| Server IP : 85.214.239.14 / Your IP : 18.221.213.213 Web Server : Apache/2.4.62 (Debian) System : Linux h2886529.stratoserver.net 4.9.0 #1 SMP Tue Jan 9 19:45:01 MSK 2024 x86_64 User : www-data ( 33) PHP Version : 7.4.18 Disable Function : pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare, MySQL : OFF | cURL : OFF | WGET : ON | Perl : ON | Python : ON | Sudo : ON | Pkexec : OFF Directory : /proc/3/root/proc/2/task/2/root/proc/2/task/2/root/lib/python3/dist-packages/ansible_collections/cyberark/pas/rulebooks/ |
Upload File : |
- name: Demo rules with CyberArk syslog as source
hosts: localhost
sources:
- cyberark.pas.syslog:
host: 0.0.0.0
port: 1514
rules:
- name: Check For User Suspension Event, Then Disable The User and Notify
condition: event.cyberark.syslog.audit_record.Severity == "Error" and event.cyberark.syslog.audit_record.MessageID == "5"
action:
run_playbook:
name: disable_user.yml
extra_vars:
username: "{{ event.cyberark.syslog.audit_record.Issuer }}"
- name: Check For PTA irregular IP OR irregular Hours Access and Notify
condition: event.cyberark.DeviceEventClassID == "25" or event.cyberark.DeviceEventClassID == "23"
action:
run_playbook:
name: pta_disable_notify.yml
extra_vars:
username: "{{ event.cyberark.suser }}"
#username: "{{ event.cyberark.suser | ansible.builtin.regex_search('^[a-zA-Z0-9_]+') }}"
eventname: "{{ event.cyberark.DeviceName }}"
eventurl: "{{ event.cyberark.PTALink }}"
station: "{{ event.cyberark.shost }}"