Centrify Add-on for Splunk
Overview
Details
The Centrify Add-on for Splunk categorizes event log data captured from Centrify privileged access activity and normalizes these events for Splunk Common Information Model (CIM) compatibility. This allows real-time analysis and risk mitigation to identify a potential breach in progress.
Key Benefits:
• Minimize the risk associated with privileged access
• Centralize visibility across enterprise deployments
• Easily import categorized data sets from privileged activity
• Leverage existing investments in SIEM and alert tools without additional costs
Centrify Infrastructure Services Splunk Solution Brief:
https://www.centrify.com/resources/centrify-infrastructure-services-for-splunk/
Please find a post on Centrify Community , that'll help you with integrating Centrify Server Suite events into Splunk.
Link to the post:
http://community.centrify.com/t5/Community-Tech-Blog/Integrating-Centrify-Server-Suite-with-SIEM-Tools-Part-2/ba-p/23982
Also, note that you have link at the bottom to an Integration guide that goes into more details of the Centrify Server Suite and Splunk Integration.
Release Notes
Version 2.3.0
- Fixed Issues to make the App compatible w/ Centrify Infrastructure Services 2017.1, 2017.2 and 2017.3 versions
Version 2.2
- Changed categorization of Centrify Infrastructure Services Audit events to centrify_css_winlog & centrify_css_syslog sourcetypes
- Added the feature to replay session from Splunk with Centrify Infrastructure Services
- Changed the name to Centrify Add-On for Splunk from Centrify Splunk Add-on
Version 2.1
Version 2.0
The Centrify Add-On V2.0 for Splunk:
- Deprecated the Centrify Splunk Insight Application
- This Add-On helps normalize the Centrify Server Suite events into Splunk and at the same time make it CIM complaint