Centrify Add-on for Splunk
Splunk Certified
Overview
Details
As the only industry-recognized leader in both Privileged Identity Management and Identity-as-a-Service, Centrify provides a single platform to secure every user’s access to apps and infrastructure in today’s boundaryless, hybrid enterprise through the power of identity services.
The Centrify Add-on for Splunk categorizes event log data captured from Centrify privileged access activity and normalizes these events for Splunk Common Information Model (CIM) compatibility. This allows real-time analysis and risk mitigation to identify a potential breach in progress.
Key Benefits:
• Minimize the risk associated with privileged access
• Centralize visibility across enterprise deployments
• Easily import categorized data sets from privileged activity
• Leverage existing investments in SIEM and alert tools without additional costs
Centrify Infrastructure Services Splunk Solution Brief:
https://www.centrify.com/resources/centrify-infrastructure-services-for-splunk/
The Centrify Add-on for Splunk categorizes event log data captured from Centrify privileged access activity and normalizes these events for Splunk Common Information Model (CIM) compatibility. This allows real-time analysis and risk mitigation to identify a potential breach in progress.
Key Benefits:
• Minimize the risk associated with privileged access
• Centralize visibility across enterprise deployments
• Easily import categorized data sets from privileged activity
• Leverage existing investments in SIEM and alert tools without additional costs
Centrify Infrastructure Services Splunk Solution Brief:
https://www.centrify.com/resources/centrify-infrastructure-services-for-splunk/
Please find a post on Centrify Community , that'll help you with integrating Centrify Server Suite events into Splunk.
Link to the post:
http://community.centrify.com/t5/Community-Tech-Blog/Integrating-Centrify-Server-Suite-with-SIEM-Tools-Part-2/ba-p/23982
Also, note that you have link at the bottom to an Integration guide that goes into more details of the Centrify Server Suite and Splunk Integration.
Release Notes
Version 2.2
Oct. 16, 2017
- Changed categorization of Centrify Infrastructure Services Audit events to centrify_css_winlog & centrify_css_syslog sourcetypes
- Added the feature to replay session from Splunk with Centrify Infrastructure Services
- Changed the name to Centrify Add-On for Splunk from Centrify Splunk Add-on