-on for Splunk
Admins: Please read about Splunk Enterprise 8.0 and the Python 2.7 end-of-life changes and impact on apps and upgradeshere.
Overview
Centrify, a recognized worldwide leader in Identity-Centric Privileged Access Management solutions, offers its customers seamless integration with Splunk Enterprise Security. Through the Centrify Add-On for Splunk, customers who leverage Splunk to monitor, search, analyze, and visualize IT machine-generated data can now enrich that data with Centrify-specific events.
The Centrify Add-On for Splunk categorizes event log data captured from the Centrify Platform related to privileged access activity and normalizes these events for the Splunk Common Information Model (CIM). This allows real-time analysis and risk mitigation to identify a potential breach in progress.
Key Features:
· Minimize the risk associated with privileged access abuse.
· Centralize visibility across enterprise deployments.
· Easily import categorized data sets from privileged user activity.
· Leverage existing investments in SIEM and alert tools without additional costs.
The Centrify Add-On for Splunk categorizes event log data captured from the Centrify Platform related to privileged access activity and normalizes these events for the Splunk Common Information Model (CIM). This allows real-time analysis and risk mitigation to identify a potential breach in progress.
Key Features:
· Minimize the risk associated with privileged access abuse.
· Centralize visibility across enterprise deployments.
· Easily import categorized data sets from privileged user activity.
· Leverage existing investments in SIEM and alert tools without additional costs.
Release Notes
Version 2.3.0
March 29, 2018
- Fixed Issues to make the App compatible w/ Centrify Infrastructure Services 2017.1, 2017.2 and 2017.3 versions
Version 2.2
Oct. 16, 2017
- Changed categorization of Centrify Infrastructure Services Audit events to centrify_css_winlog & centrify_css_syslog sourcetypes
- Added the feature to replay session from Splunk with Centrify Infrastructure Services
- Changed the name to Centrify Add-On for Splunk from Centrify Splunk Add-on
Version 2.1
Sept. 15, 2016
Version 2.0
Aug. 19, 2016
The Centrify Add-On V2.0 for Splunk:
- Deprecated the Centrify Splunk Insight Application
- This Add-On helps normalize the Centrify Server Suite events into Splunk and at the same time make it CIM complaint